Data Protection Information

With this data protection information, we inform you about the scope of the processing of your personal data (hereinafter “data”).

1. Data Controller

The party responsible for data processing in accordance with the provisions of the General Data Protection Regulation (GDPR) is:

Wego Systembaustoffe GmbH
Maybachstraße 14
63456 Hanau
Phone: +49 800 6711 000
Email: info@wego-vti.de

2. Contact Details of our Data Protection Officer

Dr. Stefanie Hellmich
Luther Rechtsanwaltsgesellschaft mbH
An der Welle 10
60322 Frankfurt
Email: datenschutz@wego-vti.de

3. Joint Processing

We process personal data jointly within the Wego Group, which belongs to the English group SIG plc. (Adsetts House, 16 Europa View, Sheffield, S9 1XH, United Kingdom), for the purpose of effective internal administration of personal data and group systems. For this purpose, we transfer your data to affiliated companies in accordance with § 18 AktG et seq. analogously, or process the data in systems that are operated jointly with our affiliated companies. You can view the participants of our corporate group at the following address: https://www.sigplc.com/our-businesses/where-we-operate

The legal basis for joint data processing is our overriding legitimate interest in effective administration and IT infrastructure in accordance with Art. 6 (1) (f) GDPR. For the processes subject to joint data processing, we are jointly responsible with our affiliated companies in accordance with Art. 26 GDPR. Accordingly, we have bindingly defined the internal competencies and responsibilities in a contract.

The information obligations of the GDPR will be fulfilled by the respective company with which you are first in contact. We have established a joint office for the fulfillment of data subject rights: Wego Systembaustoffe GmbH, Email: info@wego-vti.de. However, you can also contact us at any time with inquiries or to assert your data subject rights using the contact details provided in Section 1. We will then forward your request internally for processing. We have internally assigned the fulfillment of data subject rights to Wego Systembaustoffe GmbH. You can also contact us at any time with inquiries or to assert your data subject rights using the contact details provided in Section 1. We will then forward your request internally for processing.

The specific processes that fall under joint processing are identified accordingly below.

4. General Information on Data Processing

We process data as part of our business and website operations as well as the operation of our social media channels. This also includes disclosure by transmission to third parties and, if applicable, to so-called third countries outside the European Union (“EU”) and the European Economic Area (“EEA”). Insofar as we transfer data outside the EU or the EEA, we have identified this accordingly below.

5. Data Processing

The purposes for which your personal data are processed, as well as the legal basis for the processing, the legitimate interests of processing if applicable, the recipients or categories of recipients of your personal data, and any transfers to third countries, are listed in the following table:

5.1 Log file when visiting the website

We log your visit to the website. In doing so, we process: a) name(s) of our accessed website(s), b) date and time of access, c) the amount of data transferred, d) the browser type and version, e) the operating system you use, f) the referrer URL (the previously visited website), g) your IP address, h) the requesting provider.

The legal basis for data processing is our overriding legitimate interest in the continuous provision and security of our website in accordance with Art. 6 (1) (f) GDPR.

The log file is deleted after seven days, unless it is required to prove or clarify specific legal violations that have become known within the retention period.

5.2 Hosting

To provide our online presence, we use services from the hosting provider Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (hereinafter “AWS”), which processes the data mentioned above and all data to be processed in connection with the operation of this website (log file when visiting the website) on our behalf.

The legal basis for data processing is our overriding legitimate interest in the provision of our website in accordance with Art. 6 (1) (f) GDPR.

In principle, the AWS service is operated in the so-called EU Cloud service with data centers in the Frankfurt region. Nevertheless, it cannot be ruled out that data processing by AWS services may also result in data transfers to the USA. However, Amazon is certified under the EU-US Data Privacy Framework and is therefore covered by the adequacy decision of the EU Commission for data transfers to the USA.

5.3 Contacting Us

If you contact us, we process the following data from you for the purpose of processing and handling your inquiry: name, contact details – if provided by you – and your message.

The legal basis for data processing is our obligation to fulfill a contract and/or to fulfill our pre-contractual obligations in accordance with Art. 6 (1) (b) GDPR and/or our overriding legitimate interest in processing your inquiry and maintaining business relationships in accordance with Art. 6 (1) (f) GDPR.

Your personal data will be stored until your request has been resolved.

5.4 Contacting Us for Applications, Applicant Pool

If you contact us to send us your application as an employee, e.g., by email or via a contact form, the data you provide (e.g., name, email address, desired location, etc.), your message, and the submitted application documents will be processed exclusively for the purpose of processing and handling your application request.

