Source: https://www.bowa-medical.com/index.php/en/privacystatement.html
Timestamp: 2019-04-19 00:39:14+00:00

Document:
We do not guarantee that the information provided on our web pages is complete, correct and up-to-date in all cases, even if it has been prepared and updated to the best of our knowledge and belief. This also applies to all links this website directly or indirectly refers to. We are not responsible for the content of a site that is accessed through such a link. We reserve the right to make changes or supplements to the provided information without prior announcement.
We are delighted that you are interested in our company. The protection of your data is very important to us. In principle, it is possible to use the website without entering any personal data. However, if any persons wish to use our company’s services via our website, it may be necessary to process personal data. If processing of personal data is necessary and if there is no legal basis for such processing, we generally obtain the consent of the person concerned.
We always process personal data, for example the name, address, email address or telephone number of a person, in accordance with the General Data Protection Regulation and in compliance with the country-specific data privacy provisions that apply to our company. Our company issues this Privacy Statement to inform the public of the type, scope and purpose of the personal data that we collect, use and process. In addition, this Privacy Statement informs people concerned of their rights.
To meet our responsibility as a holder of personal data, our company has implemented numerous technical and organisational measures in order to ensure that the personal information processed via this website is protected as comprehensively as possible. However, online data transfers may always be exposed to gaps in security, meaning that absolute protection cannot be guaranteed. For this reason, every person affected is welcome to provide us with personal data by other means, for example via telephone.
Our Privacy Statement is based on the terms that were used by the European regulator for issuing directives and regulations when executing the General Data Protection Regulation (GDPR). Our Privacy Statement is intended to be easy to read and understand for the public, our customers and business partners alike. To guarantee this, we would like to explain the terms used in advance.
Personal data is all information that refers to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
A data subject is an identified or identifiable natural person whose personal data is processed by the data controller.
Processing is any procedure carried out with or without the help of automated processes or such series of processes in connection with personal data such as the collection, recording, organisation, ordering, storage, adjustment or modification, reading, querying, use, publication via transmission, distribution or another form of provision, reconciliation or combination, restriction, erasure or destruction.
Restriction of processing means the marking of stored personal data with the goal of restricting its further processing.
‘Controller’ or ‘data controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
A data processor is a natural or legal person, authority, facility or another body that processes personal data on behalf of the controller.
‘Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
Every data subject can contact our data protection officer directly at any time for any questions and concerns about data protection.
The data subject can stop our website from placing cookies at any time by adjusting the settings in the website used and therefore permanently prevent the placement of cookies. In addition, cookies already placed can be deleted at any time via a web browser or other software programs. This is possible in all modern browsers. If the data subject deactivates the placement of cookies in the web browser they use, it is possible that not all functions of our website will be usable to their full potential.
Our website uses social plugins (“plugins”) of the social networks facebook.com and linkedin.com, which are operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA and LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA ("LinkedIn”). These include the “Like” button on Facebook, as well as the “Share” button on LinkedIn.
If you access a page of our website that includes such a plug-in, your browser will establish a direct connection to the Facebook servers. Facebook delivers the content of the plug-in directly to the browser and embeds the content in the website.
LinkedIn will be able to attribute the visit to your Facebook or LinkedIn account. Should you interact with plugins, for example by clicking on the “Like” button or by writing a comment, the corresponding information will be communicated directly to Facebook or LinkedIn via your browser and saved there.
If you do not want Facebook or LinkedIn to allocate data collected through our website to your user account, you must log out of Facebook or LinkedIn before visiting our website.
On this website, data is collected for marketing and optimisation purposes using technology provided by etracker GmbH (www.etracker.com). Items created from this data may include a pseudonymous user profile. Cookies may be used for this purpose. Cookies are small text files that are saved locally in your browser’s memory. Cookies allow the web browser to be recognised. The data collected with etracker technology is not used to identify visitors to this website personally and is not kept alongside personal data of the bearer of the pseudonym, without the express consent of the data subject. Data collection and storage may be revoked at any time with future effect.
