Protektor privacy policy

Below you will find information about what personal data we process, for what purpose, on what legal basis, and for how long:

A. Our contact details and general information on data processing by us

Name and contact details of the controller

Responsible within the meaning of data protection law for the collection and use of personal data is

PROTEKTORWERK Florenz Maisch GmbH & Co KG

Viktoriastrasse 58

D-76571 Gaggenau

Phone: +49 (0)7225 / 977-0

Fax: +49 (0)7225 / 977-111

E-mail: info@protektor.com

Internet: www.protektor.com

Managing Directors: Dr. Christof Maisch (Chairman of the Management Board), Dr. Jörg Böllhoff, Dr. Andreas Metzger

Tax ID No. DE 144 007 542 Court of Registration: Mannheim HRA 520033

For more information about our company, please see the legal notice on our website.

Contact details of the data protection officer of the controller

You can contact our data protection officer as follows:

Mrs. Iris Armbruster

PROTEKTORWERK Florenz Maisch GmbH & Co KG

Viktoriastrasse 58

D-76571 Gaggenau

Phone: +49 (0)7225 / 977-202

E-mail: datenschutz@protektor.de

General Information on the Legal Basis for the Processing of Personal Data

In general, the following applies to our processing of personal data:

Insofar as we obtain your consent for the processing of personal data, Art. 6 para. 1 (a) of the EU General Data Protection Regulation (GDPR) as the legal basis for the processing of personal data.

If processing is necessary to safeguard a legitimate interest of ours or of a third party, and your interests, fundamental rights, and fundamental freedoms do not override that interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.The email addresses of our newsletter subscribers, as well as other data described in this newsletter notice, are stored on Emarsys’s servers. Emarsys uses this information to send and analyze the newsletters on our behalf. Furthermore, according to Emarsys, it may use this data to optimize or improve its own services—for example, to technically optimize the delivery and presentation of the newsletters or for business purposes, such as determining the countries from which the recipients originate. However, Emarsys does not use the data of our newsletter subscribers to contact them directly or to share it with third parties.

All information regarding data processing and Emarsys’ policies can be found here:
https://www.emarsys.com/de/datenschutzrichtlinie/

When processing personal data necessary to fulfill a contract with you, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies when the processing is necessary to take steps prior to entering into a contract.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which we are subject, Art. 6 para. 1 letter c) GDPR as the legal basis.

In the event that your vital interests or those of another natural person require the processing of personal data, Art. 6 para. 1 letter d) GDPR as the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by us or by a third party and your interests, fundamental rights and freedoms do not override these interests, Art. 6 para. 1 letter f) GDPR as the legal basis for processing.

General Information on Data Deletion and Retention Periods

The personal data will generally be deleted or blocked by us as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which we as the controller are subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

Specifically, this means:

If we process personal data based on consent to data processing (Art. 6(1)(a) of the GDPR), processing will cease upon your withdrawal of consent, unless there is another legal basis for processing the data, which is the case if, at the time of withdrawal, we are still authorized to process your data for the purpose of fulfilling a contract or if the data processing is necessary to safeguard our legitimate interests (see below for more details in each case).

If, in exceptional cases, we process the data based on our legitimate interests (Art. 6(1)(f) GDPR) following a prior balancing test, we will store this data until the legitimate interest no longer exists, the balancing test yields a different result, or you have effectively objected pursuant to Article 21 of the GDPR (see the visually highlighted “Notice Regarding the Specific Right to Object” under C.).

If we process the data for the purpose of fulfilling a contract, we will store the data until the contract has been fully fulfilled and settled and no further claims can be asserted under the contract—that is, until the statute of limitations expires. The general statute of limitations under Section 195 of the German Civil Code (BGB) is three (3) years. However, certain claims, such as claims for damages, are not subject to the statute of limitations until 30 years have elapsed (see Section 197 of the German Civil Code (BGB)). If there is reasonable cause to believe that this is relevant in a specific case, we will retain the personal data for this period. The aforementioned limitation periods begin at the end of the year (i.e., on December 31) in which the claim arose and the creditor became aware of the circumstances giving rise to the claim and the identity of the debtor, or should have become aware of them had it not been for gross negligence.

We would like to point out that we are also subject to statutory retention obligations for tax and accounting reasons. These require us to retain certain data, which may include personal data, for a period of six (6) to ten (10) years as proof of our accounting. These retention periods take precedence over the aforementioned deletion obligations. The retention periods also begin at the end of the relevant year, i.e. on December 31.

General Information on the Sources of Personal Data

The personal data processed by us originates primarily from the data subjects themselves, for example by them

As a user of our website, you transmit information such as your IP address to our web server via the web browser and your end device (e.g. a PC, smartphone, tablet or notebook),
interested parties can request information material or an offer from us,
as customers place an order with us or conclude a contract with us,
request information material, press releases, statements, etc. as a representative of the press,
as suppliers supply us with goods or provide us with services and the like as agreed.

Only in very exceptional cases can the personal data processed by us also originate from third parties, for example if a person is acting on behalf of a third party.

General Information on Categories, Purposes, and Legal Bases for the Processing of Personal Data

We process the following categories of personal data:

Users of our website,
Interested parties,
Representative of the press,
customers, as well as
Suppliers.

Depending on the category of data involved, we process personal data for the following purposes and on the basis of the respective legal basis of the General Data Protection Regulation (GDPR):

User Data: We collect and process data from users of our website in a non-personally identifiable manner. We are unable to link this data to specific individuals. IP addresses are processed exclusively in an anonymized form. In the rare event that personal data is involved, we process it to safeguard our legitimate interests pursuant to Article 6(1)(f) of the GDPR. Our legitimate interests in this context include our interest in the security and integrity of our website and the data on our web server (in particular, the detection of malfunctions and errors, as well as the tracking of unauthorized access), as well as marketing interests and interests related to statistical surveys (to improve our website and our services and offerings). After weighing the interests involved, we have concluded that the data processing is necessary to safeguard the aforementioned legitimate interests and does not override your interests or fundamental rights and freedoms that require the protection of personal data.

Data from Prospective Clients/Media Representatives: To the extent that we process data from prospective clients of our services or from media representatives, we do so only if you enter this data into an input field or send it to us via email for the purpose of making an inquiry. Providing this information is voluntary on your part. We then process this data exclusively to handle your inquiry. The processing of this data, which you have voluntarily provided to us for the purpose of receiving information about our services, is carried out as pre-contractual processing in accordance with Article 6(1)(b) GDPR and/or on the basis of the consent you have provided by submitting the data, in accordance with Article 6(1)(a) of the GDPR.

Customer Data: We process our customers’ data for the purpose of contract fulfillment in accordance with Article 6(1)(b) of the GDPR and/or on the basis of consent granted in accordance with Article 6(1)(a) of the GDPR. This also applies to processing operations necessary for the implementation of precontractual measures (e.g., in connection with the preparation and negotiation of offers).

Supplier Data/Business Partner Data: We process the data of our suppliers and business partners for the purpose of contract fulfillment in accordance with Article 6(1)(b) of the GDPR and/or on the basis of consent granted in accordance with Article 6(1)(a) of the GDPR. This also applies to processing operations necessary for the implementation of precontractual measures (e.g., in connection with the preparation and negotiation of offers).

General Information on Recipients or Categories of Recipients of Personal Data

Your personal data will be disclosed to third parties or otherwise transferred only if this is necessary for the purpose of contract fulfillment (e.g., to process an order) or for billing purposes (e.g., to process a payment transaction when purchasing goods or services), there is a legitimate interest in the disclosure or transfer, and your interests or fundamental rights and freedoms do not take precedence, or you have previously given your valid consent.

Categories of recipients can be

Service providers (publishers, printers, etc.)
Shipping service providers, suppliers
Payment service providers, banks
Tax consultant

Data processing for sending newsletters

It is possible to subscribe to a free newsletter on our website or by sending us a request. When you register for the newsletter, the data from the input screen is transmitted to us. These are

The e-mail address (mandatory field), and
Your first and last name and your country of origin (optional).

When registering for the newsletter, the following data is also collected (opt-in verification):

Your IP address and
Date and time of your registration.