The legal basis for data processing is primarily § 26 BDSG. According to this, the processing of data that is necessary in connection with the decision on the establishment of an employment relationship is permissible. Should the data be necessary for legal prosecution after completion of the application process, data processing may take place to safeguard our legitimate interests in accordance with Art. 6 (1) (f) GDPR, namely for the assertion and/or defense of claims. If you give us your consent to further store your application documents after the application process has been completed, we will store them in our applicant pool for the purpose of contacting you for future vacancies that fit your profile. The legal basis for processing within the framework of our applicant pool is your prior consent in accordance with Art. 6 (1) (a) GDPR.

5.5 Communication via WhatsApp

We offer you the opportunity to contact us via the Flinkit Business API per WhatsApp. For access to WhatsApp, we use a solution from our technical service provider Flinkit GmbH, Invalidenstr. 112, 10115 Berlin, which provides us with access using the WhatsApp Business API (from WhatsApp Ireland Limited, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland).

The terms agreed with WhatsApp apply to your use of the WhatsApp app. If you contact us via WhatsApp on the occasion of a specific business transaction (for example, an order placed), we store and use the mobile phone number you use on WhatsApp and – if provided – your first and last name in accordance with Art. 6 (1) (b) GDPR to process and answer your request. On the basis of the same legal basis, we may ask you via WhatsApp to provide further data (order number, customer number, address, or email address) in order to be able to assign your inquiry to a specific process. In addition, we process messages and files that you send to us via the app. We process your mobile number to identify you. Your nickname provided via WhatsApp is used for display purposes. Your communication with us is stored as a conversation transcript. This serves the purpose of using previous communication with you as context for future conversations. The transcript also contains delivery and read receipts. These serve to ensure smooth reception and to clean up inactive contacts.

If you use our WhatsApp contact for general inquiries (e.g., about the Wego range of services, product availability, or our website), we store and use the mobile phone number you use on WhatsApp and – if provided – your first and last name in accordance with Art. 6 (1) (b) GDPR to answer your inquiry.

As part of the use of the WhatsApp communication channel, your personal data will be processed by our service provider Flinkit GmbH named above. For the purpose of storing your data, Flinkit GmbH uses other service providers, some of which involve a transfer to countries outside the EEA. Specifically, these are AuthO Inc., 10800 NE 8th St, Suite 700 Bellevue, Washington, WA 98004 for user authentication purposes, Digital Ocean Inc. – 101 Avenue of the Americas 10th Floor, New York NY 10013 for the provision of hosting services, whereby the data is hosted in the EU, Functional Software Inc., 123 Hawthorne Street, San Francisco, CA 94 107 also for hosting services, and Google Cloud EMEA Limited, 70 Sir John Rogerson´s Quay, DO2 R296, Dublin 2, Ireland, for converting text messages into voice messages. Insofar as a transfer to countries outside the EEA takes place, Flinkit GmbH has concluded the EU standard contractual clauses with the service providers. The transmitted data is end-to-end encrypted when transmitted via API. In addition, Flinkit GmbH uses the WhatsApp Business Solution Provider 360dialog GmbH, Torstraße 1, 10119 Berlin to provide the WhatsApp Business API functionality, which stores your MSISDN (phone number) and your WhatsApp username (profile name). No disclosure to other third parties takes place.

5.6 Contract Fulfillment

When you order from us in the online shop, we process your order data to handle the contractual relationship between you and us.

The legal basis for data processing is the fulfillment of our contractual obligations in accordance with Art. 6 (1) (b) GDPR and, in individual cases, the fulfillment of our legal obligations in accordance with Art. 6 (1) (c) GDPR.

We transfer your address data to the company commissioned with the delivery. If necessary for the processing of the contract, we also transfer your email address or your telephone number to the company commissioned with the delivery to coordinate a delivery date (notification). We transfer your transaction data (name, date of order, payment method, shipping and/or receipt date, amount and payment recipient, bank details or credit card data if applicable) to the payment service provider commissioned with the processing of the payment.

5.7 Shipping Status Notifications

If we do not deliver ourselves and you wish to be informed about the status of the delivery by the shipping service provider (DHL, Hermes, DPD, etc.) or the freight forwarder, we will pass on your email address and telephone number to the respective chosen shipping company for this purpose.

The legal basis for this data processing is our legitimate interest in processing the order and arranging a delivery date in accordance with Art. 6 (1) (f) GDPR.

