Source: https://orofin.com/en/privacy-policy/?utm_campaign=orofin_kick_off&utm_content=&utm_medium=email&utm_source=newsletter
Timestamp: 2019-04-25 10:42:36+00:00

Document:
LEONHARD KURZ Stiftung & Co. KG (hereinafter "KURZ") respects any concerns regarding the protection of the security and privacy of personal data.
This Data Protection Statement applies equally for all Internet offerings (“Website(s)”) for which KURZ is considered the controller (see Section 2).
As a general rule we do not process our users’ personal data unless it is necessary to enable us to present a functioning website and our content and services. As a matter of course, our users’ personal data is not processed without the user’s consent. One exception would be cases in which it is not possible to obtain the consent beforehand for practical reasons, and/or if processing of the data is permitted by legal provisions.
If it is necessary to process personal data in order to fulfil a contract to which the data subject is a contracting party, our activities are governed by Art. 6 Para. 1 letter b GDPR as the legal basis. This also applies for processing activities essential for pre-contractual arrangements, in response to enquiries about our products or services, for example.
If it is essential to process personal data to protect the vital interests of the data subject or another natural person, the legal basis therefor is Art. 6 Para. 1 letter d GDPR. If such processing is essential in order to safeguard the legitimate interests of our company or of a third party and these interests are not outweighed by the interests, basic rights and basic freedoms of the data subject, Art. 6 Para. 1 letter f GDPR serves as the legal basis therefor. This applies e.g. to collections and analyses for statistical purposes, which we carry out to optimise our web offerings.
Every time they are accessed, our Websites automatically capture a range of general data and information, which is stored temporarily in a server’s logfiles.
In rare cases, this (technical) data in the logfiles may be personal data. The temporary storage of the IP address by the system is necessary to enable the Website to be delivered to the user’s computer. To allow this, the user’s IP address has to remain stored for the duration of the session. As a rule, however, we only use this data if it is absolutely necessary for technical reasons to ensure operation and protect our Websites from attacks and misuse; in pseudonymised or anonymised form it is also used for purposes of advertising, market research and to help us design our services to meet current needs. This is why users’ IP addresses are stored as a technical precaution for a period not exceeding 7 days. They may be stored for onger. In this case, the users’ IP addresses are erased or masked so that it is no longer possible to make a connection to the accessing client. This data is not stored together with any of the user's personal data.
The legal basis for processing data where the user’s consent has been given is Art. 6 Para. 1 letter a GDPR. The legal basis for processing data associated with the contact form is Art. 6 Para. 1 letter f GDPR. If the email indicates an intent to enter into a contract, a further legal basis for processing is constituted by Art. 6 Para. 1 letter b GDPR. The data is erased as soon as it is no longer needed to fulfil the purpose for which it is collected. You can object to the further processing of your data at any time.
You will find the necessary forms for job applications on our Websites; you can use these to provide us with your job application information (e.g., name, address, email address etc.).
In order to be able to process your application effectively, we use the applicant management system provided by our partner HR4YOU Solutions GmbH & Co. KG (“HR4YOU”). For this purpose, when you initiate an online application you are redirected to a domain operated by our partner HR4YOU, where you can enter your information. HR4YOU carries out order processing tasks on our behalf and is accordingly permitted to process the information you provide solely in accordance with our instructions. To ensure that this is the case, we have entered into a number of agreements regarding both technical and organisational measures with HR4YOU to ensure that we are able to guarantee that your application data will be protected. If your application leads to an employment contract, the information you have transmitted to us may be stored by us in your (digital) personnel file for purposes of the usual organisational and administrative process, subject to the applicable legal regulations.
The legalbasis for processing data from the job application forms is Art. 6 Para. 1 letter b GDPR. You can object to the further processing of your data at any time.
If you have given your consent, we may also process and use your personal data from the application procedure (surname, first name, residential address, email address, telephone numbers, cover letter, letter of motivation, curriculum vitae, qualifications, references, information from the application interview) for a maximum period of 1 year after the application procedure is completed. This is done to ensure that we can contact you for professional purposes and possibly let you know of a job offer from us. This data can be accessed by employees in the Human Resources department and the decision makers in the respective technical departments. You are entitled to withdraw your consent at any time without giving a reasons and with effect for the future. If you do withdraw your consent, your information will not be considered for subsequent vacancies. Your information will then be erased in keeping with the applicable provisions of the law.
We would point out here that risks are also generally associated with the transmission of data across the Internet (see Section 14.1).
As part of our B2B webshop, we process your customer data in all cases to help us manage the associated business processes. On the one hand, this involves the data that is needed directly for the ordering process, such as billing and delivery addresses, which may contain personal data. If such is necessary to enable the order to be carried out, this data may also be transmitted to the transport service provider we have tasked with delivery. On the other hand, the data each customer enters in the B2B webshop user administration system themself is also processed. This enables us to track which user has submitted which purchase order. The legalbasis for processing your personal data in the B2B webshop is Art. 6 Para. 1 letter b GDPR, since this data is used for purposes of fulfilling a contract within the meaning of Art. 6 Para. 1 letter b GDPR. You can object to the further processing of your data at any time, unless we are obliged to continue storing it to comply with statutory, incorporation-related or contractual retention requirements. For more information about the cookies we use in the B2B webshop, please refer to Section 12 “Cookies” in this Data Protection Statement.
