Source: https://www.caparol.de/en/privacy-policy
Timestamp: 2020-07-10 23:00:46
Document Index: 738077277

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 12', 'Art. 13', 'Art. 38', '§ 38', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', '§ 195', '§438', '§ 147', '§ 257', '§ 238', '§ 147', '§ 257', '§ 238', '§ 147', '§ 257', '§ 238', 'Art. 28', 'Art. 29', 'Art. 28']

Privacy policy - Caparol
The controller in the sense of the General Data Protection Regulation (GDPR), of the data protection regulations holding good in the member states of European Union and of other regulations with a legal data-protecting character is the company specified in the imprint (in the following: "we" or "us" or "our").
Mr. Jens Engelhardt and his deputy Mr. Prof. Sven Kolja Braune,
c/o NOTOS Xperts GmbH
Heidelberger Str. 6
Tel: +49 6151-52010-0
Fax: +49 6151-52010-99
Website: www.notos-xperts.de
E-Mail: datenschutz@notos-xperts.de
Each data subject can turn at any time directly to our data protection officer with all questions and suggestions on data protection.
Our data protection information is based on the definitions which have been used by the European directive and order issuing office in formulating the General Data Protection Regulation (GDPR). The data protection information of the Muster GmbH should be easily read and understood not only by the general public but also by our customers and business partners. In order to ensure this, we would like to clarify in advance the definitions used.
• Data subject
• Restricting of the processing
• Pseudonymization
• Controller or party responsible for the processing
Responsible party or party responsible for the processing (hereafter responsible party) is the natural person or legal entity, authority, institution or other post, which alone or together with others decides on the purposes and means of the processing of personal data. If the purposes and means of the processing are laid down in European Union legislation or the legislation of the member states, then the responsible party or the particular criteria of the appointment of this responsible party in accordance with European Union legislation or the legislation of the member states can be provided.
• Order processor
Order processor is a natural person or legal entity, authority, institution or other post, which processes the personal data on the instructions of the responsible party.
• Recipient
• Third party
Third party is a natural person or legal entity, authority, institution or other post with the exception of the data subject, the responsible party, the order processor and those persons which are authorized under the direct responsibility of the responsible party or of the order processor to process the personal data.
Data protection, data security and data secrecy hold high priority for us. The durable protection of your personal data, of your company data and of your business secrets is especially important for us.
The processing of your personal data is carried out in conformity with the requirements of the General Data Protection Regulation and in conformity with the country-specific data protection regulations holding good for us. With the aid of this data protection information we wish to inform you on the nature, scope and purpose of the personal data processed by ourselves. In addition, we clarify for you with the aid of this data protection information the rights to which you are entitled.
We have realized technical and organizational measures in order to ensure an appropriate level of protection of the personal data processed via this website. For security reasons and to protect the transmission of sensitive information, such as requests via a contact form that you send to us as the provider, this website uses SSL encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL encryption is activated, the data you transmit to us cannot be seen by third parties. Nevertheless, fundamentally Internet-based data transmissions can have security loopholes so that absolute protection cannot be guaranteed.
5. General statements on the legal fundamentals
6. General statements on deletion of data and duration of storing
The personal data of the data subject are deleted or disabled as soon as the purpose for which the data was stored lapses. In addition, storage can take place if this was stipulated by the European or national legislatures in orders, laws or other regulations in accordance with European Union law to which the responsible party is subject. Disabling or deletion of the data is also carried out if a storage period prescribed by the standards as named expires unless there is a necessity for the continued storage of the data for the concluding or fulfilling of a contract.
7. Collecting of general data and information
Our website collects a range of general data and information each time the website is called by a data subject or an automated system. This general data and information is stored in the log files of the server. Able to be collected are: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website, from which an accessing system reaches our website (so-called referrer), (4) the sub-websites, which are steered to on our website via an accessing system, (5) the date and time of an access to the website, (6) an Internet-protocol-address (IP-address), (7) the Internet service provider of the accessing system and (8) other similar data and information, which serve the warding off of hazards in the case of attacks to our IT systems.
In using this general data and information we draw no conclusions about the data subject. Much more is this information needed (1) to be able to deliver out the content of our website correctly, (2) to permit the optimization of the content of our website and of the advertising for this, (3) to ensure the durable functionality of our IT systems and of the technology of our website and (4) to be able to make available to the law enforcement authorities the information necessary for criminal prosecution in the case of a cyber attack. This anonymously collected data and information is evaluated by us on the one hand statistically and on the other hand with the objective of increasing the data protection and the data security in our company in order finally to ensure an optimal level of protection for the personal data processed by ourselves. The anonymous data of the server-logfiles are stored separately from all the personal data stated by a data subject.
8. Registration on the Website
9. Contacting, E-Mail and others
Salutation address*
*Obligatory information
Legal foundation for the processing of the data is as a a rule Article 6 Para. 1 lit. b. GDPR in the case of enquiries via the contact form and/or e-mails.
