Source: https://www.gifas.de/en/privacy/
Timestamp: 2019-04-26 08:58:14+00:00

Document:
With this policy statement, we would like to inform you about the nature and extent, as well as the purpose and legal basis of personal data processing on this website and any other online presence in social media networks. In addition, we would also like to communicate our information obligations for the use of personal data in our company.
The data controller, as defined by the EU general data protection regulation (GDPR) and other national data protection laws of member states, as well as other data protection regulations, is the company responsible named in the website legal notice.
We collect and process our users’ personal data only to the extent necessary to operate a functioning website and deliver our company’s services. This data is only processed with your consent or as far as it is permitted or required by a statutory provision.
For us, the security of your personal data has a high priority. We therefore protect your data by applying technical and organisational measures to prevent any misuse. The measures adopted are regularly checked and adapted to the current technical circumstances. In addition all employees are committed to secrecy in accordance with Article 28 GDPR.
• Art. 6, sec.1 (b) GDPR: processing necessary for the performance of a contract or pre-contractual measures, such as sales or services contracts or calls for tender.
• Art. 6, sec.1 (f) GDPR: processing necessary for pursuing the legitimate interests of our company, e.g. passing on data to postal services or accountants. This also includes the saving of information on usage of our website for the purpose of its optimization.
The transfer of your personal data to third parties is also based on the permissions mentioned above and is only carried out within the scope of an order processing agreement or other non-disclosure obligations, as far as they exist. These include persons with a duty of professional secrecy or shipping providers. If data is transferred to a third country outside the European economic area, appropriate guarantees are provided by the recipients, in acc. with Art. 44 ff GDPR, e.g. certification within the Privacy Shield programme.
Personal data is only stored and processed for the period required for fulfilment of the processing purpose. After this time, your data is deleted or blocked, insofar as we are no longer bound by any statutory requirement of retention.
If we came into contact with you through a contractual relationship, we will send you the newsletter with product information to maintain our legitimate interests in acc. with Art. 6, sec.1 (f) GDPR in conjunction with § 7 sec. 3 Law against Unfair Competition. You can object to the use of your e-mail address for advertising purposes. For this purpose, each newsletter has an unsubscribe function.
For sending our newsletter, we use the external service provider CleverReach. The provider maintains a database, in which we can view information on registrations and objections to or revocations of consent. The documentation serves the maintenance of our legitimate interests in acc. with Art. 6, sec.1 (f) GDPR, by enabling us to provide a newsletter which is user friendly and legal, e.g. relating to obligations to produce proof.
Should you provide us with your contact details in the form of business cards at trade fairs or other events, we will use these details to make contact with you. This includes the sending of a catalogue and/or some form of direct contact from our company. When your details are recorded in our CRM system, you will receive a separate confirmation e-mail informing you of this and offering you a simple opportunity to reject this processing of your data. We regard the contact after receiving a business card as a pre-contractual measure in acc. with Art. 6, sec.1 (b) GDPR, i.e. an expression of interest in a service/product offered. You can withdraw your consent to the processing of your personal data for the purposes mentioned above at any time.
If we are contacted directly (e.g. by contact form, e-mail, telephone or via social media networks) the user’s personal data will be used to process the inquiry, in acc. with Art. 6, sec.1 (b) GDPR, i.e. for the performance of a contract or pre-contractual measure. To do so, your data is fed into a customer relationship management system (CRM). Please note that the GoBD (Principles of Regular Data Processing-supported Accounting Systems) obliges us to archive e-mails; e-mails sent to us can therefore not be completely deleted (from our e-mail archiving system). Information transferred to our website from our contact form is securely encrypted, in accordance with the stipulations contained in Art.13 sec. 7 of the TMG (German Telemedia Law).
The legal basis for the integration of said fonts and videos is the preservation of our legitimate interest in accordance with Art. 6 para. 1 lit. f DSGVO.
Every time our server is accessed, we collect access data, (log files) on the basis of our legitimate interests in acc. with Art. 6, sec.1 (f) GDPR. This includes the name of the website accessed, date and time of access, data file transferred and data volume, notification of success or failure of the data retrieval, browser type and browser version, operating system, referrer URL (previously visited site) and your IP address.
Log files are collected for security reasons (e.g. investigation of criminal offences) and stored for a period of seven days, after which time they are deleted. Should any data be required for evidence after this time, it will be exempt from deletion until the relevant case has been clarified.