This serves to prevent misuse of the services or your e-mail address and to comply with our legal obligation to prove that an opt-in, i.e. express consent to receive the newsletter, has actually been given by the e-mail address.

Your consent is obtained for the processing of the data as part of the registration process and reference is made to this privacy policy.

Signing up for our newsletter uses a process known as “double opt-in.” This means that after you sign up, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can sign up using someone else’s email address. Clicking the link to confirm your subscription results in the collection of your IP address and the exact time (date and time) of the click. This data processing serves to fulfill our legal obligation to provide evidence that an opt-in—that is, explicit consent to receive the newsletter—was actually given from that email address.

Purposes of Data Processing: The collection and processing of the user’s email address is intended to deliver the newsletter. We use the email address for promotional purposes.

The collection of IP address and time when clicking on the confirmation link in the double opt-in e-mail serves to fulfill our legal obligation to obtain explicit consent.

The collection of other personal data as part of the registration process serves to prevent misuse of the services or the e-mail address used.

A possible storage beyond the unsubscription of the newsletter for up to three years serves the purpose of proving a previously given consent and a possible defense against claims.

Legal basis for data processing: The legal basis for processing your data after you subscribe to the newsletter is your consent pursuant to Article 6(1)(a) of the GDPR.

The legal basis for the storage of the IP address and time when you click on the confirmation link in the double opt-in email and for possible further storage for up to three years after you unsubscribe from the newsletter is our legitimate interest pursuant to Art. 6 para. 1 lit. a GDPR. 1 letter f) GDPR. The legitimate interest in this case is to be able to prove that you have previously given your consent and to defend against claims derived from this.

Retention Period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Your email address will therefore be stored for as long as your newsletter subscription remains active.

We may store the unsubscribed e-mail addresses together with the data collected when confirming the consent to receive the newsletter for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time.

The other personal data collected during the registration process is generally deleted after a period of seven days.

Right to Object and Opt Out: You may cancel your subscription to the newsletter at any time, free of charge and without having to follow any specific procedure. A link for this purpose is included in every newsletter.

This also makes it possible to withdraw consent to the storage of personal data collected during the registration process.

Please also note the additional options and information regarding our SAP shipping service provider, Emarsys, in the following paragraphs:

Use of SAP’s Emarsys email marketing service:

Newsletters are sent via SAP’s email marketing service provider, Emarsys. We have entered into a contract for this purpose with SAP Emarsys Customer Engagement GmbH, Mariahilfer Straße 123, 1060 Vienna, Austria. We have also entered into a data processing agreement with Emarsys, in which Emarsys provides us with appropriate safeguards that enable the processing of data on our behalf.

The email addresses of our newsletter subscribers, as well as any other data described in the notices accompanying these newsletters, are stored on Emarsys’ servers. Emarsys uses this information to send and analyze the newsletters on our behalf. Furthermore, according to Emarsys, it may use this data in aggregated form to optimize or improve its own services—for example, to technically optimize the delivery and presentation of the newsletters, or for business purposes to determine which countries the recipients are from. However, Emarsys does not use the data of our newsletter subscribers to contact them directly or to share it with third parties. You can find all information regarding data processing and Emarsys’ policies here: https://www.emarsys.com/de/datenschutzrichtlinie/

Contact via e-mail, fax and phone call

You can contact us via various channels if you wish. You will also find an e-mail address, telephone number and fax number on the website. Even if you send us an e-mail, call us or send us a fax, we will inevitably process your personal data. This is because at least the personal data transmitted by e-mail, fax or telephone will be stored by us or our systems.

Data will not be passed on to third parties in this context. The data is used exclusively for processing the conversation.

Purposes of Data Processing: We process personal data transmitted via email, fax, or telephone in order to handle your inquiry and address your request. We absolutely need your email address, fax number, or phone number in order to be able to respond at all. This also constitutes the legitimate interest in processing the data.

Legal basis for data processing: The legal basis for processing the data is, where consent has been given—which may be inferred from the act of contacting us— Article 6(1)(a) of the GDPR; otherwise, it is our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.

If the contact or your request is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 letter b) GDPR (implementation of pre-contractual measures).

Duration of storage: The data is deleted as soon as it is no longer required for the purpose for which it was collected.

For personal data sent by e-mail, this is the case when the respective conversation with you has ended and we have then waited a waiting period of up to 3 months to see whether we may need to revisit your request or the details of the communication. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

Fax data is stored separately from print data in the fax machine’s memory. After the fax is printed, the occupied memory space is freed up so that the next fax can be received and stored there. Parts of the fax may remain temporarily in the device’s memory after printing until they are overwritten by the next fax received. As a rule, this results in the data being automatically deleted after 1–2 weeks. If the fax was sent from a computer, we receive it as an email, and the guidelines for emails apply accordingly.

When we receive an incoming call or make an outgoing call, your phone number or the name/company name on file with your phone service provider, as well as the date and time of the call, are stored in our phone system in a so-called ring buffer, which overwrites the oldest data with new data. As a rule, this results in the data being automatically deleted from the phone system after approximately 3–4 months.

From a commercial or tax law perspective, such communications may be subject to a retention requirement, which would then take precedence (see the discussion above on “Data Deletion and Retention Periods”).

Right to Object and Right to Rectification: You have the right at any time to withdraw your consent to the processing of your personal data or to object to further data processing based on legitimate interests (see the note regarding the specific right to object under “Data Subject Rights” at the bottom of this Privacy Policy). In such a case, the conversation cannot continue.

You can withdraw your consent or object to further data processing by sending us an informal message (e.g. by e-mail).

All personal data stored in the course of contacting us will be deleted in this case.

B. Scope of the Processing of Personal Data Through Our Website

We only collect and use users’ personal data when they use our website insofar as this is necessary to provide a functional website and our content and services. The collection and use of personal data of our users generally only takes place with the consent of the user. An exception applies in cases where prior consent cannot be obtained for factual reasons and/or the processing of the data is permitted by law.

Web Hosting Provider

Our website is hosted by the provider Mittwald CM Service GmbH & Co. KG

Königsberger Straße 4-6, D-32339 Espelkamp, Germany. We have entered into a contract with the hosting provider regarding data processing on behalf of the controller pursuant to Article 28(3) of the GDPR.

Provision of the website and creation of log files

For technical reasons, our system automatically collects data and information each time the website is accessed. These are stored in the server’s log files. These are:

Date and time of access,
URL (address) of the referring website (referrer),
Web pages that are accessed by the user’s system via our website,
Screen resolution of the user,
Retrieved file(s) and message about the success of the retrieval,
Amount of data sent,
the user’s Internet service provider,
Browser, browser type and browser version, browser engine and engine version,
Operating system, operating system version, operating system type, and
the anonymized IP address and the Internet service provider of the user.

This data is processed separately from other data. This data is not processed together with other personal data of the user. It is not possible for us to assign this data to a specific person.

Purposes of Data Processing: The temporary processing of data by the system is necessary to enable the delivery of our website’s content to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session.

Storage in log files takes place to ensure the functionality of the website. In addition, we use the data to optimize our offer and the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.

Legal basis for data processing: The temporary storage of data and log files is based on Article 6(1)(f) of the GDPR. Our overriding legitimate interest in this data processing lies in the purposes mentioned above.

Retention Period: The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this occurs when the respective session ends. If data is stored in log files, this occurs after no more than seven days. Storage beyond this period is possible. In this case, users’ IP addresses are deleted or anonymized so that the client making the request can no longer be identified.

Right to Object and Opt-Out: The collection of data for the purpose of providing the website and the storage of data in log files is strictly necessary for the operation of the website. Consequently, the user has no right to object in this regard. However, the user may discontinue use of the website at any time, thereby preventing the further collection of the aforementioned data.

Contact forms and e-mail contact

Our website features contact forms that can be used to contact us electronically regarding various areas and topics. If you use this option, the data you enter in the form will be transmitted to us and stored. The subsequent data processing generally relates to the specific topic associated with the contact form.

You can send us a message at any time using our contact form. The specific information requested is listed on the web form. Required fields are clearly marked with an asterisk. We absolutely need the information you provide in the required fields in order to process your submission.

On our website, you can also request our price lists at any time via the web form or request product master data via the web form. You can find the specific information requested there listed on the web form. Required fields are clearly marked with an asterisk. The data defined as required fields is information that we absolutely need to respond to your inquiry or process your contact request.