5.8 Credit Check

If we make advance payments for the payment method you have chosen (e.g., purchase on account) or if this is otherwise provided for the payment method you have selected, we will carry out a credit check. In this context, we transfer your name and address to Creditreform Hanau Lukas AG, Rückinger Str. 12, 63526 Erlensee, which compares this data with its own database to check your creditworthiness. In particular, information about the name, address, date of birth, email address if applicable, payment behavior, and ownership structure of persons is stored in the database. Creditreform Hanau Lukas AG then transmits the corresponding credit reports to us.

The legal basis for data processing in the case of purchase on account is our legitimate interest in accordance with Art. 6 (1) (f) GDPR, as we make advance payments with the dispatch of goods and bear the risk of default. In all other cases, data processing as part of a credit check takes place exclusively on the basis of your prior consent in accordance with Art. 6 (1) (a) GDPR.

Further information from Creditreform Hanau Lukas AG on data protection can be found here: https://www.creditreform.de/hanau/datenschutz

5.9 Newsletter

To provide you with regular information about our company and offers, we offer the dispatch of an email newsletter. With your newsletter registration, we process the data you entered during registration (email address and other voluntary information). To prevent misuse, we will send you an email after your registration asking you to confirm the registration (double opt-in procedure). In order to be able to prove the registration process in a legally compliant manner, your registration is logged. This includes the time of registration and confirmation as well as your IP address.

The legal basis for sending the newsletter is your consent in accordance with Art. 6 (1) (a) GDPR. The data processing in connection with the dispatch of the confirmation email for your registration and the associated data logging is carried out in accordance with Art. 6 (1) (f) GDPR based on our legitimate interest in proving your proper registration.

If you give us your consent, we also evaluate in the newsletters whether you have opened the newsletter as well as the scrolling and clicking behavior in the newsletter. This is done for the purpose of optimally tailoring our newsletter to your interests and improving the content of our newsletter. The legal basis for the analysis of the newsletter is your consent in accordance with Art. 6 (1) (a) GDPR.

For the dispatch of the newsletter, we use CleverReach GmbH & Co. KG, Mühlenstraße 43, 26180 Rastede as a service provider, to whom we transfer the specified data and with whom we have concluded a data processing agreement in accordance with Art. 28 GDPR.

5.10 Direct Email Advertising for Existing Customers

Unless you have objected, we will send you direct advertising in connection with the goods and services you have purchased in order to offer you similar goods and services. We use the email address you used when concluding the contract.

You can object to this use at any time without incurring any costs other than the transmission costs according to the basic rates.

The legal basis for sending this direct advertising is § 7 (3) UWG in conjunction with Art. 95 GDPR. For the dispatch of the newsletter, we use the service provider mentioned in Section 5.9, to whom we transfer the specified data.

5.11 Customer Account

In connection with the opening and use of a customer account, we process your master data (name, company, address, email address) and your usage data (username, password). This allows you to manage your orders and assignments, and we can identify you as a customer.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

5.12 Cookies, Consent Banner

We use so-called cookies on our website. Cookies are small text files that are placed on your respective end device (PC, smartphone, tablet, etc.) and stored by your browser.

Information about the specific cookies we use, their providers, and purposes can be found in our consent banner. There you can give your consent to the respective services, revoke it, or adjust your settings later.

To document your selection for certain data processing processes and to fulfill our data protection obligations, we use the “Cookiebot” consent banner from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. When you access our website, your cookie preferences are requested via a banner. We then set a cookie in which data on given or revoked consents are stored.

Data processing is carried out to fulfill our legal obligations in accordance with Art. 6 (1) (c) GDPR.

5.13 Analysis and Marketing

Google Services, Google Analytics

We use various services from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”) on our website. It is possible that data transfers to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 in the USA may also occur. When using Google services, data transfers to the USA also occur. Google is certified under the EU-US Data Privacy Framework and is therefore covered by the adequacy decision of the EU Commission for data transfers to the USA.

We use the Google Analytics tracking tool from Google on our website. We use Google Analytics to evaluate your use of the website, to compile reports on activities within this website, and to provide further services associated with website use and thus improve user-friendliness.

When Google Analytics is used, interactions of website visitors are primarily recorded and systematically evaluated with the help of cookies.

We use Google Analytics with the extension “anonymizeIp()”. This shortens IP addresses within the member states of the EU or EEA. If a transfer to Google’s servers in the USA takes place, the full IP address is only transmitted in exceptional cases and shortened there. A direct personal reference is thus generally excluded. In particular, an assignment to the accessed computer or end device of the website visitor is no longer possible.