Furthermore, we reserve the right to store your personal data which we have received from you within the framework of the contractual relationship and to use them for our own advertising purposes, e.g. for the sending of similar, interesting offers and information on our offers and services by letter post or, in case you provide your e-mail address and your separate consent, also by e-mail.
Right of objection in accordance with clause 16.7
11. Data protection with applications and application processes
We collect and process the personal data of applicants for the purpose of progressing the application process. The processing can also be carried out electronically. This is in particular the case when an applicant sends to us relevant application documents by an electronic route, e.g. per e-mail. If we conclude a contract of employment with you as applicant, the data transmitted will be stored for purposes of progressing the employment relationship subject to observation of the legal regulations. If a contract of employment is not concluded by the party responsible for the processing with the applicant, then the application documents will be automatically deleted six months after notification of the rejection in so far as there is no other legitimate interest of the party responsible for the processing against deletion. Another legitimate interest in this sense is, for example, an obligation of proof in a process in accordance with the German General Equal Treatment Act.
12. Cookies -Description and scope of the data processing
As on many websites, cookies are used for our online offer. In general Cookies are small text files which are stored on your computer and which store certain settings and data for exchange with the online offer from us via your browser. A cookie usually contains the name of the domain from which the cookie file was sent, information about the age of the cookie and an alphanumeric identification.
Cookies enable us to recognize your computer and to make any settings available immediately. Cookies help us to improve our online offer and to offer you a better and even more customized service.
The cookies we use are so-called session cookies, which are automatically deleted after the end of the browser session.
We also use cookies on our website which enable an analysis of the user's surfing behaviour.
You accept our cookies if you have activated or not deactivated the cookie setting and continue to use this website.
In addition, the following third party cookies are used by visiting our site.
13. Social media channels, plug-ins and tracking tools
Data protection regulations on the application and use of Instagram Plug-Ins
Moreover our website uses so-called Social Plug-Ins ("Plug-Ins") from Instagram, which is operated by Instagram LLC ..1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram"). The plug-ins are marked with an Instagram logo, for example in the form of an "Instagram camera". An overview of the Instagram plug-ins and their appearance can be found here: http://blog.instagram.com/post/36222022872/introducing-instagram-badges
Whenever you visit a page of our website that contains such a plug-in, your browser establishes a direct connection to Instagram's servers. Instagram sends the content of the plug-in directly to your browser and integrates it into the page. Through this integration Instagram receives the information that your browser has called up the corresponding page of our website, even if you do not own an Instagram profile or are not currently logged in to Instagram. The information (including your IP address) is transmitted directly from your browser to an Instagram server in the USA and stored there. By logging in to Instagram, Instagram can immediately associate your visit to our website with your Instagram account. If you interact with the plug-ins, for example by pressing the "Instagram" button, this information is also transmitted directly to an Instagram server and stored there.
The information will also appear on your Instagram account and be displayed to your contacts. For more information on the purpose and scope of data collection and the further processing and use of data by Instagram and your rights and setting options for protecting your privacy, please refer to Instagram's privacy policy: https://help.instagram.com/155833707900388/
If you do not want Instagram to associate the information collected through our website directly with your Instagram account, you must log out of Instagram before visiting our website. You can also completely prevent the Instagram plug-ins from loading with add-ons for your browser, e.g. with the "NoScript" script blocker (http://noscript.net/).
Data protection regulations on the application and use of Facebook Plug-Ins
This website uses social plug-ins ("plug-ins") of the social network facebook.com, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, U.S.A. ("Facebook"). The plug-ins can be recognized with one of the Facebook logos (white "f" on a blue tile or a "thumbs up" character) or are characterized with the additive "Facebook Social Plugin". The list and appearance of the Facebook social plug-ins can be inspected here: http://developers.facebook.com/plugins.
If a participant calls a website of this offer, which website contains such a plug-in, the participant's browser builds up a direct link with the Facebook servers. The content of the plug-in is transmitted by Facebook directly to your browser and from this integrated into the website. Accordingly, the offeror has no influence on the scope of the data which Facebook collects with the aid of this plug-in and informs the participants accordingly in accordance with its state of knowledge (https://www.facebook.com/help/186325668085084):
Through the integration of the plug-ins Facebook gets the information that a participant has called the appropriate page of the offer. If the participant is logged in at Facebook, Facebook can assign the visit to participant's Facebook account. If participants interact with the plug-ins, for example if they press the Like button or make a comment, then the relevant information is transmitted from your browser directly to Facebook and is stored there. If a participant is not a member of Facebook, there is nevertheless the opportunity for Facebook to learn the participant's IP-address and to store this. According to Facebook only an anonymized IP-address is stored in Germany.
The purpose and scope of the data collection as well as the further processing and use of the data by Facebook as well as the related rights and setting opportunities for the protection of the private sphere of the participants can be taken from Facebook's data protection information: http://www.facebook.com/policy.php.
If a participant is a member of Facebook and does not want Facebook to collect data on him via this offer and to link this data with his membership data as stored at Facebook, he must log out at Facebook prior to visiting the Internet website.
Similarly it is possible to block Facebook social plug-ins with add-ons for your browser, for example with the "Facebook Blocker".