The following data is also stored at the time the message is sent:

The IP address of the user,
Date and time of dispatch

The data defined as mandatory fields are those that we absolutely need to answer your request or process your contact.

Alternatively, you can contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.

No data will be passed on to third parties in this context. The data is used exclusively for processing the conversation.

Purposes of Data Processing: We process the personal data provided in the input form to handle your inquiry and address your request. If you contact us, this also constitutes a legitimate interest in the processing of the data.

The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

Legal basis for data processing: The legal basis for processing your data is our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in the fact that we must process your data in order to handle your inquiry or contact request and, if necessary, respond to it.

If the contact or your request is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 letter b) GDPR (implementation of pre-contractual measures).

The legal basis for the processing of other personal data processed during the sending process is our legitimate interest in data processing in accordance with Art. 6 para. 1 letter f) GDPR, which in this case is to prevent misuse of the contact form and to ensure the security of our information technology systems.

Duration of storage: The data is deleted as soon as it is no longer required for the purpose for which it was collected.

For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with you has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

Right to Object and Right to Erasure: You have the right at any time to object to further data processing based on legitimate interests (see the note regarding the specific right to object under “Data Subject Rights” later in this Privacy Notice). In such a case, unfortunately, the conversation cannot continue.

The objection to further data processing is made possible by informal notification to us (e.g. by e-mail).

All personal data stored in the course of contacting us will be deleted in this case.

Data processing in the application process

Our website features a contact form that is specifically designed for submitting job applications electronically. If you use this form, the data you enter in the form will be transmitted to us and stored.

The application procedure requires applicants to provide us with their application data. The necessary applicant data are marked in our contact forms and can otherwise be found in the job descriptions. Basically, this includes personal details, postal and contact addresses and the documents belonging to the application, such as cover letter, CV and certificates. Applicants can also voluntarily provide us with additional information. By submitting their application to us, applicants consent to the processing of their data for the purposes of the application process in accordance with the type and scope set out in this privacy policy.

Insofar as special categories of personal data within the meaning of Art. 9 Para. 1 GDPR, their processing is additionally carried out in accordance with Art. 9 para. 2 letter b) GDPR (e.g. health data, such as severely disabled status or ethnic origin). Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR are requested from applicants, their processing is additionally carried out in accordance with Art. 9 para. 2 letter a) GDPR (e.g. health data if this is necessary for the exercise of the profession).

The data is transmitted to us in encrypted form in accordance with the state of the art.

The information requested there can be found in detail on the web form. Mandatory fields are clearly marked with an asterisk. The data that we request as mandatory fields is required in order to process your data entry.

The following data is also stored at the time the message is sent:

The IP address of the user,
Date and time of dispatch.

This data will not be passed on to third parties. The data will be used exclusively for processing the application.

Applicants can also send us their applications by e-mail. Please note, however, that e-mails are generally not sent in encrypted form and applicants must ensure that they are encrypted themselves. We can therefore accept no responsibility for the transmission path of the application between the sender and receipt on our server and therefore recommend using an online form or sending it by post. This is because instead of applying via the online form and e-mail, applicants still have the option of sending us their application by post.

In addition, the information regarding contacting us by email and data processing when applying via our contact forms also applies to your application submitted by email or mail.

Purposes of data processing: We process the applicant data only for the purpose and within the scope of the application process in accordance with the legal requirements.

The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

Legal basis for data processing: The legal basis for processing the data is Article 6(1)(b) of the GDPR (implementation of pre-contractual measures in connection with a potential employment relationship).

Retention Period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. This is the case when the application process has ended, the position has been filled, and there is no other possibility of making you additional offers based on your application.

The deletion takes place, subject to a justified revocation by the applicant, after a period of six months so that we can answer any follow-up questions about the application and meet our obligations to provide evidence under the Equal Treatment Act. Invoices for any travel expense reimbursements are archived in accordance with tax regulations.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time.

In the event of a successful application, the data provided by applicants may be processed by us for the purposes of the employment relationship.

Right to Object and Right to Erasure: You have the right at any time to object to further data processing based on legitimate interests (see the note on the specific right to object under C. of this Privacy Policy). In such a case, your application cannot be considered further. You may object to further data processing by sending us an informal notice (e.g., via email). In this case, all personal data stored in connection with your application will be deleted.

Web form for changing your customer master data

On our website, you have the option of creating your own customer master data or changing your existing customer master data using a separate web form.

The information requested can be found in detail on the web form. Mandatory fields are clearly marked with an asterisk. The data that we request as mandatory fields is required in order to process your data entry.

Alternatively, you can contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.

No data will be passed on to third parties in this context. The data is used exclusively for processing in the context of our customer database.

Purposes of data processing: The processing of personal data from the input mask serves to enable us to create you as a customer or to correct or supplement your customer master data.

The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

Legal basis for data processing: The legal basis for processing the data is Article 6(1)(b) of the GDPR (implementation of precontractual or contractual measures) based on our existing or future customer relationship with you.

In addition, data processing is also based on our legitimate interest in data processing in accordance with Art. 6 para. 1 letter f) GDPR. The legitimate interest lies in the aforementioned purposes.

Duration of storage: The data is deleted as soon as it is no longer required for the purpose for which it was collected.

This is the case when the customer relationship with you has ended. In our view, the customer relationship is terminated when it can be inferred from the circumstances that you no longer wish to place orders with us or you expressly inform us of this.

Data processing related to contractual measures may, where applicable, be subject to a retention requirement under commercial or tax law, which would then take precedence (see the discussion above on “Data Deletion and Retention Periods”).

The additional personal data collected during the sending process will be deleted after seven days at the latest.

Right to Object and Right to Erasure: You may notify us at any time that you wish to be removed from our customer database or that you no longer wish to place any further orders with us. We will then delete your customer data, unless we are required by law to retain it.

You have the right to object at any time to further data processing based on legitimate interests (see the note on the specific right to object under “Data Subject Rights” further down in this Privacy Notice). In such a case, unfortunately, the conversation cannot continue.

The objection to further data processing is made possible by informal notification to us (e.g. by e-mail).

Alternatively, you can use the PDF available for download on the page mentioned, print it out, fill in the information by hand, and send it to us. We will then enter the information you have provided into our customer system for further processing of our customer relationship.

Use of cookies by us and by third-party providers

When you use our website, so-called cookies may be used. These are small text files that are stored on your device (PC, smartphone, tablet, etc.). When you visit a website, your browser may store a cookie. This cookie contains a unique string of characters that allows the browser to be uniquely identified when you visit the website again.

Cookies are used to make our website usable in the first place, to ensure the security and integrity of the website (strictly necessary cookies), or to make the website more user-friendly (non-strictly necessary cookies).

The following data is temporarily stored in the cookies:

Language settings
Watch list regarding products/goods

Our content management system, WordPress, uses cookies that are technically necessary and therefore absolutely essential. Otherwise, the content management system would not function. Only system-critical cookies are used. By default (with one exception, see below), WordPress uses so-called session cookies. These are not intended for tracking or similar purposes, but rather ensure that the system functions correctly. As the name suggests, these cookies are stored only for the duration of a single session and expire afterward.

WordPress session cookies are:

wordpress_[hash]
When you log in, WordPress uses this cookie to store WordPress users’ authentication data. Its use is limited to the administration screen, /wp-admin/.
wordpress_logged_in_[hash]
After logging in, WordPress sets the wordpress_logged_in_[hash] cookie, which indicates that the user is logged in—and who the user is. The latter piece of information is relevant for some API applications.
wordpress_test_cookie
This cookie is set when you navigate to the login page. It is used to check whether the browser is configured to allow cookies.

WordPress cookies with a one-year expiration period:

wp-settings-[UID] & wp-settings-{time}-[UID]
WordPress also sets several wp-settings-{time}-[UID] cookies. The number at the end is the unique user ID from the “users” database table. This is used to customize the appearance of the admin interface and possibly the main site interface as well.

None of these cookies affect website users; they apply only to those who, as part of their job, manage our website in the backend (i.e., the WordPress admin interface).

