We are delighted by your interest in our company. Data protection is a particularly high priority for the management of Gut Hügle GmbH. As a rule, you can use the Gut Hügle GmbH websites without providing any personal data. However, if someone wishes to use special services offered by our company through the website, processing personal data may become necessary. If processing is necessary and no legal basis exists for it, we generally obtain the person’s consent.

Personal data, such as a person’s name, address, email address or telephone number, is always processed in accordance with the General Data Protection Regulation and the national data-protection provisions applicable to Gut Hügle GmbH. Through this privacy policy, our company informs the public about the nature, scope and purpose of the personal data we collect, use and process. It also explains the rights of persons concerned.

As controller, Gut Hügle GmbH has implemented numerous technical and organisational measures to provide the most complete possible protection for personal data processed through this website. Nevertheless, data transmission over the internet can have security vulnerabilities, so absolute protection cannot be guaranteed. For this reason, anyone may send personal data to us by alternative means, for example by telephone.

The privacy policy of Gut Hügle GmbH uses the terminology adopted by the European legislator when issuing the General Data Protection Regulation (GDPR). Our policy is intended to be easy to read and understand for the public as well as our customers and business partners. To ensure this, we first explain the terms used.

Among other things, this privacy policy uses the following terms:

• a) Personal data Personal data means any information relating to an identified or identifiable natural person (hereinafter “person concerned”). A natural person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
• b) Person concerned A person concerned is any identified or identifiable natural person whose personal data is processed by the controller.
• c) Processing Processing means any operation or set of operations performed on personal data, with or without automated means. This includes collecting, recording, organising, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying data.
• d) Restriction of processing Restriction of processing means marking stored personal data with the aim of limiting its future processing.
• e) Profiling Profiling means any form of automated processing of personal data used to evaluate personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s job performance, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• f) Pseudonymisation Pseudonymisation means processing personal data so that it can no longer be attributed to a specific person without additional information, provided that the additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data cannot be attributed to an identified or identifiable natural person.
• g) Controller or controller responsible for processing The controller, or controller responsible for processing, is the natural or legal person, public authority, agency or other body that alone or jointly with others determines the purposes and means of processing personal data. Where Union or Member State law determines the purposes and means of processing, that law may also specify the controller or the criteria for its designation.
• h) Processor A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
• i) Recipient A recipient is a natural or legal person, public authority, agency or other body to whom personal data is disclosed, whether or not they are a third party. However, public authorities that may receive personal data as part of a specific inquiry under Union or Member State law are not considered recipients.
• j) Third party A third party is a natural or legal person, public authority, agency or other body other than the person concerned, the controller, the processor, or persons authorised to process personal data under the direct authority of the controller or processor.
• k) Consent Consent means any freely given, specific, informed and unambiguous indication of a person’s wishes, given by a statement or by a clear affirmative action, by which they signify agreement to the processing of personal data relating to them.

The controller within the meaning of the General Data Protection Regulation, other data-protection laws applicable in the Member States of the European Union and other provisions of a data-protection nature is:

Gut Hügle GmbH

Bottenreute 5-7

88214 Ravensburg

Germany

Tel.: 0751 1895000

Email: info@guthuegle.de

Website: guthuegle.de

The Gut Hügle GmbH website uses cookies. Cookies are text files placed and stored on a computer system by a web browser.

Many websites and servers use cookies. Many cookies contain a so-called cookie ID, a unique identifier consisting of a string that allows websites and servers to recognise the specific browser in which the cookie was stored. This enables visited websites and servers to distinguish that browser from other browsers containing different cookies. A browser can be recognised and identified again by its unique cookie ID.

By using cookies, Gut Hügle GmbH can provide users of this website with more user-friendly services that would not be possible without cookies.

Cookies allow us to tailor the information and offers on our website to users. As mentioned above, cookies enable us to recognise visitors to our website. This recognition is intended to make the website easier to use. For example, users of a website that uses cookies do not have to enter their login details again on every visit, because the website and the cookie stored on their computer take care of this. An online shop’s shopping-cart cookie is another example: it remembers the items a customer has put in the virtual cart.

You can prevent our website from placing cookies at any time by changing the settings in your browser, thereby permanently objecting to cookie placement. Cookies already placed can also be deleted at any time using a browser or other software. All common browsers support this. If you disable cookies in your browser, some website functions may not be fully available.