Through the use of Google Analytics, the following data are processed: a) 3 bytes of the IP address of the accessed system of the website visitor (anonymized IP address), b) the accessed website, c) the website from which the user reached the accessed page of our website (referrer), d) the subpages accessed from the website, e) the time spent on the website, f) the frequency of access to the website. According to its own information, Google will under no circumstances associate your IP address with other Google data.

The legal basis for data processing within the framework of the aforementioned Google services is your prior consent in accordance with Art. 6 (1) (a) GDPR.

You can revoke your consent at any time with effect for the future by adjusting your preferences in our consent banner.

Meta Pixel

We use a so-called tracking pixel from Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland, a subsidiary of Meta Inc. 1601, Willow Road Menlo Park, CA 94025, USA, on our website. We use Meta Pixel to track the success of our own Meta advertising campaigns and to optimize the delivery of Meta advertising campaigns to interested target groups.

After clicking on a Meta advertisement or when visiting our website, a cookie is stored on your end device with the help of the pixel on our website. The cookie processes data about whether you reached our website via a Meta advertisement and makes it possible to analyze the user’s behavior until the purchase is completed. This allows us to track the success rate of our Meta advertising campaigns. In addition, the pixel processes data about the fact that you have visited our website and makes it possible to adapt the advertising displayed on Meta to your interests.

A direct connection to Meta’s servers is established when you visit our website via the Meta pixel integrated into our website. The information generated by the cookie about your use of this website (including your IP address) is transmitted to Meta in the USA.

When using Meta services, data is also transferred to the USA. Meta is certified under the EU-US Data Privacy Framework and therefore falls under the EU Commission’s adequacy decision for data transfers to the USA.

The data collected is anonymous to us and does not allow us to draw any conclusions about the user. If you are registered with Meta, Meta can assign the recorded information to your account. Even if you do not have a Meta account or are not logged in when visiting our website, processing and storage of your IP address and other identification data by Meta is possible.

You can revoke your consent for data processing by Meta Pixel for our web domain at any time with effect for the future by adjusting your preferences in our consent banner.

The legal basis for data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

5.14 Surveys

To optimize our range of goods and services, we conduct digital customer surveys ourselves. You may be asked to participate in these surveys if you have either given us your consent to be contacted for advertising purposes, which can be revoked at any time, or if you, as an existing customer, have not objected to the use of your contact details for advertising purposes. During the survey, we process your name and your email address.

The legal basis for data processing is either your consent in accordance with Art. 6 (1) (a) GDPR, if you have given it, or our legitimate interest in optimizing our range of goods and services in accordance with Art. 6 (1) (f) GDPR.

5.15 Sweepstakes

If you participate in one of our sweepstakes, you provide personal data when registering and, if necessary, for its execution, and conclude a sweepstakes contract with us through your participation. We process the personal data provided, uploaded, or sent in this context as described below.

Purpose:
If the data is personal data provided by you, its processing serves to enable us to run the sweepstakes with you as a participant at all—specifically, in the manner agreed with you in the sweepstakes contract. In the case of creative content that you have uploaded or submitted, the processing also serves to utilize this content, as you granted us exploitation rights to it in the sweepstakes contract.

Legal basis:
The legal basis that permits us to process your personal data is Art. 6 (1) (b) GDPR. Under this article, processing is lawful, among other things, if it is necessary to fulfill a contract concluded between you and us. You have concluded the sweepstakes contract with us. And since we have agreed with you to fulfill, i.e., carry out, this contract, it is necessary to process your personal data for this purpose as well.

Recipients:
Your personal data will be received by our employees involved in the sweepstakes and its administration. If service providers are involved in the sweepstakes on our part, we will also pass your data on to them. This may be the case, for example, if they provide and/or send you the prizes, maintain the website on which the sweepstakes takes place, or support us in administering the sweepstakes.

Third country transfer:
None.

Duration of storage:
We generally store your personal data for up to three months after the end of the sweepstakes. It is then deleted. Under certain circumstances, however, the storage period may be significantly longer. This is the case if a legal retention obligation requires it or if this is necessary to exercise the exploitation rights granted by you.

5.16 Law Enforcement

It may be that we are requested by investigative authorities to prepare and release your personal data. Should we comply with this request, we process your data for a purpose other than that for which it was originally collected. This processing for the changed purpose takes place as described below.

Purpose:
The processing, in particular the disclosure of your personal data to investigative authorities, aims to avert threats to state or public security and to prosecute criminal offenses.

