Source: https://www.xplm.com/privacy-policy/
Timestamp: 2018-08-18 12:34:46
Document Index: 398666786

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 46', 'Art. 21', 'Art. 6', 'Art. 9', 'Art. 17', 'Art. 9', 'Art. 89', 'Art. 16', 'Art. 17', 'Art. 18', 'Art. 6', 'Art. 6', 'Art. 6']

XPLM · Privacy policy
IV. Provision of the website and generation of web server logfiles
VI. Registration for SIG login (member area for Special Interest Groups)
VII. Registration for the Support Portal
VIII. Contact form and contact via email
IX. Application form
The controller as defined in the Regulation (EU) 2016/679 (General Data Protection Regulation), the data protection laws of the EU Member States, and any other legal regulations governing data protection is:
Email: xplm(at)xplm.com
Website: https://www.xplm.com
– hereinafter referred to as: “we” / ”us” –
Email: patrick.storelli(at)xplm.com
Tel.: +49 6204 98092 269
Personal data means any information relating to an identified or identifiable natural person (hereinafter: ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Personal data is generally only processed by us to the extent necessary to provide a functional website and website content, as well as to provide our services.
If we obtain the permission of the data subject to process their personal data, processing is done in accordance with Art. 6(1) subparagraph 1 point (a) General Data Protection Regulation (GDPR).
If the processing of personal data is necessary in order to fulfil the requirements of a contract with the data subject, it is done in accordance with Art. 6(1) subparagraph 1 point (b) GDPR. This also applies to processing procedures performed before conclusion of the contract that are necessary to carry out measures taken upon the request of the data subject.
If the processing of personal data is necessary in order to meet a legal obligation we are subject to, Art. 6(1) subparagraph 1 point (c) GDPR forms the legal basis for this processing.
In the case that the processing of personal data is necessary in order to protect the vital interests of the data subject or another natural person, our right to process data is based on Art. 6(1) subparagraph 1 point (d) GDPR.
If it is necessary to process data in order to guard the legitimate interests of the controller or a third party and this outweighs the interests or fundamental rights and freedoms of the data subject, then Art. 6(1) subparagraph point (c) GDPR forms the legal basis for processing.
We generally delete all personal data as soon as the reason for storing it expires.
We may, however, continue to store the data if this is allowed for by European Union or Member State lawmakers in EU-regulations, national laws, or other regulations we are subject to. In this case, the data is deleted as soon as a storage period specified in these legal standards has expired, unless it is necessary to continue storing the data in order to conclude a contract or fulfil the requirements of a contract with the person concerned.
Every time our website is accessed our system will automatically record data from the terminal device (such as: desktop computer, tablet, smartphone) and the internet connection of the user accessing the site.
Type and version of the web browser used by the user
Type and version of the operating system used by the user
The IP address assigned to the user
URL of the pages that are accessed on our website
The URL of the previously accessed website, if the user has been directed to our website by clicking a link or landed on our website through an automated process (so-called referrer)
The above data is also stored in our system’s web server logfiles. This data is stored separately from other collected or still to be collected personal data of the user.
It is necessary for our system to temporarily store the IP address so that the website can be delivered to the user’s terminal device. For this purpose, the user’s IP address must be stored for the duration of the session.
Data is stored in the web server logfiles in order to ensure the functionality of the website. Furthermore, the data also allows us to optimise the website and ensure the security of our information technology systems.
Herein lies our legitimate interest in processing data pursuant to Art. 6(1) subparagraph 1 point (f) GDPR as well.
The legal basis for temporarily storing data and web server protocol files is formed by Art. 6(1) subparagraph 1 point (f) GDPR.
The data will be deleted as soon as it is no longer needed in order to reach the aforementioned goals.
When data is collected and stored for the purpose of making the website available to the user, deletion will consequently occur as soon as the respective session is over.
If data is stored in the web server logfiles, it will be deleted after 24 hours at the latest.
