Source: http://cwf-gmbh.de/index.php/en/27-unternehmen/112-data-privacy-policy
Timestamp: 2019-04-21 14:04:37+00:00

Document:
More than 1,5 gigawatt of carrier system for open-fieldphotovoltaic installations all over Europe are evidence ofcustomer satisfaction and our ability to adapt our system to themarket requirements.
We are pleased about your interest in our company. Data protection has a very high priority for the CWF GmbH and we take our position as controller within the meaning of the GDPR very seriously.
This includes in particular name, address(es), bank details, e-mail address, telephone or fax number or client IP address.
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Supervisory authority means an independent public authority which is established by a Member State pursuant to Article 51.
We use personal data in particular for the processing of orders, the delivery of goods and the provision of services as well as the processing of payment. We also use personal data fort he communication with the data subject, to update our data records and to maintain the data subject's customer account. We also use personal data to improve our platform, to prevent or detect misuse, in particular fraud, or to enable third parties to perform technical, logistical or other services on our behalf. The collection, storage and processing of personal data is particularly necessary because this is the only way we can provide the service requested by the data subject. The personal data is stored for the duration of the processing of the order and execution of the contract or to the extent required by legal regulations (e.g. tax regulations).
Personal data are used for the justification of the contract, the content design and implementation or settlement of the contract(Art. 6 para. 1 lit. b) GDPR). In addition, personal data will only be processed if we have received the consent of the data subject (Art. 6 para. 1 lit. a) GDPR). This consent will be recorded.
Furthermore, personal data will only be processed and collected by default to the extent necessary for the intended purpose. If the processing of the personal data of the data subject is based on a consent, he has the right to revoke this consent at any time. Art. 7 para. 3 GDPR is expressly referred to.
The use of the (publicy accessible) website of the (publicly accessible) website is generally possible without providing personal data. If parts of the website (e.g. the order process) are dependent on the provision of personal data in order to ensure the function or to be able to fulfil the data subject will be requested to enter the personal data at the appropriate place and can decide on the entry.
Insofar as personal data is collected via forms on our pages (e. g. name, address or e-mail address), this is always done on a voluntary basis and with the express consent of the data subject, which will be recorded.
You can contact us by e-mail, fax or telephone. We store the data transmitted to us and provided by you for processing the request.
(7) the client IP address.
The data is stored each time a data subject accesses a page of our offer and each time our website is accessed and is deleted as soon as it is no longer required for the purpose of collection or processing.
The temporary storage of the personal data is carried out on the legal basis of Art. 6 para. 1 lit. f) GDPR. The legitimate interest lies in the provision of our website. The data subject may object to the processing at any time.
In addition, as far as we can possibly do, personal data will not be collected. In doing so, we adhere to the principle of data avoidance, which we take very seriously. We treat personal data confidentially and in accordance with legal data protection regulations.
The scope of the personal data communicated to us is appropriate to the purpose and limited to what is necessary for the purpose of the processing. The processing of personal data is carried out for the performance of the contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The same applies if the data subject voluntarily contacts us at their own request and initiative.
Persons under the age of 16 should not transmit any personal data to us or consent to such data without the consent of their legal representative(s).
In the case of concrete indications of an illegal action or if we are requested to do so by legal authorities, we will hand over the data available to the competent legal authorities for prosecution.
For the performance of the contract the data will be transferred on to the shipping company commissioned with the delivery, as far as this is necessary for the delivery of the ordered goods. For the processing of payments, the payment data required for this – insofar as this is necessary with regard to the type of payment and the extent of the transfer – shall be passed on to the credit institution commissioned with the payment and, if applicable, to the commissioned and selected payment service provider. Your personal data will only be processed within the EU.
The personal data is also exchanged exclusively for the performance of the contract. The exchange of personal data serves for the performance of the the contract between CWF GmbH and the data subject. This includes in particular the company contact data and the data of the contact person of the contract partner.
All personal data on our website is protected by technical and organisational measures against loss, destruction, external access, modification and distribution. We would like to point out that data transmission over the Internet (e g. communication by e-mail or infiltration of the visitor's computer (e.g. the computer of the data subject) by third parties) may have security gaps. A complete protection of data against access by third parties is not possible for us.
We are not responsible for personal data collected and processed by third parties.
We collect personal data if the data subject voluntarily provides it in connection with his order, when contacting us (e.g. via contact form or e-mail) and when opening a customer account and the necessary registration.
We collect and store all information that the data subject enters on our website or transmits to us in any other way. In addition, personal data will only be processed and collected by default to the extent necessary for the intended purpose.
The data subject has the right to object at any time to the processing of his personal data in accordance with Art. 6 para. 1 lit. 1 f) GDPR. Art. 21 DSGVO is expressly referred to.
This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on the users’ computers, to help the website analyze how users use the site. The information generated by the cookie about the use of the website by users will be transmitted to and stored by Google on servers in the United States. The IP-anonymisation is activated on this website and the users’ IP address will be truncated within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases the whole IP address will be first transferred to a Google server in the USA and truncated there. The IP-address that your browser conveys within the scope of Google Analytics will not be associated with any other data held by Google.
An opt-out cookie is stored on your mobile device. In case the users delete the cookies in this browser, they have to click the link again in order to deactivate Google Analytics.
We use the “Google Maps” component on our website in combination with the so-called “Share function". “Google Maps” is a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter “Google.” Each time this component is called up, Google sets a cookie in order to process the user configuration and data when the page with the integrated “Google Maps” component is displayed. As a general rule, this cookie is not deleted by closing the browser, but rather expires after a certain time, as long as it is not previously manually deleted by you.
The principles concerning the collection and processing of personal data also apply in particular to registration for our newsletter.
Reference is expressly made to Art. 6 para. 1 lit. a) and Art. 7 para. 4 GDPR, in particular lit. a)-c).
The use of the data to receive the information by e-mail can be revoked at any time with effect for the future by unsubscribing from the newsletter.
the existence of automated decision-making, including profiling, referred to in Art. 22 Abs. 1 and 4 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Art. 46 relating to the transfer.
We provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, we may charge a reasonable fee based on administrative costs.
the data subject objects to the processing pursuant to Art. 21 Abs. 1 and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 Abs. 2.
the personal data have been collected in relation to the offer of information society services referred to in Art. 8 Abs. 1 GDPR.
the data subject has objected to processing pursuant to Art. 21 Abs. 1 pending the verification whether the legitimate grounds of the controller override those of the data subject.
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with At. 16. Art. 17 Abs. 1 and Art. 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Art. 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 Abs. 1 lit. e) or f) GDPR, including profiling based on those provisions.
We will no longer process the personal data unless we demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
is based on the data subject's explicit consent.
Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Art. 9 Abs. 1 GDPR, unless Art. 9 Abs. 2 lit. a) or g) GDPR applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.
In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.
Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

References: Art. 7
 Art. 6
 Art. 6
 Art. 21
 Art. 6
 Art. 7
 Art. 22
 Art. 46
 Art. 21
 Art. 21
 Art. 8
 Art. 21
 Art. 17
 Art. 18
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 77