Legal basis:
If we process your personal data on the basis of Art. 6 (1) (c) GDPR, the preparation and disclosure is necessary due to a legal obligation. Such a legal obligation always exists if the investigative authorities rely on a law that compels us to disclose the data. If our processing is not based on a legal obligation, then it is based on Art. 6 (1) (f) GDPR in conjunction with Section 24 (1) No. 1 BDSG. In this case, the disclosure must be necessary to safeguard legitimate interests, and your interests, fundamental rights, or fundamental freedoms must not override this.

Legitimate interests:
If the processing of your personal data is based on Art. 6 (1) (f) GDPR, legitimate interests are pursued. This is because danger prevention and law enforcement protect the integrity of the legal system and the legal interests and subjective rights of the individual, as well as ensuring the functionality of state institutions.

Recipients:
Your personal data will be received by the requesting investigative authority.

Third country transfer:
None.

Duration of storage:
In criminal matters up to 30 years; in administrative fine matters up to 3 years. In each case, calculated no later than from the time the result of the act occurred.

5.17 SaaS Solution acto

We use the SaaS solution “acto” from acto GmbH to support our sales activities. acto analyzes existing business data from our ERP and CRM systems and creates data-based recommendations for action for our sales department. This includes, among other things, predictions on customer development, product recommendations, the identification of churn risks, and the preparation of customer appointments.

acto uses both classic machine learning methods (e.g., prediction models, customer segmentation) and Large Language Models (LLMs) for natural language processing. The AI functions serve exclusively to support human decisions. No automated decision-making with legal or similarly significant effects for data subjects takes place. The classic ML models are trained on business data – personal data is not used for training purposes. No fine-tuning or post-training with customer data takes place for the LLMs used. AI-generated content is identified as such in the system.

As part of the use of acto, the following personal data are processed: Contact persons on the customer side: name, business email address, business telephone number – provided these are stored in our CRM/ERP systems. Sales employees (users of the solution): name, access data, role assignment, planned appointments, completed tasks, and the assignment to managed customers. In addition, company-related business data are processed (customer master data, order and contract data, communication histories), which generally do not have a direct personal reference.

The data is processed in a tenant-separated environment. There is no common database with other customers of the processor. Access to data is regulated by a role and authorization concept. Each user only sees the data that has been released for their role and area of responsibility. All data is transmitted encrypted (TLS 1.2+) and stored encrypted.

Purpose:
The processing is carried out for the purpose of creating automated recommendations for action for sales, identifying customers with churn risk or growth potential, generating product recommendations based on existing business data, preparing and following up on customer appointments, and for interactive data queries via an AI-based chat interface.

Legal basis:
The processing is necessary in accordance with Art. 6 (1) (b) GDPR to fulfill contractual obligations, insofar as the data subjects are contact persons within the framework of existing business relationships. The processing is also based on our legitimate interest in optimizing sales processes and the effective use of existing business data in accordance with Art. 6 (1) (f) GDPR. The interests of the data subjects are adequately taken into account.

Recipients:
Data processing is carried out by acto GmbH as a processor in accordance with Art. 28 GDPR. A corresponding data processing agreement (DPA) has been concluded. acto uses the sub-processor Frontegg for user authentication. Data processing by Frontegg takes place on servers within the EU. Since Frontegg is based in the USA, EU standard contractual clauses (SCCs) in accordance with Art. 46 (2) (c) GDPR have been concluded. The processing is limited to authentication data (name, email). The hosting infrastructure is provided by Amazon Web Services (AWS). Data processing takes place exclusively in data centers within the European Union (e.g., Frankfurt).

Third country transfer:
No further data transfer to third countries takes place.

Duration of storage:
Personal data is only stored in acto for as long as is necessary for the purposes described. Upon termination of the contractual relationship with the processor, all customer data will be completely deleted within 30 days. Deletion within 24 hours is possible upon request. Deletion requests from data subjects (Art. 17 GDPR) can be addressed to us at any time and will be forwarded immediately to the processor.

5.18 Fermacell Therm Planner

If we create individual installation plans for Fermacell Therm25 underfloor heating elements for you, we use the SaaS solution fermacell Therm Planner from James Hardie Europe GmbH for this purpose. This software processes your first and last name, your address, your email address, and, if applicable, your other communication addresses.

Purpose:
The processing is carried out for the purpose of creating an installation plan tailored to you for the desired underfloor heating elements, personalizing how we address you in these planning documents, and handling contracts with you.

Legal basis:<br/We base the processing of your data on the following legal bases: your consent, if you have given it to us (Art. 6 (1) (a) GDPR), the initiation or performance of a contract with you (Art. 6 (1) (b) GDPR), the fulfillment of legal obligations (Art. 6 (1) (c) GDPR), and the implementation of our legitimate interests (Art. 6 (1) (f) GDPR). Legitimate interests include improving our offering, retaining our correspondence with you, and personalizing installation plans and our customer communications.

