Source: https://arvato-supply-chain.com/en/data-protection
Timestamp: 2019-04-26 12:04:48+00:00

Document:
is responsible for processing your data on the website. You can contact the data protection officer of Arvato Distribution GmbH using the above postal address with the addition “To the data protection officer” or using the email address contact-scm@arvato.com.
Arvato Distribution GmbH (hereinafter “we” or “us”) process personal data in accordance with the provisions of GDPR and the German Federal Data Protection Act (hereinafter “BDSG”).
2. Which data is recorded?
In connection with your visit to the website and exclusively where technically, contractually or legally required, your data will be processed in order to display the desired content and to facilitate your use of the website’s features.
When you visit the website, information is collected automatically from the computer used to access it (hereinafter “access data”). This access data includes details about the content you request on the website and your usage behavior as well as information about the browser type and version, operating system, internet service provider, the date and time of the use of the website, the websites visited previously and websites newly accessed via our website and the IP address of the computer (also referred to as “server log files”). Pseudonymous usage profiles are created from the access data using web tracking and are analyzed. It is therefore not possible for us to identify you personally.
In principle, you can use the website’s features, such as finding out about us, without entering your data. However, it is necessary to enter data such as your name, address, email address or telephone when using certain features, such as contacting us or signing up to a newsletter. Mandatory information is usually marked with an *.
Cookies are used on the website. Cookies are small text files that are stored on your computer when you visit a website. The cookies saved are determined by the browser you use. When the relevant website is accessed again, the web browser sends the content of the cookies back and allows the user to be recognized. Cookies are limited to a certain time period (e.g. once the browser session ends). In addition, you can configure and delete cookies as you desire using your browser’s settings. Deleting them prematurely can however lead to the features of the website only being available to a limited extent.
The website distinguishes between two types of cookies: functional cookies and optional cookies. Functional cookies are used to provide the website in a technically and functionally flawless way (e.g. identification and authentication of the user, language settings, display of images). Without the functional cookies, the features of the website are only available to a limited extent. The optional cookies help to optimize features of the website by recording user behavior and analyzing it in the form of statistics.
In principle, cookies serve as online recognition only and are not personalized. Cookies can include personal data if the information created by the cookies is combined with further data, such as the access data in accordance with Section 2 (e.g. when using web tracking). In principle, such combination only takes place in pseudonymized form. A personal combination is only permitted if you have consented to it or where allowed by law.
4. Which data is collected and for what purposes?
For the functionality of the website, the implementation of security analyses and to defend against attacks, the server log files are collected automatically as part of the access data in accordance with Section 2 accrued by the computer system accessing it and during the use of the website and are stored temporarily. The server log files are not stored alongside other data. We use the server log files for statistical analyses, to analyze and rectify technical disruptions, to combat attempts at attacks and fraud, as well as to optimize the functioning of the website.
The legal basis for the collection of server log files is Art. 6 (1) (f) GDPR. Legitimate interests lie in the functionality of the website, the performance of security analyses and the defense against dangers.
After loading the websites, the server log files are stored on the web server and the IP address contained therein is deleted after seven days at the latest in accordance with the requirements of the Telecommunications Act (“TKG”). Other regulations apply if concrete suspicion exists and storage going beyond this is legally required for the purpose of evaluation and clarification.
You have the right, for reasons that result from your particular situation, to submit an objection to the processing of your data. If you would like to assert your right to object, please contact the contact address specified under point 1.
On the website, there is the option to contact us via a contact form. If you take this opportunity, you will provide us with your data such as your email address, telephone number, first name and surname and your query (also referred to as “contact details”). The contact details are only stored and used to process your query (e.g. questions about products and services).
The legal basis for the processing of your contact details is usually Art. 6 (1) (f) GDPR. There are legitimate interests in the processing of your specific query and further communication. If the purpose of you getting in contact is to enter into a contract (e.g. to avail of our services), the legal basis for the contract shall be Art. 6 (1) b GDPR.