Whenever a person or automated system visits the Gut Hügle GmbH website, it collects a range of general data and information. This is stored in the server log files. The information collected may include (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which the accessing system reached our website (the so-called referrer), (4) the subpages visited on our website, (5) the date and time of access, (6) an Internet Protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information used to prevent threats in the event of attacks on our information technology systems.

Gut Hügle GmbH does not use this general data and information to draw conclusions about the person concerned. Instead, it is needed to (1) deliver our website content correctly, (2) optimise our website content and its advertising, (3) ensure the continued operation of our information technology systems and website technology, and (4) provide law-enforcement authorities with the information they need to investigate a cyberattack. Gut Hügle GmbH therefore analyses this anonymously collected data and information statistically and also uses it to strengthen data protection and security within our company, ultimately ensuring the best possible protection for the personal data we process. Anonymous server log-file data is stored separately from all personal data provided by a person concerned.

The Gut Hügle GmbH website allows users to subscribe to our newsletter. The personal data transmitted to the controller when ordering the newsletter is shown in the input form used for that purpose.

Gut Hügle GmbH regularly informs its customers and business partners about company offers by newsletter. A person can generally receive our newsletter only if (1) they have a valid email address and (2) they register for newsletter delivery. For legal reasons, a confirmation email is sent using a double opt-in process to the email address first entered by a person for newsletter delivery. This confirmation checks whether the owner of that address has authorised receipt of the newsletter.

When you subscribe to the newsletter, we also store the IP address assigned by your internet service provider (ISP) to the computer you used at the time of registration, as well as the date and time of registration. This data is collected so that any later misuse of a person’s email address can be traced, and therefore serves to protect the controller legally.

Personal data collected when registering for the newsletter is used solely to send our newsletter. Subscribers may also be informed by email when this is necessary to operate the newsletter service or manage a related registration, for example if the newsletter offering or its technical setup changes. Personal data collected for the newsletter service is not shared with third parties. A person may cancel their newsletter subscription at any time and withdraw their consent to the storage of personal data for newsletter delivery. Each newsletter includes a link for withdrawing consent. You may also unsubscribe at any time directly on the controller’s website or notify the controller by another means.

The Gut Hügle GmbH newsletters contain so-called tracking pixels. A tracking pixel is a miniature graphic embedded in HTML emails to record and analyse log files. This enables statistical analysis of the success or failure of online marketing campaigns. The embedded pixel allows Gut Hügle GmbH to see whether and when a person opened an email and which links in it they clicked.

The controller stores and analyses personal data collected through tracking pixels in newsletters to improve newsletter delivery and better tailor future newsletters to a person’s interests. This personal data is not shared with third parties. A person may withdraw at any time the separate consent given through the double opt-in process. After withdrawal, the controller deletes this personal data. Gut Hügle GmbH automatically treats an unsubscribe request as a withdrawal of consent.

As required by law, the Gut Hügle GmbH website provides information that enables quick electronic contact with our company and direct communication with us, including a general electronic mail address (email address). If a person contacts the controller by email or through a contact form, the personal data they provide is stored automatically. Personal data voluntarily sent to the controller is stored to process the request or contact that person. This personal data is not shared with third parties.

The controller processes and stores a person’s personal data only for as long as needed to achieve the purpose for which it was collected, or as required by the European legislator or another legislator in laws or regulations that apply to the controller.

Once the storage purpose no longer applies or a retention period prescribed by the European legislator or another competent legislator expires, personal data is routinely blocked or erased in accordance with legal requirements.