Recipients:
When processing your data via the fermacell Therm Planner, we work with James Hardie Europe GmbH (Bennigsen-Platz 1, 40474 Düsseldorf) to provide the software and to create installation plans within the software. The following data is collected: contact details (first name/last name, email address, phone number, address) and configuration numbers. Further information about the provider can be found at https://jameshardie.de/de/datenschutz

Third country transfer:
None.

Duration of storage:
If you have consented to the processing, we store your personal data at most until you withdraw your consent; if we need the data to perform a contract, at most for as long as the contractual relationship with you exists; if we use the data on the basis of a legitimate interest, at most for as long as your interest in deletion or anonymization does not prevail; if statutory retention obligations exist, until the end of the retention periods.

6. External Content

We use dynamic content (“content”) from third parties to optimize the presentation and the offer of our website. When visiting the website, a request is automatically made to the server of the respective content provider via an interface, during which certain log data (e.g., the user’s IP address) are transmitted. The dynamic content is then transmitted to our website and displayed there.

We use external content in connection with the following functionalities:

6.1 Integration of YouTube Videos

We have integrated videos from the YouTube portal of YouTube LLC, 901 Cherry Ave. San Bruno, CA 94066, USA (“YouTube”) on our website. The party responsible for data processing at YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). However, when the videos are played, log data is transmitted to YouTube’s servers in the USA.
The legal basis for data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

When using Google services, data transfers to the USA also occur. Google is certified under the EU-US Data Privacy Framework and is therefore covered by the adequacy decision of the EU Commission for data transfers to the USA.

6.2 Open Street Maps

We use the open-source map service “Open Street Map” on our website, which is offered by the OpenStreetMap Foundation (OSMF) on the basis of the Open Data Commons Open Database License (ODbL). Further details can be found in the OSMF privacy policy at https://osmfoundation.org/wiki/Privacy_Policy.

To our knowledge, user data is used by OpenStreetMap exclusively for the purposes of displaying the map functions and temporarily storing the selected settings. This data may include, in particular, IP addresses and location data of users, which, however, are not collected without their consent (usually implemented as part of the settings of their mobile devices).
The legal basis for this processing is your consent in accordance with Art. 6 (1) (a) GDPR.

7. Social Media Presence

7.1 YouTube

We use YouTube, a social network that specializes in graphic representation in the form of videos. YouTube is a service of YouTube LLC, 901 Cherry Ave. San Bruno, CA 94066, USA (a subsidiary of Google LLC). When you visit this YouTube page, personal data is processed by YouTube and us as controllers.
If you have entered data yourself as a registered user on YouTube, such as your username and the content published under your own account, this will be processed by us if we respond to your comments or write a post that refers to your profile. In this case, the data you entered on YouTube, in particular your (user) name and the content published under your account, will be processed insofar as it is included in our offering and made accessible to our fans.

For all other data processing within the framework of the use of the YouTube service and its functionalities, YouTube LLC is the controller within the meaning of Art. 4 No. 7 GDPR. We have no influence on the type and scope of the data processed by YouTube LLC within the framework of the YouTube service, the type of processing, the use of the data, or the disclosure of this data to third parties.

Information about which data is processed by YouTube and for what purposes it is used can be found in YouTube’s privacy policy: https://policies.google.com/privacy.

The processing of personal data by us is based on our legitimate interests in an effective exchange with YouTube users, visitors to our profile, and in connection with communication with users on our social media profiles, including our corporate presentation in accordance with Art. 6 (1) (f) GDPR.

Data transfer and data transmission to the USA. When data is processed via YouTube LLC, 901 Cherry Ave. San Bruno, CA 94066, USA (“YouTube”), there is a possibility that data processing may take place outside the EU or EEA in the USA. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) is responsible for the data processing of individuals within the EU or EEA. Google is certified under the EU-US Data Privacy Framework and therefore falls under the EU adequacy decision for the USA. We do not otherwise transfer data to third parties in connection with the operation of our company profile.

7.2 Facebook

We operate our own Facebook company page. Facebook is a Meta product provided by Meta Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter: “Meta”). Together with Meta, we are jointly responsible for data processing in connection with our Facebook account in accordance with Art. 4 No. 7 GDPR. This includes, in particular, the data processing of Page Insights, see below regarding the use of Insights and cookies. When you visit our Facebook company page, personal data is processed by Meta and us as controllers.