In addition, third-party cookies may be used. These cookies may also enable the analysis of users’ browsing behavior. If this is the case, we will inform you separately in this privacy policy or in specific privacy notices directly when providing information about the respective third-party tools (such as analytics tools, plugins, etc.). For example, analytics tools (such as Google Analytics) set their own cookies for analytics purposes (see below).

When you visit our website, you will be informed about the use of non-essential cookies, and your consent to the processing of personal data used in this context will be obtained. If no such information is provided, then no non-essential cookies will be used.

Purposes of Data Processing: The purpose of using strictly necessary cookies is to enable users to access desired or explicitly requested website features. Some features cannot be provided without the use of cookies. For these features, it is necessary for the browser to be recognized even after a page change. The user data collected by strictly necessary cookies is not used to create user profiles.

Non-essential cookies are generally used to improve the quality of our website and its content. For example, analytics cookies help us understand how the website is used, allowing us to continuously optimize our offerings.

Legal basis for data processing: The following applies to strictly necessary cookies: The legal basis for storing strictly necessary cookies on your device and accessing them is Section 25(2)(2) of the TDDDG. The legal basis for the further processing of personal data using the information stored in the cookie is Article 6(1)(f) of the GDPR, i.e., our legitimate interest. Our legitimate interest lies in the purposes mentioned above. For non-strictly necessary cookies, the following applies: The legal basis for storing non-strictly necessary cookies on your device and accessing them is your consent pursuant to Section 25(1) of the TDDDG. The legal basis for the further processing of personal data using non-strictly necessary cookies is the consent granted at the same time pursuant to Article 6(1)(a) of the GDPR.

Storage Duration: Some of the cookies we use are deleted at the end of the browser session—that is, when you close your browser (so-called session cookies). Other cookies remain on your device and allow us or third-party providers to recognize your browser the next time you visit (persistent or static cookies). If we have stored the cookies based on your consent, we will cease further data processing upon your revocation of consent. Furthermore, we store data collected on the basis of an overriding legitimate interest until the legitimate interest no longer exists, the balancing test yields a different result, or you have effectively objected in accordance with Article 21 of the GDPR (see the visually highlighted “Notice Regarding the Special Right to Object” under “Data Subject Rights” further down in this Privacy Notice). We regularly review whether the legitimate interest still exists.

Option to Object and Delete: Cookies are stored on your computer and transmitted from it to our website. Therefore, you have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time.

Below, we have provided links for common browsers where you can find more information on managing cookie settings:

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: https://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Internet Explorer / Edge: https://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/de/latest/web-preferences/#cookies
Yandex: https://browser.yandex.com/help/personal-data-protection/cookies.html

Note: If cookies are disabled on our website, you may no longer be able to use all of the website’s features to their full extent. If you do not give your consent or withdraw the consent you have given, you can also prevent the use of cookies that are not strictly necessary.

Use of the analysis tool Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, but which is operated in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), i.e., within the EU.

Google Analytics uses so-called “cookies,” which are text files stored on your computer that enable an analysis of your use of the website.

We have entered into a data processing agreement with Google pursuant to Article 28(3) of the GDPR, which also incorporates the EU Standard Contractual Clauses. The documents can be provided upon request.

There is also an adequacy decision by the European Commission pursuant to Article 45 of the GDPR for U.S. companies that are certified under the EU-U.S. Data Privacy Framework. This is the case for Google LLC, meaning that a potential transfer of data to the U.S. under Article 45(1) of the GDPR is permitted without further ado.

Please note that Google Analytics on this website has been enhanced with the “anonymizeIp” code to ensure that IP addresses are collected anonymously (so-called IP masking). By enabling IP anonymization on this website, your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.

Further information on terms of use and data protection can be found at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/.

Purposes of Data Processing: The analytics tool and analytics cookies are used to improve the quality of our website and its content. This allows us to understand how the website is used and, as a result, to continuously optimize our offerings. The information generated by the cookie regarding your use of this website is generally transmitted to a Google server in the United States and stored there.

Legal basis for data processing: The legal basis for storing and reading non-essential cookies on the user’s device and accessing them is your consent pursuant to Section 25(1) of the TDDDG. The legal basis for the further processing of personal data using non-essential cookies is Article 6(1)(a) of the GDPR, i.e., the user’s consent.

Duration of Storage: Cookies are stored on the user’s computer and transmitted from there to our website. We store the data until the user revokes their consent, but for no longer than 50 months.

Option to Object and Opt Out: You can prevent cookies from being stored by adjusting your browser settings accordingly; please note, however, that in this case you may not be able to use all features of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).

You can prevent Google Analytics from collecting data by clicking the following link. An opt-out cookie will be set to prevent the future collection of your data when you visit this website:
<a href=”javascript:gaOptout()”>Disable Google Analytics</a>

Use of Google Maps

This website uses Google Maps, a map service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), which is operated in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), i.e., within the EU.

When you use Google Maps, information about your use of this website (including your IP address) may be transmitted to a Google server in the United States and stored there.

Google may transfer the information obtained through Maps to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. Nevertheless, it would be technically possible for Google to identify at least individual users on the basis of the data received. It is possible that personal data and personality profiles of users of the website could be processed by Google for other purposes over which we have and can have no influence.

The privacy policy and terms of use for Google products and specifically for Google Maps can be found at https://policies.google.com/technologies/product-privacy?hl=de

Purposes of Data Processing: Google Maps is used to display an interactive map in order to improve the quality of our website and its content and to provide you with a simple, useful, and familiar mapping service for navigation, to show our company headquarters, to help you plan your trip, etc.

Rechtsgrundlage der Datenverarbeitung: The legal basis for storing and reading non-essential cookies on the user’s device and accessing them is your consent pursuant to Section 25(1) of the TDDDG. The legal basis for the further processing of personal data using non-essential cookies is Article 6(1)(a) of the GDPR, i.e., the user’s consent.

Duration of Storage: As a user, you can decide for yourself whether to allow the JavaScript code required for the tool to run by adjusting your browser settings. By changing the settings in your web browser, you can disable or restrict the execution of JavaScript. Note: If JavaScript is disabled, you may no longer be able to use all features of the website to their full extent.

Furthermore, we store data collected on the basis of a legitimate interest until the legitimate interest no longer exists, the balancing test yields a different result, or you have effectively objected in accordance with Article 21 of the GDPR (see the visually highlighted “Notice Regarding the Specific Right to Object” under “Data Subject Rights” further down in this Privacy Notice).

Option to Object and Opt Out: You can easily disable the Google Maps service and thereby prevent data from being transferred to Google: To do so, disable JavaScript in your browser. To prevent JavaScript code from running entirely, you can also install a JavaScript blocker, such as the NoScript browser plugin (e.g., www.noscript.net or www.ghostery.com). Note: If JavaScript is disabled, you may not be able to use all features of the website to their full extent.

Use of the Matomo Analytics Tool

This website uses Matomo, an open-source web analytics tool provided by InnoCraft Ltd., 7 Waterloo Quay, PO625, 6140 Wellington, New Zealand, to collect and store personal data, if applicable, for marketing and optimization purposes.

Usage profiles can be created under a pseudonym using the data collected via Matomo. To do this, persistent cookies are stored on your device and read by us. Cookies are small text files that are stored locally in the cache of the site visitor’s web browser. The cookies enable the recognition of the web browser. These are so-called first-party cookies, which are set and evaluated only by us. This allows us to recognize and count returning visitors. The session recording service records individual user sessions. We can play back recorded sessions and thus analyze the use of our website. Data entered into forms is not recorded and is never visible.

The data collected using Matomo will not be used to personally identify visitors to this website without the data subject’s separate consent, nor will it be combined with personal data about the person behind the pseudonym.

For more information on Matomo’s Terms of Use and privacy policies, please visit: https://matomo.org/privacy/

Legal basis for data processing: The legal basis for setting cookies and processing personal data is the consent you have provided in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

Retention Period: We retain the collected data until the purpose for which it was collected no longer applies, but no longer than until you revoke the consent you have given us.

Right to Object and Opt-Out: You can prevent data processing through the storage of cookies by adjusting your browser settings accordingly. Please note that, in this case, you may not be able to use all features of this website to their full extent.

You may prevent us from continuing to process your data in the future by revoking the consent you have provided.