Note on data processing on our Facebook fan page
No collection and processing of your personal data on a regular basis:
When you visit our Facebook fan page, we do not regularly collect and process any personal data from you. Processing is usually carried out by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Their privacy policy can be found at https://www.facebook.com/privacy/explanation
Collection and processing of your personal data in exceptional cases:
If, in exceptional cases, we process your personal data (e.g. from comments) with us (outside Facebook), then this is done exclusively for our own purposes, e.g. to answer your inquiries or for sweepstake notifications. In this case, we are responsible; therefore, all relevant statements in this Privacy policy apply.
The legal foundation for such processing is Art. 6 para. 1 lit. b) GDPR, in other respects, processing is only carried out in the legitimate interest of, for example, the concrete suspicion of a criminal offence pursuant to Art. 6 para. 1 lit. f) GDPR.
Exclusively own purposes, e.g. implementation of a sweepstake and other actions.
Your data will be deleted if it is not required to be kept for a specific purpose.
In accordance with the terms and technical possibilities of Facebook and when the data is transferred to our system in exceptional cases in accordance with the general regulations in accordance with clause 9.
Data protection regulations on the application and use of YouTube
On this website we have integrated components from YouTube. YouTube is an Internet video portal that enables video publishers to set video clips free of charge and for other users to view, evaluate and comment on these, also free of charge. YouTube permits the publication of all types of video so that not only complete films and television programmes but also music videos, trailers and amateur videos prepared by users can be called via the Internet portal.
Operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, U.S.A.
With each call of one of the individual pages of this website, which is operated by the responsible party for the processing and on which a YouTube component (YouTube video) has been integrated, the Internet browser on the IT system of the data subject is caused by the particular YouTube component to download a representation of the relevant YouTube component from YouTube. Further information on YouTube can be called under https://www.youtube.com/yt/about/de/. Within the framework of this technical process YouTube and Google receive knowledge of which concrete subsite of our website has been visited by the data subject.
In so far as the data subject is at the same time logged in at YouTube, YouTube will recognize with the calling of a subsite, which contains a YouTube video, which concrete subsite of our website the data subject has visited. This information is collected by YouTube and Google and assigned to the particular YouTube account of the data subject.
YouTube and Google will always receive via the YouTube components information that the data subject has visited our website if the data subject is logged in at our website and at the same time at YouTube; this takes place regardless of whether or not the data subject has clicked on a YouTube video. If the transmitting of this information in this way to YouTube and Google is not desired by the data subject, the latter can prevent this transmission by logging out of his/her YouTube account before calling our website.
The data protection regulations published by YouTube - these can be called down at https://www.google.de/intl/de/policies/privacy/ - provide information on the collecting, processing and using of personal data by Google and YouTube.
Data protection regulations for the use and application of Google Analytics (with anonymization function)
Google Analytics sets a cookie on the IT system of the data subject. What cookies are has been explained above. The setting of cookies enables Google to analyse the use of our website. With each call of an individual page of this website, which is operated by the party responsible for the processing and on which a Google Analytics component has been integrated, the Internet browser on the IT-system of the data subject is automatically caused by the particular Google Analytics component to transmit data to Google for the purpose of online analysis. Within the framework of this technical process, Google obtains knowledge of personal data such as the IP-address of the data subject, which data enables Google to - amongst other things - trace the origin of the visitor and clicks and as a consequence to make possible the issuing of commission invoices.
As has already been described above, the data subject can prevent the setting of cookies by our website at any time by making an appropriate setting on his/her Internet browser as used and thereby object to the setting of cookies in a durable manner. Such a setting of the Internet browser used would also prevent Google from setting a cookie on the IT system of the data subject. In addition, a cookie, that has already been set by Google Analytics, can be deleted at any time via the Internet browser or another software program.
Furthermore, the data subject has the opportunity to object to collection of the data relating to use of this website generated by Google Analytics and to the processing of this data by Google and to prevent such collection. For this the data subject must download and install a browser add-on under the link https://tools.google.com/dlpage/gaoptout. This browser add-on informs Google Analytics via JavaScript that no data and no information on the visiting of websites may be transmitted to Google Analytics. The installation of the browser add-on is evaluated by Google as an objection. If the IT system of the data subject is deleted, formatted or installed anew at a later point in time, then the data subject must carry out the installation of the browser add-on again in order to deactivate Google Analytics. In so far as the browser add-on is uninstalled or deactivated by the data subject or by another person, who can be considered to belong to the area of control of the data subject, then the browser add-on can be installed or activated again.
Further information and the valid and applicable data protection regulations of Google can be called under https://www.google.de/intl/de/policies/privacy/ as well as under http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail under this link: https://www.google.com/intl/de_de/analytics/
Data protection regulations on the insertion and use of Google AdWords
We have integrated Google AdWords on this website. Google AdWords is a service for Internet advertising which permits the advertiser to place an advertisement not only in Google's search engine results but also in the Google advertising network. Google AdWords permits an advertiser to lay down in advance particular key words by means of which an advertisement will only be displayed in Google's search engine results when the user calls a key-word relevant search result with the search engine. In the Google advertising network the advertisements are distributed to thematically relevant websites with the aid of an automatic algorithm and subject to observation of the previously defined key words.