The collection of data in order to make the website available and the storage of data in web server logfiles is absolutely necessary for the operation of the website. Considering this, users do not have the right to object to such data collection, nor do they have the right to have the collected data deleted prematurely.
Our website uses cookies. Cookies are text files that the web browser stores on the user's terminal device. When a user accesses a website, a cookie can be stored on the terminal device of the user. This cookie contains a unique character string that makes it possible to clearly identify the web browser when the website is accessed again.
We use cookies that are technically necessary to make our website more user-friendly. Being able to identify the web browser that has accessed the site, even after a page change, is essential to some elements of our website.
Only the following data is stored and transmitted in the cookies we place:
Technically necessary cookies are used to simplify the use of websites for users. Some of the features of our website cannot be offered without the use of cookies. In order to make these features available, it is essential to be able to identify the web browser even after a page change, which is something made technically possible by the use of cookies.
SIG login (member area for Special Interest Groups)
Without cookies, users would have to enter and confirm their login information (user name, password) every time they switch pages (for example: click on a button). In order to avoid this, we need to use cookies for all features involved in providing the SIG login.
At the same time, these purposes also constitute a legitimate interest in processing personal data pursuant to Art. 6(1) subparagraph 1 point (f) GDPR.
The legal basis for processing personal data using cookies is constituted by Art. 6(1) subparagraph 1 point (f) GDPR.
4. Storage period / prevention of further data processing by the data subject / premature deletion of the collected data
As a user, you do in principle have full control over the use of cookies, which may still be limited in individual cases – depending on the functional scope of the web browser used. Specifically speaking, you can deactivate or limit the storage of cookies by changing the cookie settings in your web browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically.
If cookies are deactivated for our website, it may not be possible to use all of the features of the website to their full extent.
On our website, we offer users the opportunity to register for SIG login by entering personal data.
Special Interest Groups (SIG) are informational events that we hold regularly for customers and partners addressing various topics associated with PLM.
User group [meaning the SIG area(s) to be registered]
Furthermore, reference is made to the validity of the concrete privacy policy and to the fact that the user can view it at any time by clicking the linked URL https://www.xplm.com/privacy-policy.
Within the context of the SIG login, we provide interested companies with supplementary informational material, particularly on past events and topics.
Data collected during registration is used to assign every registered account to a legal and/or natural person with absolute certainty. Furthermore, data collection also serves the purpose of making specific information available to specific user groups.
Additionally, we also use the collected data to determine which user groups are especially interested in our services.
This is the case for data collected during the registration process when the registration for a SIG login is cancelled or modified.
If you have given your consent for the processing of personal data, you can withdraw it at any time. In order to withdraw a given consent, you can also use the contact form available on every page of our website or you can contact us directly via email, for instance at xplm(at)xplm.com.
Furthermore, you have the option to cancel your registration at any time by deleting the registered user account yourself through the account settings or letting us know that you want your registered user account deleted. You can also use the contact form available on every page of our website for such a notification or you can contact us directly via email, for instance at xplm(at)xplm.com.
In the first case, your user account as well as all data collected in relation to it will be immediately deleted, within 14 days at the latest, as long as there are no legal obligations that would prevent deletion.
In the case that the data stored about you is incorrect, incomplete, or there are other justified reasons to modify it, you can change the data – with the exception of the email address – at any time or have us change the data, either by changing the data yourself in your user account or informing us of your desire to change the data, specifying the data to be changed. In the latter case, we will perform the changes within 7 days. As soon as the changes have been made, the old data will be automatically deleted.
Furthermore, you have the option to cancel your registration at any time by letting us know that you want your registered user account deleted. You can also use the contact form available on every page of our website for such a notification or you can contact us directly via email, for instance at xplm(at)xplm.com.
There is a contact form on our website that can be used to contact us electronically. If a user decides to use this option, the data entered into the form will be transmitted to us and stored. The mandatory data required is:
and – if the user decides to enter this additional information in individual cases:
Before the contact form is sent, your consent to process the data will be obtained.