You can also prevent the collection of data related to your use of the website (including your IP address) and our processing of this data by using the opt-out option:

Use of the CRM tool Hubspot

Wir nutzen das Tool Hubspot der FirmaHubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA. Es handelt sich um ein System, in welchem von uns Daten und Adressen von Interessenten und potentiellen Kunden verarbeitet werden zum Zwecke der Werbung und des Marketings.

We have entered into a data processing agreement with HubSpot, as HubSpot processes the aforementioned data on our behalf—that is, stores it on its servers. HubSpot is certified under the EU-U.S. Data Privacy Framework and thus guarantees a level of data protection equivalent to that of the EU.

You can view HubSpot’s privacy policy here: https://legal.hubspot.com/privacy-policy

Purposes of Data Processing: The data is processed by [name] for marketing and advertising purposes. We use the data to promote our offerings to potential new customers.

Legal basis for data processing: Data processing is carried out on the legal basis of Article 6(1)(f) of the GDPR. Our overriding legitimate interest in this data processing lies in the purposes mentioned above.

Duration of storage: The data is deleted as soon as it is no longer required for the purpose for which it was collected.

This is the case for data that we collect on the basis of a legitimate interest if the legitimate interest no longer exists, if the balancing test leads to a different conclusion, or if you have effectively objected pursuant to Article 21 of the GDPR (see the visually highlighted “Notice Regarding the Specific Right to Object” under “Data Subject Rights” further down in this Privacy Notice). Right to Object and Right to Erasure: If your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right, pursuant to Article 21 of the GDPR, to object to the processing of your personal data, provided there are grounds for doing so arising from your particular situation.

Use of YouTube videos (in extended data protection mode)

Our website allows you to watch YouTube videos. The provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“YouTube”).

Wir haben YouTube-Videos im erweiterten Datenschutzmodus von YouTube eingebunden, der das Setzen von YouTube-Cookies so lange blockiert, bis ein aktiver Klick auf die Wiedergabe erfolgt.

The videos are therefore only reloaded and YouTube cookies are only set when you give your consent to the setting of YouTube cookies by clicking on such a video for the first time.

YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA. Whenever you view a product page that includes an embedded YouTube video, the website will play that video from YouTube. As part of this process, YouTube and Google receive information about which product is being accessed. If you are logged into YouTube at the same time, YouTube will recognize which specific page you are visiting when you access a page that contains a YouTube video. This information is collected by YouTube and Google and associated with your YouTube account.

Google processes your data in the United States, among other places. The European Commission has issued an adequacy decision regarding data transfers from the EU or the EEA to the United States. Google LLC, as the U.S. parent company of Google Ireland Limited, has joined the EU-U.S. Data Privacy Framework (DPF) on which this adequacy decision is based and is certified under the DPF. Consequently, data transfers to the United States are permitted without special authorization (Art. 45(1) GDPR).

As an additional basis for data processing by recipients based in so-called third countries (= countries outside the EEA, i.e., all countries outside the European Union, Iceland, Liechtenstein, and Norway) or for data transfers to such countries, Google uses the so-called EU Standard Contractual Clauses (= Art. 46. (2) and (3) of the GDPR). These Standard Contractual Clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and processed in third countries. By agreeing to these clauses with us, Google commits to adhering to European data protection standards when processing personal data, even if the data is processed in the United States. These clauses are based on an implementing decision by the European Commission. You can find the decision and the corresponding Standard Contractual Clauses here, among other places: https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32021D0914&from=DE

Google has also entered into a data processing agreement with us pursuant to Article 28(3) of the GDPR, which serves as the legal basis for our customer relationship with Google under data protection law. The content of this agreement refers to the EU Standard Contractual Clauses. You can find the data processing terms here: https://business.safety.google/intl/de/adsprocessorterms/

YouTube’s Privacy Policy provides information about the collection, processing, and use of personal data by YouTube and Google and can be accessed here: http://www.google.de/intl/de/policies/privacy.

Purposes of Data Processing: YouTube videos are embedded for the purpose of presenting multimedia content to you on the website, thereby enhancing and improving your user experience on the site. Since this makes our website more attractive, the use of YouTube also serves our marketing and advertising purposes. Furthermore, hosting and playing such videos on our own web server would involve high costs and significant effort.

Legal basis for data processing: The legal basis for storing non-essential cookies on your device and accessing them is your consent pursuant to Section 25(1) of the TDDDG. The legal basis for the further processing of personal data using non-essential cookies is Article 6(1)(a) of the GDPR, i.e., your consent granted under the GDPR, which we request from you.

Retention Period: We do not store any personal data regarding the use of YouTube videos. We analyze the number of views and accesses for individual videos, but without linking this information to any specific individual.

We have no control over the storage of data by YouTube or Google itself. You can find the exact details regarding data processing there in Google’s privacy policy at http://www.google.de/intl/de/policies/privacy.

Option to Object and Opt Out: YouTube and Google receive information that a user has visited our website whenever the user is logged into YouTube at the same time as using the app; this occurs regardless of whether the user clicks on a YouTube video or not. If you do not want this information to be transmitted to YouTube and Google, you can prevent the transmission by logging out of your YouTube account before visiting the website. In addition, you’ll find options in your YouTube account settings to minimize data processing by Google. Since the video platform is owned by Google, these settings are located in the general configuration of your Google account. There, under “Activity Settings” (https://myactivity.google.com/activitycontrols), you’ll find not only options for web and location history but also specific privacy features for YouTube. First, you can pause your video search history so that your search queries are no longer saved. Second, you can also turn off your video watch history so that none of the videos you’ve watched are saved.

Otherwise, you can prevent data processing by not visiting pages that contain YouTube videos.

Use of Google Ads Remarketing

We use Google Remarketing, an advertising analytics tool, on our website. The service provider is the U.S. company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For the European region, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all Google services.

This tool allows you to link the ad audiences created with Google Ads Remarketing to the cross-device features of Google Ads and Google DoubleClick. This allows interest-based, personalized ads—tailored to you based on your previous usage and browsing behavior on one device (e.g., a cell phone)—to also be displayed on another of your devices (e.g., a tablet or PC). If you have given Google your consent to do so, Google will link your web and app browsing history to your Google Account for this purpose. This allows the same personalized ads to be displayed on any device on which you sign in with your Google Account. To support this feature, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data to define and create audiences for cross-device advertising.

To create target audiences, we use, among other things, the customer matching feature of Google Remarketing. To do this, we transfer encrypted lists of certain customer data (e.g., email addresses) to Google. If the customers in question are Google users and are logged into their Google accounts, relevant ads will be displayed to them within the Google network (e.g., YouTube, Gmail, or a search engine).

Google processes your data in the United States, among other places. The European Commission has issued an adequacy decision regarding data transfers from the EU or the EEA to the United States. Google Inc., as the U.S. parent company of Google Ireland Limited, has joined the EU-U.S. Data Privacy Framework (DPF) on which this adequacy decision is based and is certified under the DPF. Consequently, data transfers to the United States are permitted without special authorization (Art. 45(1) GDPR).

As an additional basis for data processing by recipients located in so-called third countries (= countries outside the EEA, i.e., all countries outside the European Union, Iceland, Liechtenstein, and Norway) or for data transfers to such countries, Google uses the so-called EU Standard Contractual Clauses (= Art. 46. (2) and (3) of the GDPR). These Standard Contractual Clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and processed in third countries. By agreeing to these clauses with us, Google commits to adhering to European data protection standards when processing personal data, even if the data is processed in the United States. These clauses are based on an implementing decision by the European Commission. You can find the decision and the corresponding Standard Contractual Clauses here, among other places: https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32021D0914&from=DE

For more information about the data processed through the use of Google Remarketing, please see the Privacy Policy at https://policies.google.com/privacy?hl=de. Google provides a more detailed description of its data processing practices regarding the use of personal data from websites or apps on or within which Google services are used here: https://www.google.com/policies/technologies/ads There you will also find instructions on how to reset or delete your Google Advertising ID, which is used by Google for identification purposes.

You can find specific information about cookies set by Google here: https://policies.google.com/technologies/cookies?hl=de#types-of-cookies

Purposes of Data Processing: We use Google Remarketing to identify your interests across devices and websites, enabling us to offer you our products and services in a targeted manner on other devices and websites as well, and thereby display advertisements optimized for your actual individual needs and interests.