• a) Right to confirmation Every person has the right, granted by the European legislator, to ask the controller to confirm whether personal data concerning them is being processed. Anyone wishing to exercise this right may contact an employee of the controller at any time.
• b) Right of access Anyone whose personal data is processed has the right, granted by the European legislator, to obtain free access from the controller at any time to the personal data stored about them, along with a copy. The European legislator has also granted the person the right to receive information about the following:
• the purposes of processing
• the categories of personal data being processed
• the recipients, or categories of recipients, to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organisations
• where possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period
• the existence of a right to request rectification or erasure of personal data concerning them, restriction of processing by the controller, or to object to that processing
• the existence of a right to lodge a complaint with a supervisory authority
• if the personal data was not collected from the person concerned: all available information about its source
• the existence of automated decision-making, including profiling, under Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved and the significance and intended effects of such processing for the person concerned
• The person also has the right to know whether personal data has been transferred to a third country or an international organisation. If it has, the person has the right to be informed of the appropriate safeguards relating to the transfer. Anyone wishing to exercise this right of access may contact an employee of the controller at any time.
• c) Right to rectification Anyone whose personal data is processed has the right, granted by the European legislator, to request the immediate rectification of inaccurate personal data concerning them. The person also has the right to request completion of incomplete personal data, including by means of a supplementary statement, taking into account the purposes of processing. Anyone wishing to exercise this right to rectification may contact an employee of the controller at any time.
• d) Right to erasure (right to be forgotten) Anyone whose personal data is processed has the right, granted by the European legislator, to ask the controller to erase personal data concerning them without delay if one of the following grounds applies and processing is not necessary:
• The personal data was collected or otherwise processed for purposes for which it is no longer needed.
• The person withdraws consent on which processing was based under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for processing.
• The person objects to processing under Art. 21(1) GDPR and there are no overriding legitimate grounds for processing, or the person objects to processing under Art. 21(2) GDPR.
• The personal data was processed unlawfully.
• The personal data must be erased to comply with a legal obligation under Union law or the law of a Member State to which the controller is subject.
• The personal data was collected in relation to information society services offered under Art. 8(1) GDPR.
• If one of the grounds listed above applies and a person wishes to have personal data stored by Gut Hügle GmbH erased, they may contact an employee of the controller at any time. That employee will ensure the request is carried out without delay. If Gut Hügle GmbH has made personal data public and is required to erase it as controller under Art. 17(1) GDPR, it will, taking account of available technology and implementation costs, take reasonable measures, including technical measures, to inform other controllers processing the published data that the person has requested erasure of all links to, copies of or reproductions of that data, insofar as processing is not necessary. An employee of Gut Hügle GmbH will take the necessary steps in each case.
• e) Right to restriction of processing Anyone whose personal data is processed has the right, granted by the European legislator, to ask the controller to restrict processing if one of the following conditions is met:
• The person contests the accuracy of the personal data, for a period that allows the controller to verify its accuracy.
• Processing is unlawful, and the person objects to erasure of the personal data and instead requests restriction of its use.
• The controller no longer needs the personal data for processing, but the person needs it to establish, exercise or defend legal claims.
• The person has objected to processing under Art. 21(1) GDPR, and it has not yet been determined whether the controller’s legitimate grounds override those of the person.
• If one of the conditions above is met and a person wishes to restrict personal data stored by Gut Hügle GmbH, they may contact an employee of the controller at any time. The employee will arrange for processing to be restricted.
• f) Right to data portability Anyone whose personal data is processed has the right, granted by the European legislator, to receive the personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to whom they provided them, if processing is based on consent under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract under Art. 6(1)(b) GDPR, and is carried out by automated means, unless processing is necessary for a task in the public interest or in the exercise of official authority vested in the controller. When exercising the right to data portability under Art. 20(1) GDPR, the person also has the right, where technically feasible, to have the personal data transmitted directly from one controller to another, provided this does not adversely affect the rights and freedoms of others. To exercise this right, the person may contact an employee of Gut Hügle GmbH at any time.
• g) Right to object Anyone whose personal data is processed has the right, granted by the European legislator, to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them under Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions. If an objection is made, Gut Hügle GmbH will no longer process the personal data unless we can demonstrate compelling legitimate grounds for processing that override the person’s interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If Gut Hügle GmbH processes personal data for direct marketing, the person has the right to object at any time to processing for that advertising. This also applies to profiling related to such direct marketing. If the person objects to processing for direct marketing, Gut Hügle GmbH will no longer process the personal data for those purposes. The person also has the right, on grounds relating to their particular situation, to object to processing by Gut Hügle GmbH of personal data concerning them for scientific or historical research or statistical purposes under Art. 89(1) GDPR, unless the processing is necessary to perform a task in the public interest. To exercise the right to object, the person may contact any employee of Gut Hügle GmbH directly. In connection with information society services, and notwithstanding Directive 2002/58/EC, the person may also exercise this right through automated procedures using technical specifications.
• h) Automated individual decision-making, including profiling Anyone whose personal data is processed has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary for entering into or performing a contract between the person and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and that law provides appropriate measures to safeguard the person’s rights, freedoms and legitimate interests, or (3) is based on the person’s explicit consent. If the decision (1) is necessary for entering into or performing a contract between the person and the controller or (2) is based on the person’s explicit consent, Gut Hügle GmbH will take appropriate measures to safeguard the person’s rights, freedoms and legitimate interests. These include at least the right to obtain human intervention from the controller, to present their point of view and to contest the decision. Anyone wishing to exercise rights relating to automated decisions may contact an employee of the controller at any time.
• i) Right to withdraw data-protection consent Anyone whose personal data is processed has the right, granted by the European legislator, to withdraw consent to the processing of personal data at any time. Anyone wishing to exercise this right may contact an employee of the controller at any time.