Prior to giving consent, you will also be informed of your right to withdraw your consent at any time and that the lawfulness of processing based on your consent before its withdrawal will not be affected by the withdrawal.
Furthermore, reference is made to the validity of the concrete privacy policy and to the fact that it can be viewed at any time by clicking the linked URL https://www.xplm.com/privacy-policy.
Contact can also be made via the email addresses made available for this purpose, particularly xplm(at)xplm.com. In this case, the personal data of the user transmitted with the email will be stored.
Reference is made to the applicability of this privacy policy in all emails sent by us. Furthermore, a clickable link to the URL https://www.xplm.com/privacy-policy, where this privacy policy can be viewed at any time, is also clearly displayed behind the phrase “Privacy Policy”.
The personal data from the contact form is used exclusively to process the contact attempt. In cases where contact is made via email, this is also our legitimate interest in processing the data.
The legal basis for processing data conveyed by the user by sending an email is formed by Art. 6(1) subparagraph 1 point (f) GDPR. If the user seeks to conclude a contract when they contact us via email, this constitutes additional legal grounds for data processing pursuant to Art. 6(1) subparagraph 1 point (b) GDPR.
The collected data will be deleted as soon as it is no longer needed for the purposes for which it was collected. For personal data from the contact form and data sent via email, this is the case when the respective conversation with the user comes to an end. The conversation ends once it can be assumed from the circumstances, that the matter involved has been conclusively resolved.
The user can withdraw the consent given for the purpose of using the contact form at any time. If users contact us via email, they can object to the storage of their personal data transmitted in this respect at any time. In such cases, it will not be possible to continue the conversation.
Notification of withdrawal of consent given or objection to further processing of personal data can also be conveyed through our contact form or directly via email, for instance at xplm(at)xplm.com.
In the case of a withdrawal or objection, all personal data stored when contact is made will be deleted.
Furthermore, we also provide an application form on our website that can be used for electronic applications (online applications). If a user decides to take advantage of this option, the data entered into the form will be transmitted to us and stored. The mandatory data required is:
Selection for the offered positions
and – if the user decides to upload this additional information in specific cases:
Application documents in electronic format
Prior to giving consent, you will also be informed of your right to withdraw consent at any time and that the lawfulness of processing based on consent before its withdrawal will not be affected by the withdrawal.
The personal data from the application form is used exclusively to process your application.
Since the application aims to conclude an employment contract, this constitutes an additional legal basis for data processing pursuant to Art. 6(1) subparagraph 1 point (b) GDPR.
The collected data will be deleted as soon as it is no longer needed for the purposes for which it was collected. This is the case for personal data from the application form, when the respective application has ended. An application has ended once it can be assumed from the circumstances that the affected matter has been conclusively resolved.
The user can withdraw the consent given while using the application form at any time. In this case, it will not be possible to continue processing the application.
Notification of withdrawal of consent given can also be conveyed to us through the contact form available on every page of our website or directly via email, for instance at xplm(at)xplm.com or jobs(at)xplm.com.
In the case of a withdrawal, all personal data stored during the course of the application will be deleted.
We make use of Google Analytics on our website, a web analysis service of Google LLC (hereinafter: Google). Google Analytics uses so-called “analysis cookies”, which are stored on the user's terminal device by the web browser and allow us for an analysis of the usage of the website by our users. The information generated by the cookies regarding the usage of our website will generally be transmitted to and stored on a server of Google in the USA.
We use Google Analytics with the add-on „anonymizeIp“. As a result, the IP address assigned to the user will be processed shortened (e.g.: 12.214.31.144 becomes shortened to 12.214.31.0). As the ip address qualifies the collected data as personal data, this quality gets lost by the means of shortening the ip address, with the result that no personal will be processed afterwards. As a general rule, the shortening of the IP address effected by Google takes place within the European Union or in countries which are contracting parties to the Agreement on the European Economic Area. Only in exceptional cases the complete IP address will initially be sent to a server of Google in the USA and be shortened there subsequently. In any case, IP addresses processed by means of Google Analytics will be stored separately and will not be combined with other data stored by Google.