Operating company for the services of Google AdWords is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
The purpose of Google AdWords is the advertising of our website through the overlaying of interest-relevant advertising on the website of third parties and in the search engine results of the Google search engine and an overlaying of third party advertising on our website.
If a data subject reaches our website via a Google advertisement, a so-called conversion cookie is stored on the IT system of the data subject by Google. What cookies are has been already described above. A conversion cookie loses its validity after 30 days and does not serve for the identification of the data subject. The conversion cookie - in so far as it has not expired - permits determination of whether a particular subsite, for example the shopping basket of an online shop system, was called on our website. With the aid of the conversion cookies not only ourselves but also Google can deduce whether a data subject, who reaches our website via an AdWords advertisement, generated turnover, i.e. completed a purchase or broke off.
The data and information collected through the use of conversion cookies is used by Google in order to prepare visit statistics for our website. These visit statistics are in turn used by ourselves to determine the total number of visitors which are conveyed to us via AdWords advertisements, i.e. in order to determine the success or lack of success of the particular AdWords advertisement and in order to optimize our AdWords advertisements for the future. Neither our company nor other advertising customers of Google AdWords receive information from Google with the aid of which the data subject could be identified.
With the aid of the conversion cookies personal data, for example the websites visited by the data subject, is stored. Accordingly, personal data including the IP-address of the Internet connection used by the data subject is transmitted to Google in the United States of America with each visit to our websites. This personal data is stored by Google in the U.S.A. Under certain circumstances Google passes on the personal data collected via the technical process to third parties.
As has already been described above, the data subject can prevent the setting of cookies by our website at any time by making an appropriate setting in the Internet browser used and thereby object to the setting of cookies in a durable manner. Such a setting in the Internet browser used would also prevent Google from setting a conversion cookie in the IT system of the data subject. In addition, a cookie that has already been set by Google AdWords can be deleted at any time via the Internet browser or by a software program.
Furthermore, the data subject has the opportunity to object to the interest-related advertising. For this the data subject must call from each of the Internet browsers he/she uses the link www.google.de/settings/ads and there carry out the desired settings.
Further information and the valid data protection regulations of Google can be called under https://www.google.de/intl/de/policies/privacy/
Data protection regulations on the application and use of Google Tag Manager
Google Tag Manager is a tool that allows us to administrate website tags from a single interface. The Tool Tag Manager itself (which implements the tags) is a cookie-free domain and does not collect any personal data. The tool causes other tags to be triggered, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been made at the domain or cookie level, it will remain in effect for all tracking tags implemented with Google Tag Manager. http://www.google.de/tagmanager/use-policy.html
However, if you do not wish to do so, you can also prevent cookies from being saved here using your browser settings. Furthermore, you have the possibility to select the types of Google ads or to deactivate interest-based ads on Google via the settings for advertising (https://adssettings.google.com/authenticated?hl=en). Finally, you can disable the use of cookies by third parties by using the Network Advertising Initiative's disabling tool (http://optout.networkadvertising.org/?c=1#!/).
Data protection regulations on the application and use of Doubleclick
Furthermore we use Doubleclick, a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Doubleclick uses cookies to present relevant advertisements relevant to you. Your browser is assigned a pseudonymous identification number (ID) to check which ads have been displayed in your browser and which ads have been called. The cookies do not contain any personal information. The use of DoubleClick cookies only allows Google and its partner websites to serve ads based on previous visits to our or other websites on the Internet. The information generated by the cookies is transmitted by Google to a server in the USA for analysis and stored there. A transfer of data by Google to third parties only takes place due to legal regulations or within the scope of order data processing. Under no circumstances will Google match your data with other data collected by Google.
You can prevent the storage of cookies. Moreover you can prevent the collection, processing and storage of data at any time with effect for the future by setting your browser software accordingly or by downloading and installing the browser plug-in available under the Doubleclick deactivation extension link: https://www.google.com/settings/ads/plugin
However, we would like to emphasize that in this case you may not be able to use all functions of our websites to their full extent.
Data protection regulations on the application and use of Wiredminds
For the purposes of marketing and optimization, products and services of wiredminds GmbH (www.wiredminds.de), Lindenspürstraße 32, 70176 Stuttgart, are used on this website. In the context, data is collected, processed and stored from which user profiles are created under a pseudonym. The user profiles will be made completely anonymous, as far as this is possible and reasonable. Cookies may be used for this purpose. The collected data, which may also contain personal data, is transmitted to wiredminds or collected directly by wiredminds. The data obtained in this way will not be used to identify you personally without your separate consent. Furthermore, the data are not combined with personal data about the bearer of the pseudonym. If IP addresses are collected, they will be made anonymous immediately after collection by deleting the last number block. The collection, processing and storage of data can be revoked at any time with effect for the future under the following link: https://wm.wiredminds.de/track/cookie_mgr.php?mode=dont_track_ask&websitesel=83c0a2992f900f0f&lang=en
Further social-media Plug-Ins
You will find more detailed information on data protection in the particular data protection information of this offeree in so far as we use further social-media plug-Ins. Should you not find this, please do not hesitate to contact us at address given in our imprint.