The controller collects and processes applicants’ personal data to manage the recruitment process. Processing may also take place electronically, particularly when an applicant sends application documents to the controller by email or through a web form on the website. If the controller enters into an employment contract with an applicant, the submitted data is stored to manage the employment relationship in accordance with legal requirements. If no employment contract is concluded, the application documents are automatically erased two months after the rejection decision is communicated, unless other legitimate interests of the controller prevent erasure. One such interest may be the need to provide evidence in proceedings under the General Equal Treatment Act (AGG).

The controller has integrated Google Analytics (with an anonymisation function) into this website. Google Analytics is a web analytics service that collects and evaluates data about visitor behaviour. It records, among other things, which website a person came from (the referrer), which subpages they accessed and how often and for how long they viewed a page. Web analytics is mainly used to optimise websites and assess the cost-effectiveness of online advertising.

The operator of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

For web analytics through Google Analytics, the controller uses the setting “_gat._anonymizeIp”. With this setting, Google truncates and anonymises the IP address of the person’s internet connection when our website is accessed from a Member State of the European Union or another contracting state to the Agreement on the European Economic Area.

The Google Analytics component analyses traffic to our website. Google uses the data and information collected, among other things, to evaluate use of our website, compile online reports for us showing activity on our site, and provide other services related to website use.

Google Analytics places a cookie on the person’s information technology system. Cookies have already been explained above. The cookie enables Google to analyse use of our website. Whenever someone visits an individual page of this website operated by the controller that includes Google Analytics, the component automatically prompts the person’s browser to transmit data to Google for online analysis. Through this technical process, Google receives personal data such as the person’s IP address, which Google may use, among other things, to trace the source of visitors and clicks and subsequently calculate commissions.

The cookie stores personal information such as the time of access, the location from which access originated and how often the person visits our website. Whenever someone visits our website, this personal data, including the IP address of the internet connection used by that person, is transmitted to Google in the United States of America. Google stores this personal data in the United States of America and may disclose data collected through this technical process to third parties.

As described above, you can prevent our website from placing cookies at any time by changing your browser settings and thereby permanently objecting to cookie placement. Changing your browser settings also prevents Google from placing a cookie on your information technology system. A cookie already placed by Google Analytics can be deleted at any time through your browser or other software.

The person may also object to and prevent Google Analytics from collecting data generated by their use of this website and Google from processing that data. To do so, they must download and install the browser add-on at https://tools.google.com/dlpage/gaoptout and then install it. The add-on tells Google Analytics through JavaScript that no data or information about website visits may be transmitted to Google Analytics. Google treats installation of the add-on as an objection. If the person’s information technology system is later erased, formatted or reinstalled, they must install the add-on again to disable Google Analytics. If the add-on is uninstalled or disabled by the person or someone acting under their authority, it can be reinstalled or re-enabled.

Further information and Google’s applicable privacy policies are available at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html Google Analytics is explained in more detail at https://www.google.com/intl/de_de/analytics/ where you can find further information.

The controller has integrated Google Remarketing services into this website. Google Remarketing is a Google AdWords feature that lets a company show ads to internet users who have previously visited its website. It therefore enables user-specific advertising and lets internet users see ads relevant to their interests.

The operator of Google Remarketing services is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Google Remarketing displays advertising relevant to users’ interests. It allows us to show ads through the Google advertising network or on other websites, tailored to internet users’ individual needs and interests.