Google processes all data to be processed by means of Google Analytics on our behalf exclusively and in compliance with our instructions within the framework of a processor contract concluded with us.
In respect to the exceptional cases in which personal data are transmitted to the USA, Google further has submitted to the Privacy Shield agreement between the European Union and the USA and has been certified within its framework. For additional information please refer to the following link:
Additional information about Google Analytics is available at:
Data protection (overview):
Contact details of Google:
Due to the large amount of inquiries, Google recommends to use the electronic forms available on Google Help (https://www.google.com/support), because only notifications that are sent by means of the contact forms provided reach the corresponding employee purposefully and swiftly.
We use Google Analytics for the purpose of analyzing the usage of our website and continuously improving individual features, offers and the user experience. The statistical evaluation of the user behavior on our website allows us to improve our offer and to design it more effective and interesting for our users.
Herein lies our legitimate interest in the processing of the aforementioned data performed by Google, simultaneously.
The legal basis for processing data by means of Google Analytics is Art. 6(1) subparagraph 1 point (f) GDPR.
The collected data will be deleted as soon as they are no longer needed for the purposes for which they were collected.
5. Prevention of further data processing by the data subject
As mentioned, the data processing by means of Google Analytics is performed using cookies.
Apart from that, you can prevent the collection of your data regarding the usage of our website and the IP address assigned to you (i.e. to your internet connection) as well as the processing of this data by Google by downloading and installing the web browser add-on available via the following link:
As of now (May 2018), this add-on is available for the web browsers Microsoft Internet Explorer 11, Google Chrome, Mozilla Firefox, Apple Safari and Opera exclusively.
Additionally, we use Google Maps, an online map service of Google LLC (hereinafter: Google), on parts of our website.
If you open pages of our website on which contents of Google Maps are embedded, the IP address assigned to you (i.e. to your internet connection), terminal device-related information as well as information regarding your use of our website will be transmitted to and stored on a server of Google in the USA. If you have a Google user account and are logged in in such during the access of Google Maps contents, your data can be matched with your user account directly. We have no impact on the details and scope of the processing of your personal data by Google. One cannot rule out the possibility that Google creates usage profiles with your data and uses the data for the purpose of personalized advertising, market research and/or adequate designing of its websites and services.
For this reason, you – prior to being able to access the relevant pages of our offices by means of a click on ‘directions’ through the navigation of our website on https://www.xplm.com/offices – will be informed explicitly by a pop-up notification that we embed contents of Google Maps on the pages of our offices and that the access of these pages will therefore lead to the processing of your personal data by Google, on which we have no impact regarding the details and scope of processing. Furthermore, reference is made to the validity of the concrete privacy policy and to the fact that it can be viewed at any time by clicking the linked URL https://www.xplm.com/privacy-policy.
Google has submitted to the Privacy Shield agreement between the European Union and the USA and has been certified within its framework. For additional information please refer to the following link:
Google Terms of Service:
Google Maps Terms Of Service:
We use Google Maps for the purpose of providing interactive maps and route planning features related to our offices to our users in order to improve the user experience.
Herein lies our legitimate interest in the processing of your data by Google, simultaneously.
The legal basis for processing data by means of Google Maps is Art. 6(1) subparagraph 1 point (f) GDPR.
4. Prevention of further data processing by the data subject / premature deletion of the collected data
If you want to prevent the processing of personal data relating to you based on the embedding of Google Maps, you should not access the relevant pages of our offices.
Apart from that, you can object to the processing of personal data relating to you, in particular if the processing is done in order to create usage profiles. In order to claim your right to objection, you have to contact Google (please refer to the aforementioned contact details.