Every time our website is accessed by a data subject or an automated system, it collects a series of general data and information. This general data and information is stored in server log files. The information recorded can include: the type and version of the browser used, the operating system used by the accessing system, the website that the accessing system reached our website from (known as the ‘referrer’), the sub-sites that directed an accessing system to our website, the data and time of access to the website, an internet protocol address (IP address), the internet service provider of the accessing system and other similar data and information that is used to defend against danger in the event of attacks on our IT systems.
When using this general information and data, we will not draw any conclusions about the data subject. This information is actually required to correctly provide the content of our website, to optimise the content of our website and advertising for it, to guarantee the consistent functionality of our IT systems and the technology of our website as well as to provide the law enforcement authorities with the information required for criminal proceedings in the event of a cyber attack. This data and information collected anonymously is therefore evaluated by us statistically as well as for the goal of increasing data protection and data security in our company, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data in the server log files is stored separately from all personal data provided by a data subject.
In line with legal regulations, the website contains information that allows users to quickly contact our company electronically and to communicate with us directly, which also includes a general email address. Where a data subject makes contact with the data controller via email or a contact form, the personal data sent by the data subject is stored automatically. Such personal data provided to the data controller voluntarily by a data subject will be stored for the purpose of handling contact with the data subject. None of this personal data is forwarded to third parties.
The data controller only processes and stores personal data of the data subject for the period that is required to achieve the purpose of storage or insofar as this was envisaged by the European regulator and legislator or another legislator in laws or regulations to which the data controller is subject.
If the purpose of storage no longer applies or if a storage period prescribed by the European regulator and legislator or another legislator expires, the personal data will be blocked or deleted routinely and in line with statutory regulations.
Each data subject shall have the right granted by the European regulator and legislator to obtain from the controller confirmation as to whether or not personal data concerning them is being processed. If a data subject would like to take advantage of this right to confirmation, they can contact our data protection officer or another employee of the data controller to do so at any time.
In addition, the data subject has the right to be informed whether personal data has been transmitted to an external country or an international organisation. If this is the case, the data subject shall also have the right to obtain information about suitable guarantees in connection with the transmission.
If a data subject would like to take advantage of this right to information, they can contact our data protection officer or another employee of the data controller to do so at any time.
Each data subject affected by the processing of personal data shall have the right granted by the European regulator and legislator to request the immediate correction of inaccurate personal data concerning them. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
If a data subject would like to take advantage of this right to correction, they can contact our data protection officer or another employee of the data controller to do so at any time.
If one of the reasons stated below applies and a data subject would like to arrange the deletion of personal data that we have stored, they can contact our data protection officer or another employee of the data controller to do so at any time. Our data protection officer will organise the deletion to take place immediately.
The data subject has lodged an objection to the processing of the data in accordance with Art. 21 (1) GDPR and it has not yet been determined whether the legitimate interests of the controller outweigh those of the data subject.
If one of the requirement stated below applies and a data subject would like to arrange the restriction of personal data that our company has stored, they can contact our data protection officer to do so at any time. The data protection officer will arrange the restriction of processing.
The data subject affected by the processing of personal data shall have the right granted by the European regulator and legislator to obtain from the controller the personal data concerning them, which has been made available to a data controller by the data subject, in a structured, accessible and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, provided that the processing is based on consent in accordance with point (a) of Art. 6(1) GDPR or point (a) of Art. 9(2) GDPR or on a contract in accordance with point (b) of Art. 6(1) GDPR and processing is carried out by automated means, provided that processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In exercising their right to data portability pursuant to Art. 20(1) GDPR, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible, and provided that this does not impede the rights and freedoms of another person.
To assert the right to data portability, the data subject can contact the data protection officer or another employee at any time.
Each data subject affected by the processing of personal data shall have the right granted by the European regulator and legislator to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
In the event of revocation, we shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or such processing is necessary for the establishment, exercise or defence of legal claims.
Where we process personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing. This also applies to profiling that is connected with such direct marketing. Where the data subject objects to processing by our company for direct marketing purposes, we will no longer process the personal data for such purposes.