Legal basis for data processing: The legal basis for storing cookies and similar technologies on your device and accessing them (reading them) is your consent pursuant to Section 25(1) of the TDDDG. The legal basis for the further processing of the personal data stored in this manner on your device is your consent, granted at the same time, pursuant to Article 6(1)(a) of the GDPR.

Retention Period: We do not store any personal data related to the use of Google Analytics Remarketing. However, Google, as the provider, may store such information via the cookies or similar technologies it uses. Unfortunately, we have no control over whether Google does this or for how long.

Google provides specific information about cookies and how long they are stored here: https://policies.google.com/technologies/cookies?hl=de#types-of-cookies

According to this, cookies are stored for a maximum of 13 months, though in some cases for much shorter periods.

Right to Object and Opt-Out: You can configure your browser to notify you when cookies are set, to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser.

If you disable cookies, the functionality of this website may be limited.

You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be automated.

If you use the Google Chrome browser, in addition to the settings you configure in the “Settings” menu, you can install a plugin from the website https://www.google.com/settings/ads/plugin that disables personalized ads. Please note that you will continue to receive just as many ads as before—they will simply no longer be tailored to your interests.

If you specifically do not wish to use Google’s remarketing feature, you can generally disable it by adjusting the relevant settings at http://www.google.com/settings/ads. Alternatively, you can disable the use of cookies for interest-based advertising through the Network Advertising Initiative by following the instructions at http://www.networkadvertising.org/managing/opt_out.asp.

You can permanently opt out of cross-device remarketing/targeting by disabling personalized ads in your Google Account; to do so, follow this link: www.google.com/settings/ads/onweb/.

Using Google Tag Manager

Our website uses Google Tag Manager, a tool provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which operates the service in the EU on behalf of its parent company, Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter collectively referred to as “Google”). This service provided by Google allows website tags to be managed via a user interface. Google Tag Manager merely implements tags. This means that no cookies are used and no personal data is collected. Google Tag Manager triggers other tags, which in turn may collect data. However, Google Tag Manager does not access this data. If deactivation has been performed at the domain or cookie level, it remains in effect for all tracking tags, provided they are implemented using Google Tag Manager.

The Google tools and plugins mentioned in this privacy policy are managed via Google Tag Manager.

Google Tag Manager therefore does not result in any additional data processing; rather, it simply makes it easier to set up tags on the website. Consequently, no additional personal data is processed through the use of Google Tag Manager.

For more information about Google’s data processing, please refer to Google’s Privacy Policy. There, you can also change your settings in the Privacy Center so that you can manage and protect your data.

Here you will find further instructions on how to manage your own data in connection with Google products.

Google processes data in the United States, among other places. The European Commission has issued an adequacy decision regarding data transfers from the EU or the EEA to the United States. Google Inc., as the U.S. parent company of Google Ireland Limited, has joined the EU-U.S. Data Privacy Framework (DPF) on which this adequacy decision is based and is certified under the DPF. Consequently, data transfers to the United States are permitted without further action (Art. 45(1) GDPR).

As an additional basis for data processing by recipients based in so-called third countries (= countries outside the EEA, i.e., all countries outside the European Union, Iceland, Liechtenstein, and Norway) or for data transfers to such countries, Google uses the so-called EU Standard Contractual Clauses (Art. 46. (2) and (3) of the GDPR). These Standard Contractual Clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and processed in third countries. By agreeing to these clauses with us, Google commits to adhering to European data protection standards when processing personal data, even if the data is processed in the United States. These clauses are based on an implementing decision by the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32021D0914&from=DE

Use of Emarsys by SAP

We use services provided by SAP Emarsys Customer Engagement GmbH,

Mariahilfer Straße 123, 1060 Wien, Österreich („Emarsys“), etwa zum Versand unseres

Newsletters, der Einladung zu Webinaren und Veranstaltungen sowie der Downloadmöglichkeit von Informationen zu unserem Unternehmen und unseren Produkten („digitale Services“).

Für diese Auswertung beinhalten die versendeten E-Mails sogenannte Web-Beacons, auch

Known as tracking pixels. These single-pixel image files make it possible to track your user behavior

track. Tracking is not possible if you have disabled the display of images by default in your email program. If you manually enable the display of images, the tracking described above will take place.

In doing so, we track when you read our emails, which links you click on in them, and

We use this information to draw conclusions about your personal interests. We link this data to the actions you take on our website. Emarsys stores the information collected in this way on servers located in the European Union or the European Economic Area (EU/EEA).

Sollten Sie einen unserer digitalen Services nutzen, für den Sie den Registrierungsprozess

abgeschlossen haben (beispielsweise für unseren Newsletter), unterstützt uns Emarsys

We also use cookies to analyze your usage behavior on our website. To do this, a cookie (a text file) is stored on your device, which allows us to recognize you when you visit our website again.

Purposes of data processing: We analyze how you use our website and other digital

Use content such as videos, banners, and downloads that are posted on our website. This allows us to tailor our offerings to your individual needs, so that you receive fewer random, unsolicited offers overall. We use the data collected in this way to tailor our digital services to your interests and make them available to you accordingly.

Storage period: The cookie on your system expires after 24 months. You can prevent the cookie from being stored by adjusting your browser settings accordingly, or you can manually delete the cookie in your browser.

Right to Object and Right to Erasure: When you sign up for one of our digital services and provide personal data via a registration form in this context, we will obtain your separate declaration of consent. In doing so, you consent to the processing of your data, to the extent described, in connection with your use of our digital services—such as newsletters, invitations to webinars and events—and the associated analysis of your user behavior as described in this section. As a user, you have the option at any time to withdraw this consent and thereby cancel your registration. You may have the data stored about you modified at any time. Please contact us at the following email address: datenschutz@protektor.com.

Use of Google Site Search

This website also uses the Google Site Search feature. Site Search is an extension of the Google Analytics analytics tool. Detailed information about Google and Google Analytics can be found in this privacy policy under the heading “Use of the Google Analytics Analytics Tool.”

This integrated search service enables a full-text search of the content on our website and allows us to analyze the search terms entered. This feature enables us to gain insight into what users are specifically searching for on our website or in our online store. This, in turn, enables us to improve our offerings, products, and their discoverability. The search function can be accessed via a search box embedded on the individual web pages.

By entering a search term in the search box and pressing the enter key or the search icon (magnifying glass symbol), the user activates the search function and the search results page is called up, which loads the corresponding search results from Google using a plugin provided by Google.

The plugin, developed and provided by Google, is integrated into the search results page without modification (“as is”). The plugin enables automated communication (data exchange) between the search results page being viewed and the Google service when the search results page is accessed. The use of the search function provided by Google involves a dynamic transfer of data from the service provider Google to the search results page.

In general, no data is transmitted to Google simply by visiting our web pages that include “Google Custom Search.” Data is only transmitted to Google after the user activates the search box, initiates a full-text search, and accesses the search results page. Using the search function on the search results page also transmits user data to Google. However, if the search function is not used, no such data is transmitted.

We would like to point out that the processing, in particular the storage, deletion and use of any personal data that may be transferred is the responsibility of Google itself and that we have no influence on the type and scope of the data transferred or on its further processing by Google.

If you are logged in to Google at the same time, the Google service is able to assign the information directly to your user profile. You should log out to avoid the collection of profile information about you.

Google processes your data in the United States, among other places. The European Commission has issued an adequacy decision regarding data transfers from the EU or the EEA to the United States. Google Inc., as the U.S. parent company of Google Ireland Limited, has joined the EU-U.S. Data Privacy Framework (DPF) on which this adequacy decision is based and is certified under the DPF. Consequently, data transfers to the United States are permitted without special authorization (Art. 45(1) GDPR).

Further information from Google on the handling of user data (privacy policy) can be found at: http://www.google.com/intl/de/policies/privacy.

Purposes of Data Processing: We use Google Site Search to improve the quality of our website and its content. By using Site Search, we learn how the search function is used, what specific terms are searched for, and which searches may not lead to a relevant result, allowing us to continuously optimize our offerings for users.

Legal basis for data processing: The legal basis for the processing of personal data is Article 6(1)(f) of the GDPR, i.e., a legitimate interest on our part. Our legitimate interest lies in the purposes mentioned above.