Google Remarketing places a cookie on the person’s information technology system. Cookies have already been explained above. The cookie lets Google recognise a visitor to our website when they later visit other sites that are also part of the Google advertising network. Whenever someone visits a website that includes Google Remarketing, their browser automatically identifies itself to Google. Through this technical process, Google receives personal data such as the IP address or browsing behaviour, which it uses, among other things, to show interest-based advertising.

The cookie stores personal information such as the websites visited by the person. Whenever someone visits our website, personal data, including the IP address of the internet connection they use, is transmitted to Google in the United States of America. Google stores this data in the United States and may disclose data collected through this technical process to third parties.

As described above, you can prevent our website from placing cookies at any time by changing your browser settings and thereby permanently objecting to cookie placement. Changing your browser settings also prevents Google from placing a cookie on your information technology system. A cookie already placed by Google Analytics can be deleted at any time through your browser or other software.

The person may also object to Google’s interest-based advertising. To do so, they must visit www.google.de/settings/ads from each browser they use and change the desired settings there.

Further information and Google’s applicable privacy policies are available at https://www.google.de/intl/de/policies/privacy/ for details.

The controller has integrated Google AdWords into this website. Google AdWords is an online advertising service that lets advertisers place ads in Google search results and across the Google advertising network. Advertisers can specify keywords so that an ad appears in Google search results only when a user searches for a result relevant to those keywords. Across the Google advertising network, ads are distributed to relevant websites by an automated algorithm that takes the selected keywords into account.

The operator of Google AdWords services is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Google AdWords is used to promote our website by displaying interest-based ads on third-party websites and in Google search results, and to display third-party ads on our own website.

If a person reaches our website through a Google ad, Google places a so-called conversion cookie on their information technology system. Cookies have already been explained above. A conversion cookie expires after thirty days and is not used to identify the person. While it remains valid, it records whether certain subpages on our website have been visited, for example an online shop’s shopping cart. The conversion cookie allows both us and Google to see whether someone who reached our website through an AdWords ad generated a sale, meaning they completed or abandoned a purchase.

Google uses data and information collected through the conversion cookie to compile visitor statistics for our website. We use these statistics to determine the total number of users referred to us through AdWords ads, assess the success or failure of each ad and optimise future ads. Neither our company nor other Google AdWords advertisers receive information from Google that could identify the person.

The conversion cookie stores personal information such as the websites visited by the person. Whenever someone visits our website, personal data, including the IP address of the internet connection they use, is transmitted to Google in the United States of America. Google stores this data in the United States and may disclose data collected through this technical process to third parties.

As described above, you can prevent our website from placing cookies at any time by changing your browser settings and thereby permanently objecting to cookie placement. This also prevents Google from placing a conversion cookie on your information technology system. A cookie already placed by Google AdWords can also be deleted at any time through your browser or other software.

The person may also object to Google’s interest-based advertising. To do so, they must visit www.google.de/settings/ads from each browser they use and change the desired settings there.

Further information and Google’s applicable privacy policies are available at https://www.google.de/intl/de/policies/privacy/ for details.

The controller has integrated PayPal components into this website. PayPal is an online payment service. Payments are processed through so-called PayPal accounts, which are virtual personal or business accounts. PayPal also allows users without an account to make virtual payments by credit card. A PayPal account is linked to an email address, so there is no traditional account number. PayPal lets users initiate online payments to third parties and receive payments. It also acts as a trustee and provides buyer-protection services.

PayPal’s European operating company is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal L-2449, Luxembourg.

If a person selects “PayPal” as the payment method during checkout in our online shop, their data is automatically transmitted to PayPal. By selecting this payment option, the person consents to the transfer of personal data required to process the payment.

The personal data transmitted to PayPal generally includes first name, last name, address, email address, IP address, telephone number, mobile number or other data needed to process the payment. Personal data relating to the relevant order is also needed to perform the purchase contract.

The data is transmitted to process payments and prevent fraud. The controller will transmit personal data to PayPal in particular where there is a legitimate interest in doing so. PayPal may pass personal data exchanged between PayPal and the controller to credit reference agencies. This transfer is for identity and credit checks.

PayPal may disclose personal data to affiliated companies, service providers or subcontractors where this is necessary to fulfil contractual obligations or where they process the data on PayPal’s behalf.