Purpose of and legitimate interest in the setting of third party cookies is that of improving our offer for you through the analysis of your user behaviour. As a rule, only a pseudonymized transmission of data to the third parties takes place. In addition, you yourself are able to prevent transmission of third party cookies by carrying out an appropriate setting on your Internet browser. For more details look at the separate statements.
Third party cookies are stored on the computer of the user and are transmitted to our computer from this. Accordingly, you as user have full control on the use of third party cookies.
By carrying out a change to the settings of your Internet browser you can deactivate or restrict the transmission of third party cookies. Third party cookies that have already been stored can be deleted at any time. This process can also be automated.
By subscribing to our newsletter, your e-mail address will be used for our own advertising purposes until you log out. You will receive regular information by e-mail on current topics as well as e-mails for special occasions, for example special promotions. These e-mails can be personalized and individualized based on our information about you. You can influence the topics, contents and if applicable the time interval of receiving the newsletter by individual selection and specifications (e.g. your professional category).
If you have not given us your written consent to subscribe to our newsletter, we will use the double-opt-in process, i.e. we will not send you a newsletter by e-mail until you have expressly confirmed to us beforehand that we should activate the newsletter dispatch. Then we will send you a notification e-mail and ask you to confirm that you would like to receive our newsletter by clicking on a link contained in this e-mail.
If you do not wish to receive any more newsletters from us, you can object to this at any time without incurring any costs other than the transmission costs according to the basic rates. Therefore you only have to use the unsubscribe link contained in each newsletter or send a message to us or our data protection officer.
15. Prize draw
We regularly organize free prize draws in which participants can win various prizes. Details on the type and scope of the prize draws and the prizes as well as the prerequisites for participation can be found in the respective conditions of participation. In order to participate in the prize draws, personal data must be provided. Which data must be provided can be found on the registration page of the respective prize draw. In the minimum case, the following personal data of the participant will be processed:
Title and/or gender
In addition, participants may voluntarily provide other personal data, such as address data.
Article 6 Para. 1 lit. b GDPR (Steps prior to entering into a contract) for the execution of the prize draw
Article 6 Para. 1 lit. b GDPR (consent) for the sending of advertising
Article 6 Para. 1 lit. b GDPR (Steps prior to entering into a contract) for the delivery of prices
This data is required for the proper running of the prize draw, for example to verify the identity of the participants, to comply with the age limit for participation in the prize draw, to contact participants with the appropriate designation or to notify them in the event of a win.
In addition, your personal data may be stored for the purpose of sending advertising or delivering prices.
If, in the event of a win, the prizes are delivered or made available by a specialist retailer, an affiliated company or another third party (cooperation partner), the participant data must be transmitted to such cooperation partner for the purpose of delivery or provision of the prize(s).
The data provided on the registration page will be processed exclusively for the purpose of the prize draw and will be deleted by the responsible organizer once the prize draw has been completed.
In connection with questions or suggestions regarding the processing of your personal data in the prize draw, you have the right at any time to contact the person responsible stated in this data protection notice or his data protection officer. Your rights listed in this data protection notice are also fully applicable to participation in prize draws.
16. Colour shade sheet order
When you order the free colour sheets, we collect and store the personal data provided by you (name/company, street and house number, postcode and city, as well as any additional information). The collection of this data is based on Art. 6 para. 1 lit. a GDPR (consent) and is carried out for the purpose of the execution of your order, as well as for our own advertising purposes e.g. to send offers and services by mail.
Revocation / Possibility of elimination
Data from the form for ordering colour shade sheets
The legal basis for the collection and storage of data is Art. 6 para. 1 lit. a GDPR (consent).
The purpose of storing personal data is to execute the order for colour shade sheets.
The data may also be used for advertising purposes (e.g. by sending advertising mail).
The data for the execution of the order will be deleted two weeks after completion of the order and dispatch.
In the event of additional consent to the use of the data for advertising purposes, these will be stored for a period of 18 months.
Right of revocation according to clause 9.8 possible at any time and without stating reasons.
If your personal data is processed, then you are the data subject in the sense of the GDPR and you are entitled to the following rights vis à vis the responsible party:
You can demand from the responsible party confirmation as to whether personal data, that relates to you, has been processed by ourselves.
If such processing has taken place, you can demand information on the following from the responsible party:
• The purposes for which the personal data is processed;
• The categories of personal data which are processed;
• The recipients or, as the case may be, the categories of recipients to which the personal data relating to you has been disclosed or will be disclosed;
• The planned duration of the storage of the personal data relating to you or - if concrete statements on this are not possible - the criteria for the laying down of duration of storage;
• The existence of a right to correction or deletion of the personal data relating to yourself, of a right to a restriction of the processing by the responsible party or of a right of objection to this processing;
• The existence of a right of appeal at a supervisory authority;
• All the available information on the origin of the data if the personal data was not collected at the data subject;
• The existence of an automated decision-finding process including profiling in accordance with Article 22 Para. 1 and 4 GDPR and – at least in these cases - meaningful information on the logic involved and its scope and the effects strived for of such a processing for the data subject in question.