After processing your query and ending further communication, your contact details will be deleted. Other regulations apply if the purpose of getting in contact is to enter into a contract. For this purpose, the data will only be stored until the contractual and/or legal storage periods (currently 6 to 10 years) are complete.
You have the right, for reasons that result from your particular situation, to submit an objection to the processing of your contact details. If you would like to assert your right to object, please contact the contact address specified under point 1. If you object, the processing of your query cannot continue. Other regulations apply if the storage of your contact details is required to initiate a contract or to execute a contract.
We are legally obliged under GDPR to process your data in order to assert data subject rights. The legal basis for this is Art. 6 (1) (c) GDPR.
We store the correspondence held with you in relation to the assertion of data subject rights for a period of three years. This excludes evidence of identity such as a marked copy of your personal ID, if you provide us with one. This will be deleted once your identity has been confirmed.
The processing of your data is required in order to satisfy your data subject rights. In this respect, you have no right to object.
Via the website, you can download content we have provided, such as studies or white papers on current topics from our areas of business. When you download, your contact details will be sent to us via the registration screen and stored. We will also record the date and time of your download when doing so. Downloading is voluntary, free of charge and generally independent from any other features of the website. You can see further details in the contractual provisions (link to T&Cs from the footer).
The download of free content is an online feature we offer you. The legal basis for the processing of your related data is the contract under Art. 6 (1) (b) GDPR.
Your data will be stored for as long as is necessary to execute the contract concerning the downloading of free content. The contract ends automatically once the download has completed successfully. After the end of the contract, your data will only be stored until the contractual and/or legal storage periods (currently 6 to 10 years) are complete.
The processing of your data is required in order to fulfil the contract governing the downloading of free content. In this respect, you have no right to object.
You can register for individual events via the website. In general, the events consist of presentations on current topics and developments in our areas of business. Our portfolio of services plus new products and services may also be presented. Your contact details are sent to us via the registration form and are processed for your participation. We will also record the date and time of your registration when doing so. Your data is only forwarded to third parties (e.g. event organizers, hotels) exclusively where this is necessary for your participation in the event.
Participation in events is an online feature we offer you. The legal basis for the processing of your related data is the contract under Art. 6 (1) (b) GDPR.
You data will be stored for as long as is necessary for participation in the individual events. After your participation, your data will only be stored until the contractual and/or legal storage periods (currently 6 to 10 years) are complete.
The processing of your data is necessary in order for you to participate in the specific event. In this respect, you have no right to object.
As part of our business customer relationships, we occasionally conduct customer surveys in order to record satisfaction and to improve our services. The customer survey is intended for our business customers, but we generally store your contact details in our customer database if you act as a contact person. We use your contact details to invite you to take part in the customer survey. Participation is voluntary and you have the option to communicate to us at any time that you would no longer like to receive invitations to take part in customer surveys in the future. Your contact details are generally no longer required for analysis, as the survey results consist of purely statistical information. It is then no longer possible to identify you personally.
The legal basis for the processing of your contact details is Art. 6 (1) (f) GDPR. There are legitimate interests in customer care and retention and in the improvement of our services.
In principle, survey results will be stored for the duration of the business relationship. Other provisions apply in the event that the survey results consist of purely statistical data.
You have the right, for reasons that result from your particular situation, to submit an objection to the processing of your contact details. If you would like to assert your right to object, please contact the contact address specified under point 1.
The web tracking services are regularly provided by service providers who process the usage profile according to our instructions, and not for their own purposes. This is ensured based on order processing contracts. If the service providers have offices outside of the European Union or the European Economic area (hereinafter “EU/EEA”), then what is called a third-country transfer takes place. This is permitted if you have consented to it, we have provided guarantees for a level of data protection in line with the European standard or the European Commission has classified the third country as a secure third country. The third-country transfer of the respective service is detailed below. You can find further information about the recipients of your data and the third-country transfer in Sections 6 and 7.
The website uses the Google Tag Manager. This service is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google Inc.). The Google Tag Manager can be used to manage the web tracking services integrated into this website and other services using so-called "tags" (placeholders for a website code). The Google Tag Manager only implements these tags. No cookies are used and no personal data is collected by the Google Tag Manager. The Google Tag Manager only triggers other tags, which in turn may collect data. However, the Google Tag Manager does not access this data.