On our Website, you will find the option to subscribe to our free newsletter. When you register to receive the newsletter, the information you enter in the input mask - that is to say at least your email address - is transmitted to us. In order to be able to process information for the registration process, we obtain your consent and refer you to this Data Protection Statement. The consents to distribution are obtained on the basis of Art. 6 Para. 1 letter a, Art. 7 GDPR. For the registration to receive our newsletter, we use the “double opt-in” procedure. This means that after you have given us your consent to send you the newsletter as part of the registration process, we send you a confirmation email to your email address, in which we ask you to confirm your registration. If you do not provide this confirmation within 72 hours, your registration is deleted automatically. If you confirm your wish to receive the newsletter, we store your data until you unsubscribe from the newsletter. The only purpose for which this data is stored is to enable us to send you the newsletter. We also store your IP addresses and times when you send us your registration and confirmation to prevent your personal data from being misused (e.g., registration for the newsletter using a different email address). This other personal data which is collected in the course of the registration process is typically deleted after a period of seven days.
You can withdraw your consent for us to send you the newsletter at any time. To notify us of your withdrawal, you simply need to click on the link which is provided in every newsletter email or send an email to newsletter@kurz.de.
It is our stated aim to continually optimise our online offering for you. For the purposes of analysing and evaluating the behaviour of visitors to our Websites, we use Google-Analytics.
For more information about the collection and use of your data by YouTube and your rights in this regard and setting options for protecting your privacy, please refer to the notes on data protection there under policies.google.com/privacy.
Most of the cookies we use are of the type known as “session cookies”. They are deleted automatically at the end of your visit to our Website. Other cookies remain stored on your end device until you delete them. These cookies enable us to recognise your browser again the next time you visit.
You can object to the capture of your data by Google Analytics by clicking on the following link. An “opt-out” cookie is set, which prevents your data from being captured when you visit this Website in future: Deactivate Google Analytics. Deleting all of the cookies in your browser also deletes the corresponding opt-out cookie.
We use the “Activate IP anonymisation” function on this Website. However, this entails your IP address being truncated by Google beforehand within the member states of the European Union or in other signatory states of the Agreement of the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On the instructions of the operator of this Website, Google will use this information to analyse your use of the Website, to compile reports on Website activities and to provide additional services for the Website operator associated with Website and Internet use. The IP address that is transmitted by your browser as part of the Google Analytics function is not merged with other data by Google. The cookies stored by Google Analytics is deleted at the latest after 14 months.
In the context of Google-AdWords we use the "Conversion-Tracking” analysis service on our Websites.If you have come to our Website via a Google advertisement, a cookie is placed on your computer. These conversion cookies lose their validity after 30 days and are not used to dentify you personally. If you visit certain pages on our Websites and the cookie has not expired, we and Google can see that you as a user have clicked on one of the advertisements that were placed with Google and were consequently redirected to our page.
Google uses the information collected with the aid of the conversion cookies to prepare visit statistics for our Website. From these statistics we learn the total time spent by users who have clicked on our advertisement, and also which pages of our Website were subsequently accessed by the respective user. However, neither we nor other providers who use GoogleAdwords in our advertising receive any information that enables us to identify users personally.
You can prevent the conversion cookies from being installed by making corresponding settings in your browser, for example with the browser setting that deactivates the automatic setting of cookies generally, or which specifically only blocks the cookies from the “googleadservices.com” domain.
This function serves to present to visitors to the Website interest-specific advertisements for “similar target groups” within the Google advertising network. The browser of the Website user stores cookies which render the user recognisable when they return to Websites which belongs to the Google advertising network. On these pages, the user can then be presented with advertisements relating to the content the visitor viewed previously on Websites that use the Google Remarketing function. By its own account, Google does not collect any personal data in this process.
If you still do not wish to have the Google Remarketing function on your computer, you can deactivate it generally by making the corresponding settings at www.google.com/settings/ads.
For more detailed information about Google Remarketing and the Google data protection statement, please visit: www.google.com/privacy/ads/ .
For the purposes described in Section 3.1, your data is also transmitted to the responsible offices of KURZ and to affiliates of KURZ if this is necessary in order to fulfil the stated purposes and thus conforms to the legal permission regulations or if you have given your consent for the transmission.
The Worldwide Web is a publicly accessible system. If personal data is divulged online, this data is transmitted at the user’s risk. The data can be lost in transit or may fall into the hands of unauthorised third parties. KURZ has adopted measures to guarantee the confidentiality and security of your personal data.
You can configure your browser so that you are informed as soon as cookies are to be set, so that you can accept them globally or on a case by case basis, or reject them globally (see Section 12).
You can see whether an Internet connection is secure, among other things, from the address. If the address begins with https, this indicates that the connection is secure (e.g. ….de). We are making every effort to convert all of our Websites to https where this has not yet been done. Another indicator is the symbol of a locked padlock in the bottom icon tray of your browser.
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular within the Member State of your habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Social buttons from social networks are used on our website. This serves to preserve, in the course of the weighing of interests, the optimal marketing of our offer. In order to increase the protection of your data when you visit our website, these buttons are not fully integrated into the page as plug-ins, but only by using a HTML link. This integration ensures that no connection to the servers of the provider of the respective social network is established when a page of our website containing such buttons is viewed. By clicking on one of the buttons, a new window of your browser opens and calls up the page of the respective service provider, where you can (if necessary after entering your login data) for example, press the Like or Share button. The purpose and scope of the data collection and the further processing and use of the data by the providers on their pages as well as the possibility of contact and your relevant rights and setting options for the protection of your privacy can be found in the data protection information of the providers.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 7
 Art. 78