• Right to correction
You have a right to correction and/or complementing vis à vis the responsible party in so far as the personal data as processed and which relates to yourself is incorrect or incomplete. The responsible party has to carry out the correction without delay.
• Right to restriction of the processing
• if you dispute the correctness of the personal data relating to yourself for a period which makes it possible for the responsible party to check the correctness of the personal data;
• the processing is unlawful and you reject deletion of the personal data and instead demand restriction of the use of the personal data;
• the responsible party no longer needs the personal data for purposes of the processing but you need the data for the advancing, exercising or defending of legal claims, or
• if you have advanced objection to the processing in accordance with Article 21 Para. 1 GDPR but it has not yet been established whether the justified reasons of the responsible party outweigh your reasons.
If the restriction of the processing has been restricted in accordance with the afore-mentioned preconditions, then you will be informed by the responsible party before the restriction is removed.
• Right to deletion
• Deletion obligation
You can demand of the responsible party that the personal data relating to yourself is deleted without delay and the responsible party is then obliged to delete this data without delay in so far as one of the following reasons applies:
• The personal data relating to yourself is no longer required for the purposes for which it was collected or for which it was processed.
• You revoke your consent, on which processing in accordance with Article 6 Para. 1 lit. a or Article 9 Para.2 lit. a GDPR was based, and there is no other legal foundation for the processing.
• You submit an objection to the processing in accordance with Article 21 Para. 1 GDPR and there are no justified reasons for the processing with a higher priority, or you submit an objection to the processing in accordance with Article 21 Para. 2 GDPR.
• The personal data relating to you was processed in an unlawful manner.
• The deletion of the personal data relating to you is required to fulfil a legal obligation in accordance with European Union law or the law of the member states, which laws the responsible party is subject to.
• The personal data relating to you was collected in relation to services offered by the information company in accordance with Article 8 Para. 1 GDPR.
• Information to third parties
If the responsible party has made the personal data relating to you public and if he/she is obliged to delete this data in accordance with Article 17 Para. 1 GDPR, then he/she shall take reasonable measures including ones of a technical nature - whereby account shall be taken of the available technology and the implementation costs - to inform the responsible parties for the data processing which process the personal data that you as data subject have demanded from them the deletion of all links to this personal data or of copies or replicates of these.
• the exercising of the right of free expression of opinion and to information;
• for the fulfilment of a legal obligation, which requires the processing in accordance with the law of the European Union or the law of the member states, which laws the responsible party is subject to, or for the carrying out of a task, which lies in the public interest or which is carried out in the exercising of public authority, which authority was transferred to the responsible party;
• for reasons of public interest in the field of public health in accordance with Article 9 Para. 2 lit. h and i as well as Article 9 Para. 3 GDPR;
• for archiving purposes, scientific or historical research purposes lying in the public interest or for statistical purposes in accordance with Article 89 Para. 1 GDPR, in so far as the right named in section a) probably makes the reaching of the objectives of the processing impossible or impairs it seriously, or
• for the advancing, exercising or defending of legal claims.
If you have advanced the right to the correcting, deleting or restricting of the processing vis à vis the responsible party, then the latter is obliged to inform all recipients, to which the personal data relating to you was disclosed, of this correction or deletion of the data or of the restricting of the processing, unless this proves itself to be impossible or linked with unreasonable expenditure.
You are entitled to the right vis à vis the responsible party to be informed about these recipients.
You have the right to receive the personal data relating to you, which you made available to the responsible party, in a structured, conventional and machine-readable format. In addition, you have the right to transmit this data to another responsible party without hindrance by the responsible party to whom the personal data was made available, in so far as
• the processing is based on a consent in accordance with Article 6 Para. 1 lit. a GDPR or Article 9 Para. 2 lit. a GDPR or on a contract in accordance with Article 6 Para. 1 lit. b GDPR and
• the processing is carried out with the aid of automated processes.
In exercising this right, you have in addition the right to bring about the situation that the personal data relating to you is transferred directly from one responsible party to another responsible party in so far as this is technically possible. The freedoms and rights of other persons may not be impaired thereby.
The right to data portability does not hold good for the processing of personal data, which is necessary for the carrying out of a task, which lies in the public interest or in the exercising of public authority and which task was transferred to the responsible party.
The responsible party shall then no longer process the personal data relating to you, unless he/she can demonstrate compelling reasons worthy of protection, which reasons overweigh your interests, rights and freedoms or where the processing serves the advancing, exercising or defending of legal claims.
• Right to withdraw from the declaration of consent under data protection law
• Automated decision-making in individual cases including profiling
• is necessary for the concluding or fulfilment of a contract between you and the responsible party,
• is permissible on the basis of legal regulations of the European Union or of its member states, which the responsible party is subject to, and these regulations contain reasonable measures for the maintenance of your rights and freedoms as well as for your legitimate interests or
• is carried out with your explicit consent.