In addition, where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, the data subject, on grounds relating to his or her particular situation, shall have the right to object to such processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
To exercise the right to revocation, the data subject can contact the data protection officer at any time. In addition, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may also exercise their right to object by automated means using technical specifications.
Each data subject affected by the processing of personal data shall have the right granted by the European regulator and legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, insofar as the decision is not required to enter into or fulfil a contract between the data subject and the controller, or is permitted in line with Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests or which takes place with the explicit consent of the data subject.
If the decision is required for the initiation or fulfilment of a contract between the data subject and the controller or is based on the data subject's explicit consent, we shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.
If a data subject would like to exercise rights in relation to automated decisions, they can contact our data protection officer to do so at any time.
Each data subject affected by the processing of personal data shall have the right granted by the European regulator and legislator to revoke their consent to the processing of personal data at any time.
If the data subject would like to exercise their right to revoke consent, they can contact our data protection officer or another employee of the data controller to do so at any time.
The data controller collects and processes the personal data of applicants for the purpose of carrying out the application process. Processing may take place electronically. This applies in particular to when an applicant sends relevant application documents electronically, for example via email or via a web form located on the website, to the data controller. If the data controller signs an employment contract with an applicant, the data transmitted will be stored for the purpose of executing the employment relationship, in line with legal regulations. If the data controller does not sign an employment contract with the applicant, the application documents will be deleted automatically three months after notification of the rejection decision, provided that deletion does not oppose any other legitimate interests of the data controller. Other legitimate interests in this sense include a burden of proof in proceeding in accordance with the General Equal Treatment Act (Allgemeine Gleichbehandlungsgesetz, AGG).
Art. 6 I lit. a of the GDPR shall serve as the legal basis for processing procedures at our company, through which we obtain consent for a certain processing purpose. If the processing of personal data is required to execute a contract for which the data subject is a contractual party, such as is the case during processing procedures, which is necessary for the delivery of goods or the provision of another service or considerations, the processing is based on Article 6 I lit. b GDPR. The same applies for such processing procedures that are required to execute precontractual measures, such as in the case of requests for our products or services. If our company is subject to a legal obligation that makes the processing of personal data necessary, such as to satisfy tax obligations, the processing shall be based on point (c) of Art. 6 I GDPR. In rare cases, processing may be necessary in order to protect the vital interests of the data subject or of another natural person. For example, this would be the case were a visitor to our company to be injured and, as a result, their name, age, health insurance data or other vital information needs to be sent to a doctor, a hospital or other third parties. The processing would then be based on Article 6 I lit. d GDPR. Ultimately, processing procedures may be based on Article 6 I lit. f GDPR. Processing procedures that are not covered by any of the legal bases specified above are based on this legal basis, if the processing is required to grant a justified interest out our company or a third party, insofar as this does not outweigh the interests, fundamental rights and freedoms of the data subject. We are therefore permitted to carry out such processing procedures in particular, as they have been highlighted by the European legislator. This covers in particular the fact that a legitimate interest may be assumed in the case of the data subject being a client of the data controller (recital 47(2) GDPR).
If the processing of personal data is based on Article 6 I lit. f GDPR, our legitimate interest to carry out our business activity is for the benefit of the wellbeing of all of our employees and our shareholders.
The criterion for the storage of personal data is the relevant statutory storage deadline. After this period has expired, the relevant data will routinely be deleted, provided that it is no longer necessary for fulfilling or initiating contracts.
We draw your attention to the fact that the provision of personal data is often prescribed by law (e.g. tax regulations) or may result from contractual provisions (e.g. information about the contractual partner). Inter alia, it may be necessary when initiating a contract for a data subject to provide us with personal data then subsequently has to be processed by us. The data subject may for example be obliged to provide us with personal data if our company enters into a contract with them. Not providing personal data would result in the contract not being able to be entered into with the subject. Before the data subject provides personal data, the data subject must contact our data protection officer. On a case-by-case basis, our data protection officer shall explain to the subject whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data.

References: Art. 21
 Art. 6
 Art. 9
 Art. 6
 Art. 20

Art. 6
 Art. 6