To guarantee fast and stable connection, hosting has been outsourced to an external provider that processes the above-mentioned log files in accordance with our instructions. The legal basis for this is the pursuit of our legitimate interests in acc. with Art. 6, sec.1 (f) GDPR in conjunction with Art. 28 GDPR.
Cookies are files saved on the user’s computer system by the internet browser. When a person accesses this website, cookies are saved in their browser memory.
You can prevent cookies being saved in your browser, though this can restrict the function of the page. A better choice would be to delete all cookies after the end of each browser session, a function which operates without restriction on our website and prevents you being recognised on your next visit, with all the positive and negative consequences this involves.
We use technical cookies as this is necessary for the operation of the services provided and is in accordance with Art. 6, sec.1 (f) GDPR, i.e. in our legitimate interests.
Technical cookies are used to recognise users when they return to the website, so that any language settings, shopping baskets, etc. can be saved after the end of a session.
More detailed information on conditions of use and data protection can be found in the Google Analytics terms of service or the Google Analytics privacy and terms overview (https://policies.google.com/technologies/ads). We also point out that this website uses the Google Analytics code “gat._anonymizeIp();” to guarantee the anonymous collection of IP addresses (so-called IP masking).
Google is certified in accordance with the Privacy Shield agreement and therefore guarantees compliance with European data protection legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
You have the right to obtain information on any personal data which is stored about you.
You have the right to receive the data requested in a commonly used electronic form.
You have the right to demand from the controller the rectification of any personal data concerning you which is inaccurate. Taking into account the purpose of the processing, you have the right to demand that any incomplete personal data be completed.
1) The accuracy of the personal data is contested by you, for a period enabling the controller to verify the accuracy of the personal data in question.
2) The processing is unlawful and you reject the deletion of the data, requesting instead the restriction of their use.
4) you, as the data subject, have lodged an objection to the processing of the data, pending verification of whether the legitimate interests of the controller override your own.
If processing has been restricted, the personal data in question shall, with the exception of storage, only be processed with the data subject’s (i.e. your) consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. We will inform you before the restriction is lifted.
1) The personal data are no longer needed for the purpose for which they were originally collected or otherwise processed.
2) You have withdrawn your consent and there is no further legal basis for the processing.
3) You have lodged an objection to the processing and there are no overriding legitimate grounds for the processing.
5) The personal data have to be erased to comply with a legal obligation in Union or Member State law to which the controller is subject.
6) The personal data were collected in relation to the use of web services.
You have the right to withdraw your consent to the processing of your personal data. The withdrawal of consent does not affect the lawfulness of any processing which was based on previously given consent before its withdrawal.
If you have invoked your right to rectification, erasure or limitation of the processing, we are obliged to inform all those who have received this data of the rectification, erasure or limitation of the data in question, unless this involves a disproportionate effort or expenditure, or it is impossible.
As the data subject, you have the right to object to the processing of your personal data, which is based on the points (e) or (f) of Article 6 (1), at any time on grounds relating to your own particular situation; including profiling based on those points. The controller shall then no longer process your personal data unless compelling legitimate grounds for the processing can be proven, which override the interests, rights and freedom of you as the data subject, or which show the processing to be necessary for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you, as the data subject, have the right to object at any time to the processing of your personal data for such marketing. This also includes profiling to the extent that it is related to such direct marketing.
3) is based on your explicit consent.
Decisions referred to in paragraph 2 must not be based on special categories of personal data referred to in Art. 9, sec.1 GDPR, unless points (a) or (g) of Art. 9, sec. 2 apply and suitable measures to safeguard your rights, freedoms and legitimate interests as the data subject are in place.
You have the right to complain to a supervisory authority, irrespective of any other administrative or judicial remedy, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data contravenes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy in acc. with Art. 78 GDPR.
Should you not provide us with personal data which we require for contractual purposes, the general consequence of this will be that the contract cannot not be concluded. We can inform you of whether provision of personal data, in individual cases, is a statutory requirement or a contractual necessity and of the possible consequences of the failure to provide such data.

References: Art. 6
 Art. 6
 Art. 44
 Art. 6
 § 7
 Art. 6
 Art. 6
 Art. 6
 Art.13
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 9
 Art. 9
 Art. 78