Retention Period: We retain data collected on the basis of a legitimate interest until the legitimate interest no longer exists, the balancing test yields a different result, or you have effectively objected in accordance with Article 21 of the GDPR (see the visually highlighted “Notice Regarding the Specific Right to Object” under “Data Subject Rights” further down in this Privacy Notice).

Option to Object and Opt Out: You can prevent cookies from being stored by adjusting your browser settings accordingly. Please note that in this case, you may not be able to use all features of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).

You can easily prevent data processing by Google in Site Search by not using the internal search function on our site.

Use of Facebook Pixel, Custom Audiences, and Facebook Conversion

Our website uses the so-called “Facebook Pixel” from the social network Facebook, which is operated by Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, within the EU, by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).

Facebook processes data in accordance with its Data Use Policy. General information regarding the display of Facebook ads can be found in Facebook’s Data Use Policy: https://www.facebook.com/policy.php. For specific information and details about the Facebook Pixel and how it works, please visit Facebook’s Help Center: https://www.facebook.com/business/help/651294705016616.

Purposes of Data Processing: We use Facebook Pixel for the purposes of analyzing, optimizing, and ensuring the efficient operation of our website.

With the help of the Facebook Pixel, Facebook is able, on the one hand, to identify visitors to our website as a target audience for displaying ads (so-called “Facebook Ads”). Accordingly, we use the Facebook Pixel to ensure that the Facebook Ads we place are shown only to those Facebook users who have expressed an interest in our online offerings or who exhibit certain characteristics (e.g., interests in specific topics or products, determined based on the webpages they have visited), which we transmit to Facebook (so-called “Custom Audiences”).

We also use the Facebook Pixel to ensure that our Facebook ads align with users’ potential interests and do not come across as intrusive. Furthermore, the Facebook Pixel allows us to track the effectiveness of Facebook ads for statistical and market research purposes by determining whether users were redirected to our website after clicking on a Facebook ad (known as a “conversion”).

Legal basis for data processing: The legal basis for processing personal data using Facebook Pixel is Article 6(1)(a) of the GDPR, i.e., the consent you have provided to us.

Right to Object and Opt Out: You can object to the collection of your data by the Facebook Pixel and its use to display Facebook ads. To control the types of ads you see on Facebook, visit the page set up by Facebook and follow the instructions there regarding usage-based advertising settings: https://www.facebook.com/settings?tab=ads. These settings apply across all platforms, meaning they are applied to all devices, such as desktop computers or mobile devices.

You can also opt out of cookies used for audience measurement and advertising purposes via the Network Advertising Initiative’s opt-out page (http://optout.networkadvertising.org/) and, additionally, the U.S. website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

Using SAP Sales Cloud

We use the cloud-based CRM solution “SAP Sales Cloud” as part of our sales, customer, and prospect management. The provider is SAP SE, Dietmar-Hopp-Allee 16, 69190 Walldorf, Germany, or the respective contractually affiliated company within the SAP Group.

SAP Sales Cloud is used for the centralized management of customer, prospect, and contact data, as well as to support our sales and customer service processes. In particular, SAP Sales Cloud can be used to process contact information, company data, communication histories, quote and contract information, sales activities, tasks, appointments, leads, opportunities, interests, needs, contact requests, and other sales-related transactions.

This may particularly affect contact persons at customers, prospective customers, business partners, suppliers, and other B2B contacts, as well as individuals who communicate with us as part of an existing or prospective business relationship.

Depending on the specific case, we process the following categories of personal data via SAP Sales Cloud: Master data, including last name, first name, job title, department, employer, or company; business contact information, including business email address, phone number, mailing address, and communication channels; communication data, specifically the content and metadata of emails, phone notes, meetings, contact form inquiries, and other business communications; sales and contract data, specifically inquiries, quotes, orders, contract status, customer history, products, services, projects, revenue, and pipeline information; Interest, needs, and activity data, in particular information regarding products, services, conversations, appointments, follow-ups, lead status, opportunity status, and other sales-related activities;

Technical and organizational metadata, in particular timestamps, processing status, responsible employees, log data, and access data, to the extent that such data is necessary for the operation, security, traceability, and administration of the system.

In this context, SAP generally processes personal data as a data processor within the meaning of Article 28 of the GDPR, based on a corresponding data processing agreement. To the extent that SAP engages other affiliated companies or subprocessors, this is done in accordance with the contractual provisions regarding data processing agreed upon with SAP.

The transfer of personal data to countries outside the European Union or the European Economic Area cannot be ruled out, particularly in connection with SAP’s support, maintenance, operations, or corporate structures. To the extent that personal data is transferred to third countries, this will only occur if the requirements of Articles 44 et seq. of the GDPR are met, in particular on the basis of an adequacy decision by the European Commission, the EU Standard Contractual Clauses, or other appropriate safeguards within the meaning of the GDPR.

No decision made exclusively by automated means, as defined in Article 22 of the GDPR, takes place in connection with the use of SAP Sales Cloud. To the extent that analysis, forecasting, recommendation, or AI-supported assistance functions are used in SAP Sales Cloud, these serve the purpose of internal sales support and do not replace human decision-making regarding the establishment, execution, or termination of a business relationship.

Purposes of Data Processing: The processing of personal data via SAP Sales Cloud is carried out, in particular, for the following purposes: managing and maintaining customer, prospect, and business partner data; Processing inquiries, initial contacts, and other business communications; initiating, executing, and managing contractual relationships; creating, editing, and tracking quotes, orders, and sales transactions; planning, managing, and documenting sales activities, appointments, tasks, and follow-ups; Managing leads, opportunities, pipeline, and forecasting processes; supporting existing customers and business partners; internal organization, collaboration, and documentation of sales and customer service processes; analyzing and improving our sales, customer service, and business processes; Compliance with legal retention, documentation, and reporting requirements; ensuring IT security, system administration, access control, and the traceability of processing operations.

Legal basis for data processing: To the extent that processing is necessary for the initiation, performance, or fulfillment of a contract with you or the company you represent, the processing is based on Article 6(1)(b) of the GDPR.

To the extent that we process data from contacts, employees, or representatives of our customers, prospective customers, suppliers, or other business partners, such processing is generally based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the efficient management and maintenance of business contacts, the handling of business inquiries, the conduct of B2B communication, the establishment and maintenance of business relationships, the organization of our sales and customer service processes, and the documentation of business-related transactions.

To the extent that processing is necessary to comply with legal obligations—in particular, commercial, tax, or other statutory retention and documentation requirements—the processing is based on Article 6(1)(c) of the GDPR.

To the extent that we obtain consent for specific processing activities—such as certain promotional communications—the processing is based on Article 6(1)(a) of the GDPR. Consent that has been given may be withdrawn at any time with future effect.

Retention Period: We store personal data in SAP Sales Cloud only for as long as is necessary for the respective processing purposes.

As a general rule, we store data on existing customers, business partners, and ongoing contractual relationships for the duration of the respective business relationship. Upon termination of the business relationship, the data will be deleted, blocked, or reduced to the extent necessary, provided there are no statutory retention requirements, statutes of limitations, or other legitimate reasons for further storage.

As a general rule, we store data on prospective customers and leads for as long as there is a legitimate business interest in maintaining contact, tracking sales, or further processing the inquiry. If this interest ceases to exist—particularly if there is no further contact or no discernible interest—the data will be deleted or reduced to the necessary extent in accordance with our data deletion policy.

To the extent that data is subject to retention requirements under commercial or tax law, we generally retain it for six or ten years. To the extent that data may be necessary to assert, exercise, or defend legal claims, we generally retain it for the duration of the statutory limitation periods. The standard statute of limitations is three years and generally begins at the end of the year in which the claim arose and we became aware of the circumstances giving rise to the claim or, absent gross negligence, should have become aware of them.

Log, security, and administrative data are stored only for as long as necessary for operational purposes, security, traceability, and the prevention of misuse, unless longer storage is required in specific cases to investigate security incidents or to comply with legal obligations.

Right to Object and Right to Erasure: You may object at any time to the processing of your personal data based on Article 6(1)(f) of the GDPR for reasons arising from your particular situation. We will then no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

To the extent that personal data is processed for direct marketing purposes, you may object to such processing at any time, effective for the future. If you object to direct marketing, your personal data will no longer be processed for these purposes.