In addition we use videos of the online video service YouTube, which are embedded on our website and in consequence, are (still) stored on https://www.youtube.com and accessed at that domain by your terminal device, but can be watched directly on our website.
The website https://www.youtube.com is provided by YouTube LLC (hereinafter: YouTube).
Every YouTube video is embedded in ‘privacy-enhanced mode‘, the consequence being that – according to information of the Google LLC, the parent company of YouTube – YouTube does not use cookies to track your viewing behavior, meaning that your viewing activity is not collected to personalize your viewing experience.
Additionally, we disabled tracking for advertising purposes by YouTube by adding our website to YouTube’s ‘Tag for child-directed treatment’ page.
Apart from the aforementioned, we have no impact on the processing of your personal data by YouTube, regarding the details and scope of processing.
The parent company of YouTube, Google LLC, has submitted to the Privacy Shield agreement between the European Union and the USA and has been certified within its framework, including YouTube. For additional information please refer to the following link:
Additional information about YouTube is available at:
Contact details of YouTube:
We use YouTube videos for the purpose of providing a more interesting design to our offer and in order to improve the user experience.
Herein lies our legitimate interest in the processing of your data by YouTube, simultaneously.
The legal basis for processing data by means of YouTube videos is Art. 6(1) subparagraph 1 point (f) GDPR.
If you want to prevent the processing of personal data relating to you based on the embedding of YouTube videos to the highest possible extent, you should not watch the videos embedded on our website.
Apart from that, you can object to the processing of personal data relating to you, in particular if the processing is done in order to create usage profiles. In order to claim your right to objection, you have to contact YouTube (please refer to the aforementioned contact details).
If your personal data is processed, you are considered a data subject as defined by GDPR. You are at the same time entitled to the following rights in relation to the controller (us):
You can receive confirmation from us of whether we are processing personal data relating to you.
In the case that we are processing personal data relating to you, you can require access to this personal data and the following information:
Furthermore, you also have the right to request information on whether the personal data relating to you are transmitted to a third country or to an international organisation. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
If personal data we are processing relating to you are inaccurate, you have the right to obtain without undue delay the rectification.
You can require that we restrict the processing of personal data relating to you, if
you have objected to processing pursuant to Art. 21(1) GDPR pending the verification whether our legitimate grounds outweigh yours.
If the processing of personal data relating to you has been restricted, this data – aside from its storage – will only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
If the processing has been restricted, we will inform you before the restriction of processing is lifted.
You can require that we erase the personal data relating to you without undue delay and we are obligated to erase this data without undue delay as long as one of the following grounds apply:
you withdraw your consent on which the processing is based according to Art. 6(1) subparagraph 1 point (a), or Art. 9(2) point (a) GDPR and there is no other legal ground for the processing;
the personal data have to be erased for compliance with a legal obligation in the law of the European Union or Member States to which we are subject;
If we have made the personal data public and are obliged pursuant to Art. 17(1) GDPR to erase the personal data, we, taking account of available technology and the cost of implementation, are obliged to take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
for reasons of public interest in the area of public health in accordance with Art. 9(2) points (h) and (i) as well as Article 9(3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
We are obliged to communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Art. 16, Art. 17(1) and Art. 18 GDPR to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right to be to informed about those recipients if you require it.
You have the right to receive the personal data relating to you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from us, where the processing:
is based on consent pursuant to Art. 6(1) subparagraph 1 point (a) GDPR or Article 9(2) GDPR or on a contract pursuant to Art. 6(1) subparagraph 1 point (b) GDPR; and
That right shall not adversely affect the rights and freedoms of others.
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data relating to you which is based on Art. 6(1) subparagraph 1 point (e) or (f) GDPR, including profiling based on those provisions.
We no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which overweigh your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data relating to you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
8. Right to Withdraw the Consent to the Processing of Personal Data
If you have given consent to processing of your personal data for one or more specific purposes, you have the right to withdraw your consent at any time.