A person may withdraw consent to PayPal’s handling of personal data at any time. Withdrawal does not affect personal data that must be processed, used or transmitted to carry out the payment in accordance with the contract.

PayPal’s applicable privacy policy is available at https://www.paypal.com/de/webapps/mpp/ua/privacy-full for details.

The controller has integrated Sofortüberweisung components into this website. Sofortüberweisung is a payment service that enables cashless payment for products and services online. It uses a technical process through which the online merchant receives immediate confirmation of payment. This allows the merchant to deliver goods, services or downloads to the customer immediately after an order is placed.

Sofortüberweisung is operated by Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If a person selects “Sofortüberweisung” as the payment method during checkout in our online shop, their data is automatically transmitted to Sofortüberweisung. By selecting this payment option, the person consents to the transfer of personal data required to process the payment.

When paying through Sofortüberweisung, the buyer gives their PIN and TAN to Sofort GmbH. Sofortüberweisung then checks the account balance and obtains further information to verify that sufficient funds are available before making a transfer to the online merchant. The merchant is notified automatically when the transaction is completed.

The personal data exchanged with Sofortüberweisung includes first name, last name, address, email address, IP address, telephone number, mobile number or other data required to process the payment. The transfer serves to process payments and prevent fraud. The controller may also transmit other personal data to Sofortüberweisung where there is a legitimate interest in doing so. Sofortüberweisung may pass personal data exchanged with the controller to credit reference agencies for identity and credit checks.

Sofortüberweisung may disclose personal data to affiliated companies, service providers or subcontractors where this is necessary to fulfil contractual obligations or where they process the data on its behalf.

A person may withdraw consent to Sofortüberweisung’s handling of personal data at any time. Withdrawal does not affect data that must be processed, used or transmitted to carry out the payment in accordance with the contract.

Sofortüberweisung’s applicable privacy policy is available at https://www.klarna.com/sofort/datenschutz/ for details.

Art. 6 I lit. a GDPR is the legal basis for processing operations for which we obtain consent for a specific purpose. If processing personal data is necessary to perform a contract to which the person concerned is a party, for example to deliver goods or provide another service or consideration, processing is based on Art. 6 I lit. b GDPR. The same applies to processing necessary to take pre-contractual steps, such as responding to enquiries about our products or services. If our company is subject to a legal obligation that requires processing personal data, for example to meet tax obligations, processing is based on Art. 6 I lit. c GDPR. In rare cases, processing personal data may be necessary to protect the vital interests of the person concerned or another natural person. This may be the case if a visitor is injured at our business and their name, age, health-insurance details or other vital information must be shared with a doctor, hospital or another third party. Processing would then be based on Art. 6 I lit. d GDPR. Finally, processing may be based on Art. 6 I lit. f GDPR. This legal basis covers processing not covered by any of the grounds above when it is necessary to protect a legitimate interest of our company or a third party, provided the interests, fundamental rights and freedoms of the person concerned do not override it. The European legislator has specifically recognised that such processing may be permitted, noting that a legitimate interest may exist where the person concerned is a customer of the controller (Recital 47, sentence 2 GDPR).

If personal data is processed on the basis of Art. 6 I lit. f GDPR, our legitimate interest is conducting our business for the well-being of all our employees and shareholders.

The applicable statutory retention period determines how long personal data is stored. Once that period expires, the corresponding data is routinely erased unless it is still needed to perform or prepare a contract.

We inform you that providing personal data may be required by law (for example, tax rules) or under contractual terms (for example, details about the contracting party). In some cases, it may be necessary for a person to provide us with personal data that we must then process in order to conclude a contract. For example, a person must provide personal data if our company enters into a contract with them. If the data is not provided, the contract cannot be concluded. Before providing personal data, the person should contact one of our employees. Our employee will explain for each case whether providing the data is required by law or contract, or necessary to conclude the contract, whether there is an obligation to provide it and the possible consequences of not doing so.

As a responsible company, we do not use automated decision-making or profiling.

This privacy policy was created using the privacy-policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, which serves as an external data-protection officer in Landshut, in cooperation with Christian Solmecke, a lawyer specialising in IT and data-protection law.

• External data-protection officer, Landshut
• Lawyer specialising in IT and data-protection law