Meta assumes primary responsibility under the GDPR for the processing of Insights data. Meta therefore also assumes all obligations under the GDPR with regard to the processing of Insights data (including Articles 12 and 13 GDPR, Articles 15 to 22 GDPR, and Articles 32 to 34 GDPR). Meta remains solely responsible for the processing of such personal data in connection with Page Insights that does not fall under the existing Page Insights Supplement.

Due to the existing agreements with Meta, including those regarding joint responsibility for data processing, it is appropriate to submit information requests and assert other data subject rights directly to Meta. As the operator of the social network and its ability to integrate Facebook fan pages, only Meta is able to access the necessary information directly and take any necessary measures and provide information. However, you may also send requests to us. We are ready to support you at any time and to fulfill our obligations as a controller.

The underlying Page Insights Supplement regarding the controller can be accessed at: https://www.facebook.com/legal/terms/page_controller_addendum.

Only the terms of use of Facebook (including the other terms and policies listed therein) are applicable for the use of the service. These can be accessed at https://www.facebook.com/legal/terms.

Information on data processing by Meta can be found in the Facebook service privacy policy at https://www.facebook.com/legal/terms.

The purpose of operating our Facebook account is to engage with users and visitors of the Facebook social network and to facilitate exchange. We directly inform about our company and related offerings, such as events we conduct or current events, special promotions and offers, etc.

We may receive statistics on visits and interactions with our account. These are generated by Meta. This enables us to manage the marketing of our activities more effectively and in a more targeted manner. In some cases, we may gain knowledge of Facebook profiles of individual users who like our profile and/or use the page’s applications. This enables us to provide improved content and features to the relevant users via our Facebook profile.

To further improve our content, we may also use demographic and geographic analyses based on the information collected during visits to our account. This allows us to place targeted interest-based advertisements without directly obtaining knowledge of your identity as a visitor.

If you use multiple devices when visiting Facebook, data collection and analysis may also occur across devices, provided you visit our profile as a registered user logged in with your Facebook profile.

Visitor statistics generated are only forwarded to us in anonymized form. We do not have access to the underlying data.

As part of our Facebook profile, we use Meta’s “Insights” service to receive anonymized statistical data about visitors to our profile.

When you visit our Facebook profile, Meta stores a corresponding data package, a so-called “cookie,” on your device, which contains an assignable user code. If you are registered as a Facebook user, this user code can be linked to your data. The information stored in this way is processed by Facebook. It is also possible for third parties to use this information from Facebook cookies to provide services to companies advertising on Facebook.

Unless deleted earlier, the cookie remains active for two years.

Further information on the use of cookies by Meta can be found in Meta’s cookie policy: https://www.facebook.com/policies/cookies/

The processing of personal data by us is based on our legitimate interests in effective exchange with Facebook users, visitors to our profile, and in connection with communication with users on our social media profiles, including our company presentation, in accordance with Art. 6 Para. 1 f) GDPR.

As a Facebook user, you have the option to configure in your account’s advertising preferences settings the extent to which your user behavior during visits to our Facebook profile may be recorded. Meta also provides an objection form: https://www.facebook.com/help/contact/1994830130782319.

We do not otherwise transfer data to third parties in connection with the operation of our company profile.

7.3 LinkedIn

We operate our own LinkedIn company page. LinkedIn is a product provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter: “LinkedIn”). Together with LinkedIn, we are jointly responsible for data processing in connection with our company profile, particularly in connection with the “Page Insights” function, in accordance with Art. 4 No. 7 GDPR.

When you visit our company profile, personal data is processed by LinkedIn and us as controllers.

LinkedIn assumes primary responsibility under the GDPR for the processing of Page Insights data, see also section bb) User Analysis. LinkedIn therefore also assumes all obligations under the GDPR with regard to the processing of Page Insights data (including Articles 12 and 13 GDPR, Articles 15 to 22 GDPR, and Articles 32 to 34 GDPR). LinkedIn remains solely responsible for the processing of such personal data in connection with Page Insights that does not fall under the existing Page Insights Joint Controller Addendum.

The “Page Insights Joint Controller Addendum” can be accessed at: https://legal.linkedin.com/pages-joint-controller-addendum. LinkedIn’s privacy policy can be found at: https://www.linkedin.com/legal/privacy-policy.

The purpose of operating our company profile on LinkedIn is primarily to engage with users and visitors of the LinkedIn social network and to facilitate exchange. We directly inform about our company and related offerings.

As a user of a LinkedIn profile, we may process the data you make available as a LinkedIn member. This includes all information you have entered in your profile, messages you send us, and interactions with our content. This occurs particularly when you share or recommend our content, comment, contact us, or when you refer to our presence within LinkedIn.