This website uses the Google Analytics service. Google Analytics is supplied by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). Google Analytics creates a pseudonymized usage profile in order to optimize the user-friendliness of the website. Pseudonymity is ensured by the IP address being shortened before your data is transmitted to Google and it not being possible for conclusions about your identity to be drawn. The pseudonymized usage profile is analyzed after transmission for the purpose of optimizing user-friendliness. It is not combined with other Google data. By means of an order processing contract, we ensure that Google only processes the data in line with our instructions.
A third-country transfer takes place through the use of Google Analytics. With certification under the EU-US Privacy Shield, however, Google ensures that the same level of data protection as in Europe is guaranteed during the third-country transfer. You can find further details about the third-country transfer under Section 7.
The legal basis for the collection and analysis of pseudonymous usage profiles is Art. 6 (1) f GDPR/Section 15 (3) German Telemedia Act (TMG). We have legitimate interests in the optimization of the user-friendliness of the website and measuring coverage.
Data that is collected and analyzed when using web tracking services is generally stored until you object to its use. The storage duration of cookies is generally no longer than 24 months.
You can object to the use of Google Analytics at any time by changing your browser settings and/or clicking on the following link to download and install the available browser plug-ins: https://tools.google.com/dlpage/gaoptout?hl=en.
In addition, you can centrally deactivate web tracking by all providers who are part of the “Your Online Choices” self-regulatory initiative via the link http://www.youronlinechoices.eu.
We also use your access data under Section 2 to activate tailored advertising on our websites and the newsletter of Arvato Supply Chain Solutions. This allows us to recognize click fraud and to activate advertisements that are as relevant to you as possible. The advertising that is presented to you is chosen based on your access data that accrues when you use the websites and the newsletter (called “re-targeting”).If you have given us your consent to personalized advertising, we will process your data on this basis to the extent you have permitted. Without your consent, we will only process your data using pseudonyms, i.e. the data that accrues as part of online advertising is not combined with your other data (e.g. contact details).
You can register for a free newsletter on the website. So that we can check your identity and see that you have registered, we use what is called the double opt-in procedure. In this procedure, the technical data of your registration is stored (e.g. time and date). For the registration, your data will also be sent to us via the registration form and processed further by service providers to send the newsletter via email. In principle, this is only your email address. Further information is optional.
contact details shared by you and voluntary information (name, email, telephone, company-specific information, e.g. company name and industry).
Your data accrued is combined and stored as a personal usage profile in our CRM customer database.
The legal basis for online advertising using pseudonymous usage profiles is Art. 6 (1) f GDPR/Section 15 (3) TMG. The legitimate interest lies in the tailored presentation of advertising and offering of our products and services via the website and the newsletter.
The legal basis for individualized advertising is your consent in accordance with Art. 6 (1) a GDPR/Section 7 (2) 3 Unfair Competition Prevention law (hereinafter “UWG”). The newsletter aims to approach (potential) business customers of Arvato Supply Chain Solutions with advertising to inform them of its own products and services. Registration for our newsletter is voluntary and generally independent of any other features of the website.
The pseudonymized usage profiles created for online advertising are stored for a duration of 4 years, unless you object to the processing of your data for the processing of the online advertising. Google cookies generally become invalid after 30 days.
The individual interests recorded through the use of the newsletter are saved until you withdraw your consent. Due to legal evidence obligations, we store your permission granted and your revocation for three years after receipt.
by blocking cookies for conversion tracking by setting up your browser so that cookies are blocked by the domain “www.googleadservices.com”.
In addition, you can centrally deactivate online advertising by all providers who are part of the “Your Online Choices” self-regulatory initiative via the link http://www.youronlinechoices.eu.
You can revoke your consent to the processing of your data to receive individualized advertising and therefore the newsletter at any time with future effect by using the deregister link or by sending your revocation to Arvato Distribution GmbH via email contact-scm@arvato.com or via post “An der Autobahn 22, 33333 Gütersloh”.