In respect of the cases named in (1) and (3) above the responsible party shall take reasonable measures to ensure the rights and freedoms as well as your legitimate interests, whereby belonging thereto is at the least the right to the affecting of the intervention of a person on the side of the responsible party for the representation of the responsible party's standpoint and to the challenging of the decision.
• Right to complain at a supervisory authority
18. Modifications of this data protection information
The status of the data protection information is indicated by the date (below). We reserve the right to change this data protection declaration at any time with effect for the future. A current version can be called up directly via the online offer. Please visit the website regularly and inform yourself about the applicable data protection declaration.
Status: June 2019
Responsible party: s. imprint
Business Partner Information (especially Customer and Supplier), as well as right of access by the data subject
for data processing according to Art. 12, 13, 14 ff. and 21 GDPR
dear Mister;
due to the legal regulations of the General Data Protection Regulation (GDPR) are we obliged and happy to provide you with comprehensive information (Art. 13 GDPR) about the processing of your personal data. Data protection and treatment of your personal data are very important to us, so as to always guarantee lawfulness of your personal data processing. If you have any questions about the processing of your data, both we and our data protection officer are at your service. Furthermore, the data protection officer is not subject to any instructions, is independent in his position and legally obliged to maintain secrecy and confidentiality (Art. 38 GDPR, § 38 Federal Data Protection Act (BDSG)), so that you can talk to him in confidence. With regard to the processing of your personal data, we inform you of the following:
1. Name of the controller
Controller for the processing of your personal data is the
DAW SE.
2. Chief Executive Director, Head of data processing
• Managing board
Management directors of the controller are:
Dr. Christoph Hahner, Dr. Ralf Murjahn (CEO), Dr. Thomas Späth, Daniel Weber and Heiko Fischer (COO).
• Head of data processing
Head of data processing is:
Herr Alexander Bode
• Data protection officer
External data protection officer is:
3. Contact details of the controller
Telefax: +49 6154 71-70222
E-Mail: info@daw.de
4. Purpose of the processing
Since 1895 DAW has developed, produced and sold innovative coating systems. As an independent family company in its fifth generation, we have continued to grow to become the third largest manufacturer of building paints in Europe and for decades we have been the market leader in Germany and Austria.
The DAW Group is the home to numerous stalwart brands. It is the driver of innovation in coating materials, thermal insulation and building protection and is a reliable partner for its customers and suppliers. The business purpose is the manufacture and sale of the aforementioned products. The DAW Group has its affiliated companies in various countries as well as outside Europe, e.g. Russia, Ukraine, Belarus and United Arab Emirates. A list of foreign locations can be found at www.daw.de/unternehmen/wer-wir-sind/unsere-standorte/daw-weltweit.html
The purpose of processing of your personal data is necessary and does only happen for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract, realization, roll-out, evaluation and completion of a contract (planning, purchase, delivery and service relationship), in this case with you as the business partner, incl. possible collection of outstanding debts. Additional information to privacy issues of collection procedures can be found in the privacy statement at the website of our collection service provider : https://www.eos.ksi.de/datenschutz
5. Categories of data
In this context, we process the following data or categories of data of you, in particular:
Name + first name of the contact person
Birthday of contact person
Address data of the company, sole proprietors or private customers
Contract data (name, address, customer ID, invoice number)
Accounts receivable data
Other payment details (credit card etc.)
Statistics of goods purchases
Content data of an existing business relationship, such as business letters, E-Mails and notes to oral or non-oral correspondence.
6. Lawfulness of processing
The lawfulness of processing of your personal data comes from:
Performance of a contract according to Art. 6 Para. 1 lit. b GDPR (e.g.: Sales-, Supply- and Servicecontract)
Consent according to Art. 6 Para. 1 lit a, 7 GDPR (e.g. Newsletter, transfer of personal data to offices in third countries,
Compliance with legal obligations according to Art. 6 Para. 1 lit c GDPR (e.g. reports to the tax office; Responses to legal and data protection related inquiries)
Legitimate interest according to Art. 6 Para. 1 lit. f GDPR (e.g. direct marketing for existing business partners, exercise domiciliary rights; Assertion of legal claims and defense in legal disputes; accounts receivable management; Safeguarding the IT security and operation of the controler; Prevention and detection of criminal offences; Collecting evidence of criminal offences through video surveillance. They thus serve to protect customers and employees as well as exercising domicilarty rights; Action to protect the facility security (e.g. limited access control).
7. Recipient and categories of recipients
In order to fulfil our contractual and legal obligations, your data will be forwarded to the following recipients or categories of recipients:
Clerk and managing clerk of the respective departments
E-Procurement Provider
Collection service provider
Independent offices and affiliated units abroad, as long as your delivery and demand relates to them
Controlling/Auditing
8. Transfer of personal data to a third country
If you enquire our products or services abroad, mostly Europe or in a third country, your personal data will be transferred to such office of the DAW Group. Some third countries such as Russia or United Arab Emirates do not comply with the GDPR and further have no adequate level of protection of personal data. In this case we ask for your explicit consent for a transfer of your data to a third country.