Applications

If you submit your application to us via LinkedIn, or if you express interest in a job offer that we approach you with, the data you provide (e.g., name, email address, desired location, data from your LinkedIn profile, etc.), your message, and the submitted application documents will be processed exclusively for the purpose of processing and handling your application request.

The processing of personal applicant data by us is based on § 26 Para. 1 BDSG. Accordingly, the processing of data is permissible if it is necessary in connection with the decision on establishing an employment relationship.

If the data may be necessary for legal prosecution after completion of the application process, data processing may occur to protect our legitimate interests in accordance with Art. 6 Para. 1 f) GDPR, namely for the assertion and/or defense of claims.

User Analysis

LinkedIn provides us with various information about visits and visitors to our company page through the “Page Insights” service. These are generated by LinkedIn and enable us to manage the marketing of our activities more effectively and in a more targeted manner. This involves so-called aggregated data, which cannot be linked to your person. Data processing within the “Pages-Insights” service takes place exclusively under LinkedIn’s responsibility. We have no access to personal data, except in aggregated form.

The processing of personal data by us is based on our legitimate interests in effective exchange with LinkedIn users and visitors to our profile, as well as in connection with communication with users on our social media profiles, including our company presentation, in accordance with Art. 6 Para. 1 f) GDPR.
Data collected during visits to our company profile may be forwarded to and processed by LinkedIn Corporation, based in the USA. LinkedIn is certified under the EU-US Data Privacy Framework and therefore falls under the EU adequacy decision for the USA.

We do not otherwise transfer data to third parties in connection with the operation of our company profile.

7.4 XING

We operate our own XING company page. XING is a platform operated by New Work SE, Am Strandkai 1, 20457 Hamburg (hereinafter “XING”).
If you contact us via our XING company page, we may process data in accordance with sections 5.3 and 5.4.

When you visit our XING page, your personal data is collected, transmitted, stored, disclosed, and used by New Work SE. We have no influence on the type and scope of data processed by XING, the type of processing and use, or the transfer of this data to third parties. We also have no effective control options in this regard. Likewise, our company has no knowledge of the content of your data transmitted to XING and cannot provide information about which data about you is stored through the use of the XING service.

Please refer to XING’s privacy policy, which you can view at https://privacy.xing.com/de/datenschutzerklaerung/druckversion, to find out which data XING collects and processes and for what purposes this occurs.

The legal basis for operating the XING company page for the purpose of communication with users on our social media profiles, including our company presentation, is our legitimate interest in accordance with Art. 6 Para. 1 f) GDPR.

8. Storage Duration

We store your personal data only for as long as is necessary for the purposes for which it is processed or until consent you have granted is revoked by you. Insofar as statutory retention obligations must be observed, the storage period for certain data may be up to 10 years, regardless of the processing purposes.

9. Your Data Subject Rights

9.1 Information

Upon request, you will receive free information at any time about all personal data we have stored about you.

9.2 Rectification, Erasure, Restriction of Processing (Blocking), Objection

If you no longer agree to the storage of your personal data or if it has become inaccurate, we will arrange for the deletion or blocking of your data or make the necessary corrections upon appropriate instruction (insofar as this is possible under applicable law). The same applies if we are to process data only in a restricted manner in the future. You have a right to object particularly in cases where your data is required for the performance of a task carried out in the public interest or where data processing is based on our legitimate interest, as well as profiling based thereon. You also have such a right to object in the case of data processing for the purpose of direct marketing.

9.3 Right of Withdrawal for Consents with Effect for the Future

You may withdraw consents granted at any time with effect for the future. Your withdrawal does not affect the lawfulness of processing up to the time of withdrawal.

9.4 Data Portability

If data processing is based on a contract, pre-contractual negotiations, consent, or automated procedures, you have the right to data portability. Upon request, we will provide you with your data in a common, structured, and machine-readable format so that you can transmit the data to another controller if desired.

9.5 Restriction of Processing

Data for which we are unable to identify the data subject, for example if it has been anonymized for analysis purposes, is not covered by the above rights. Information, deletion, blocking, correction, or transfer to another company may be possible with regard to this data if you provide us with additional information that allows us to identify you.

9.6 Exercise of Your Data Subject Rights and Right to Lodge a Complaint

If you have questions about the processing of your personal data, or for information, rectification, blocking, objection, or deletion of data, or if you wish to transfer data to another company, please contact the controller named in section 1.

You also have the option to lodge a complaint with a supervisory authority regarding your data subject rights.