When your online application for a specific job vacancy is received, your data will be processed for recruitment purposes. In the employment contract initiation phase, your potential employer has an interest in ensuring that you possess the specialist skills and personal qualities required for the vacant position. The legal basis for the processing of your data is the contract under Art. 6 (1) (b) GDPR.
Your data is only processed where required for the recruitment decision. After finishing the online application, your data will be deleted after the end of the statutory storage period (currently usually six months).
The processing of your data is required for the recruitment decision, i.e. (pre-)contractual purposes. There is thus no option to object.
We include external services and content on our website. If you use such a service or if you are shown third-party content, technical communication data will be shared between you and the provider in question.
In addition, it may transpire that the provider of the services or content in question will process your data for its own further purposes. To the best of our knowledge, we have configured third-party services and content from providers who knowingly process data for their own purposes in such a way that either stops communication for purposes other than the presentation of content or services on our website, or communication only takes place if you actively decide to use the service. Since we have no influence on the data collected by third parties and its processing, we cannot provide any binding information about the process and scope of the processing of your data.
In our company, the departments that require your data to fulfil the purposes presented under Section 4 will receive access to it. The service providers we commission may also receive access to your data (also referred to as “processors”). The requirement to observe instructions, data security and the confidential handling of your data by these service providers is ensured by means of processing contracts.
The forwarding of data to further recipients such as advertising partners, providers of social media services or law enforcement authorities (referred to as “third parties”) only takes place where required by statutory provisions or where you have given your permission. In connection with receipt of our newsletter, you have consented to your data also being forwarded to the subsidiaries of our corporate group Arvato Supply Chain Solutions for the purpose of tailored advertising. The confidential handling of your data and compliance with data protection regulations is ensured by means of internal data protection guidelines and joint data security management.
7. Is my data processed in a third country?
Insofar as the service providers and/or third parties named under Section 6 have branches outside of the EU/EEA, this can lead to your data being transmitted to a country where a level of data protection suitable for the EU/EEA cannot be guaranteed. Such a level of data protection can be ensured by means of a suitable guarantee, however. Standard contractual clauses provided by the EU Commission are an example of a suitable guarantee. Any guarantees may be waived by way of exception if you give your permission or the third-country transfer is necessary to execute our contractual relationship. The EU Commission has also recognized certain third countries as secure third countries, meaning that the company does not need to make suitable guarantees in these cases.
A third-country transfer takes place through the use of Google services for web tracking and online advertising. In principle, the data will be processed by Google within the EU. Google will only be able to access the data in the USA in exceptional cases, such as due to technical maintenance. With certification under the EU-US Privacy Shield, however, Google ensures that the same level of data protection as in Europe is guaranteed during this third-country transfer. You can find more information here about this certification here https://www.privacyshield.gov/welcome.
A third-country transfer may also take place via our newsletter in the case of targeted advertising. Some of our subsidiaries are based outside of the EU/EEA (e.g. USA or Shanghai). We have entered into standard contractual clauses with these subsidiaries in accordance with the EU Commission’s stipulations. You can find more information here https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2004:385:0074:0084:DE:PDF.
You have the right to be informed about the personal data we have stored about you at any time. Should data about you be incorrect or no longer up-to-date, you have the right to request its correction. You also have the right to request the deletion or restriction of processing of your data in accordance with Art. 17 and 18 GDPR. You may also have the right to receive the data you have provided in a common and machine-readable format (also known as “right to data portability”).
If you have granted consent to the processing of personal data for certain purposes, you can revoke this consent at any time with future effect. The withdrawal should be addressed to the company via the contract address specified under Section 1.
In accordance with Art. 21 GDPR, you have the right, for reasons that result from your particular situation, to submit an objection against the processing of your personal data in accordance with Art. 6 (1) f GDPR at any time. You have the right to object to the processing of your personal data for the purpose of direct advertising at any time. The same applies for automated procedures when using individual cookies, provided that these are not absolutely necessary for the provision of the website.
You can also contact the data protection authorities responsible for your place of residence.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 17
 Art. 21
 Art. 6