9. Storage duration, erasure of personal data
In order to fulfil our contractual and legal obligations, we store the data for the following periods, unless there is a legitimate interest according to Art. 6 Para. 1 lit. f GDPR, which would justify longer storage:
If necessary, we process and store your personal data for the duration of our business relationship, which also includes, for example, the initiation and processing of a contract. In addition, we are subject to various storage and documentation obligations arising from the German Commercial Code (HGB), the Fiscal Code (AO), the German Banking Act (KWG) and the Money Laundering Act (GwG), among others. The periods for storage and documentation specified there range from two to ten years.
Additionally the storage duration is influenced by legal limitation periods, which can range from e.g. according to §§ 195 ff. of the German Civil Code (BGB) three (3) years, construction materials five (5) years [§438 Para. 1 No. 2 lit. b) BGB] to in certain cases even thirty (30) years.
Business correspondence: 6 Years, § 147 Para. 1 No. 4,5 in connection with Para. 3 the Fiscal Code (AO); § 257 Para. 1 No. 1, 4 in connection with § 238 Para. 1 the German Commercial Code (HGB)
Contracts: 6 Years, § 147 Para. 1 No. 4,5 in connection with Para. 3 the Fiscal Code (AO); § 257 Para. 1 No. 1, 4 in connection with § 238 Para. 1 the German Commercial Code (HGB)
Invoices and Accounting records: 10 Years, § 147 Para. 1 No. 4,5 in connection with Para. 3 the Fiscal Code (AO); § 257 Para. 1 No. 1, 4 in connection with § 238 Para. 1 the German Commercial Code (HGB)
Verdicts, order of court and enforceable legal documents: 30 Years
10. Existence of a right of access by the data subject
Regarding your personal data you have the following rights:
Right of rectification and erasure (‚right to be forgotten‘)
Right to lodge a complaint with a supervisory authority about the processing of your personal data, if you do not consent with our operations.
Right to withdraw: You have the right to at any time withdraw your consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before ist withdrawal;
Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning on points (e) and (f) of Article 6 (1) GDPR, including profiling based on those provisions.
The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense or legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing personal data concerning direct marketing; which includes profiling if it relates to such direct marketing.
When you object to processing of your personal data for direct marketing, the controller will no longer process your data for such purposes
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you also have the right to object by automated means using technical specifications.
11. Mutual Rules for processing
If we exchange personal data of customers for further processing, e.g. within the scope of the fulfilment of so-called drop shipments, that is usually not qualified as a processing in the sense of Art. 28 par. 3 GDPR, but a data transmission, because we or you process the data for our or your own purposes, namely to fulfil delivery or purchase obligations and under instruction-free determination of own resources. In order to ensure legal conformity, we establish the following mutual processing rule:
• Contractor and Principal are obliged to process personal data only in accordance with the basic EU data protection regulation (GDPR) and the Federal Data Protection Act (BDSG-new) and, if applicable, other special legal standards.
• The employees of contractors and Principal as well as their vicarious agents are subject to data confidentiality in accordance with Art. 29 GDPR in conjunction with the Federal Data Protection Act-new (BDSG-new). As far as the Contractor or the Principal uses a processor for the processing of personal data within the scope of the order, he shall - in accordance with Art. 28 GDPR - be carefully selected with regard to the guaranteed level and obliged and checked accordingly within the scope of a data processing agreement. The same applies if the Contractor and the Principal make use of another third party for the fulfilment of the order by way of the transfer of functions. The obligations arising from the confidentiality obligation/ data processing agreement relate to all individual details of a person's personal and material circumstances as well as to all protective measures for this information. In particular, the Contractor and the Principal are obliged not to process any personal data without authorization.
• The Contractor will only use personal data which he receives from the Principal and/or from third parties within the scope of the execution of the order or which he collects himself for the purpose of the execution of the order. The Principal declares his agreement with this purpose limited processing. The use of this personal data outside the joint execution of the order (change of purpose) requires a separate, prior written consent of the Principal.
• In the event of the transfer of personal data to the Contractor assures the Principal that he is entitled to do so on the basis of an authorization under the GDPR, the BDSG-new or a special legal standard.
• If the Contractor and/or the Principal violate these obligations, the other party reserves the right to assert a resulting claim for damages and/or recourse.
• In the internal relationship, the Contractor and the Principal are only liable if the violation is within their own area of responsibility. In the event of a violation that is within the joint area of responsibility, the Contractor and the Principal shall be mutually liable in proportion to their respective share of fault and/or responsibility.
• If one party is held responsible by an affected party or the supervisory authority (liability, damages, fines, etc.), although the other party is responsible for the violation giving rise to the claim, the responsible party is obliged to indemnify the claimed party upon first request.
• The obligations of Contractor and Principal shall be apply beyond the end of the contract.
Status: June 2020