To the extent that the processing is based on consent, you may withdraw that consent at any time with future effect. The lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal remains unaffected.

In addition, in accordance with the applicable legal requirements, you have the right to access, rectify, erase, restrict the processing of, and transfer your data, as well as the right to lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, you can contact us at any time. The contact information for the data controller and our data protection officer can be found in this Privacy Policy.

Using the If-So Dynamic Content plugin for audience-specific content

We use the WordPress plugin “If-So Dynamic Content” from If-So Technologies Ltd. on our website. The plugin enables the display of website content tailored to specific target audiences.

To this end, visitors can be assigned to one or more of the following professional target groups:

Specialized Contractor
Retailer
Architects
Industry
Prefabricated Home Builder
System manufacturer
Other

The assignment can be made through an active choice by the visitor, based on a URL or campaign parameter—such as a UTM parameter—or based on a visit to a page specifically tailored to a particular target audience.

If you have consented to the storage of your target group assignment, the first-party cookie `ifso_group_name` will be set. This cookie is stored directly by our website and contains only one or more abstract target group designations, such as “Architect.” It does not contain any names, contact information, individual user IDs, timestamps, or specific campaign data.

The plugin is operated within our WordPress installation using the configuration we have set up. Website visitor data is not transmitted to If-So Technologies Ltd. as part of the target audience segmentation described. In particular, we do not use any If-So functions for IP-based geolocation, browser-based location tracking, usage analysis, conversion tracking, conducting A/B tests, or identifying new or returning visitors. Target audience segmentation data is not transferred to any other third parties or to a third country. Processing by the hosting and IT service providers named in this Privacy Policy remains unaffected.

You can find the provider’s privacy policy here: https://www.if-so.com/privacy-policy/

Purposes of Data Processing: The purpose of this processing is to display relevant content, downloads, contact persons, and other information to visitors based on their professional target group. This is intended to improve the user experience and tailor the content displayed to the anticipated information needs of each visitor.

The ifso_group_name cookie allows us to save a target group—whether selected manually or determined based on the specified criteria—for future page views. This ensures that the target group-specific display continues even during subsequent page views and future visits.

If a URL or campaign parameter is used solely to select content when a page is viewed, the target audience derived from it is not stored permanently. A target group identified based on a URL, campaign, or page view is stored for subsequent page views only if you have previously consented to the use of the cookie used for this purpose.

Target audience assignment is not used to track usage behavior across pages, to create comprehensive user profiles, or to make decisions with legal or similarly significant effects. No automated decision-making within the meaning of Article 22 of the GDPR takes place.

Legal basis for data processing: The setting and reading of the ifso_group_name cookie are based solely on your consent in accordance with § 25(1) of the TDDDG.

To the extent that the stored target group assignment can be linked to a natural person or a specific device, and personal data is thereby processed, the legal basis is Article 6(1)(a) of the GDPR.

To the extent that a URL or campaign parameter is evaluated solely to select content for the respective page view, without permanently storing the resulting target group in a cookie or by any other means, the processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest is to provide visitors with information that is immediately relevant to the content of the link they have accessed and to improve the user experience.

Storage Duration: The ifso_group_name cookie is stored for one year. It will be deleted earlier if you withdraw your consent, reset your target group assignment, or delete the cookie through your browser settings.

If a target group is identified solely for a specific page view based on a URL or campaign parameter, the resulting target group assignment is not stored beyond that specific page view. The processing of URLs and access data in server log files that may occur in this context is explained at the top of Section B. under “Website Provision and Creation of Log Files.”

Right to Withdraw Consent and Opt Out: Your consent is voluntary and may be withdrawn at any time with future effect. Upon revocation, the cookie “ifso_group_name” will be deleted, and the target group assignment stored therein will no longer be used. The lawfulness of the processing carried out up to the time of revocation remains unaffected.

You can also change or completely reset your audience selection at any time using the audience selection tool on our homepage. Regardless of this, you can delete the cookie through your browser settings.

If you do not consent to the storage of this information or withdraw your consent, your target audience assignment will not be saved for future page views. You will still be able to use the website; however, you may then be shown general content instead of target audience-specific content.

Encryption of the website

The website and thus the data transmissions via it are encrypted according to the SSL standard (https protocol).

Transfer of Personal Data to a Third Country (Outside the EEA)

In certain circumstances, personal data may also be processed outside the EEA (European Economic Area) and thus in so-called third countries.

In this Privacy Policy, under the description of how each tool processes data, you can see exactly which providers might transfer data to third countries.

In principle, this may also be a country for which there is currently no EU adequacy decision—meaning that its level of data protection is not recognized as equivalent to that of the EU—although we always strive to transfer data only to safe third countries.

The EU has issued an adequacy decision for the U.S. pursuant to Article 45(1) of the GDPR, certifying that the U.S. provides an adequate level of data protection, which means that data transfers to the U.S. are generally permitted. A prerequisite for this is that third-party providers from the U.S. have each obtained certification under the EU-U.S. Data Privacy Framework (DPF). This is generally the case for the U.S. providers we have selected. As a result, data transfers to these third-party providers are permitted without further ado.

All companies that may engage in transfers to third countries and that (may) transfer personal data to a third country for which there is no EU adequacy decision, or U.S. companies that are not certified under the EU-U.S. Data Privacy Framework (DPF), must, through a binding agreement incorporating the EU Standard Contractual Clauses (SCCs; see Article 46(2)(c) of the GDPR) and by agreeing to additional data security measures, have provided sufficient safeguards for the data transfer within the meaning of the GDPR and the European Court of Justice (ECJ) and have subjected themselves to a regulatory framework that is, in principle, comparable to the EU level of data protection. Data transfers to these companies are therefore generally permitted (see Art. 44 et seq. GDPR).

Furthermore, in the case of order processing, corresponding order processing contracts have been concluded with these companies to secure the data and our rights to issue instructions.

C. Rights of data subjects

If we process your personal data, you are a “data subject” and you have the following rights with respect to us as the data controller:

Right to information

You have the right to obtain confirmation from us free of charge as to whether we are processing personal data concerning you. If this is the case, you have a right to information about this personal data and to further information, which you can find in Art. 15 GDPR. You can contact us by post or e-mail.

Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. You also have the right – taking into account the above-mentioned purposes of processing – to request the completion of incomplete personal data, including by means of a supplementary declaration. You can contact us by post or e-mail.

Right to erasure

You have the right to demand the immediate deletion of personal data concerning you if one of the conditions of Art. 17 GDPR is met. You can contact us by post or e-mail.

Right to restriction of the processing

You have the right to demand that we restrict processing if one of the requirements of Art. 18 GDPR is met. You can contact us by post or e-mail.

Right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed about these recipients by the controller.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from us, where the requirements of Art. 20 GDPR are met. You can contact us by post or e-mail.

Right to object to processing based on legitimate interest

If, in exceptional cases, we process personal data on the basis of Art. 6(1)(f) GDPR (i.e. on the basis of legitimate interests), you have the right to object to the processing of your personal data by us at any time on grounds relating to your particular situation. If we cannot demonstrate compelling legitimate grounds for further processing which override your interests, rights and freedoms, or if we process your data for the purpose of direct marketing, we will no longer process your data (see Art. 21 GDPR). You can contact us by post or e-mail.

A technical procedure that you use, e.g. a unique technical information that your web browser transmits to us (“do-not-track” message).

Right of revocation if consent has been granted

You have the right to withdraw your consent to the collection and use of personal data at any time with effect for the future. You can contact us by post or e-mail. This does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

Automated decision-making including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Unless the decision is necessary for the conclusion or performance of a contract between you and us, it is permissible on the basis of Union or Member State legislation to which we are subject and this legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or the decision is made with your express consent.

We do not carry out such automated decision-making.

Voluntary nature of the provision of data

If the provision of personal data is required by law or contract, we will always point this out when collecting the data. In some cases, the data we collect is required for the conclusion of a contract, namely if we would otherwise not be able to fulfill our contractual obligation to you, or not sufficiently. You are under no obligation to provide the personal data. However, failure to provide it may mean that we are unable to perform or offer a service, action, measure or similar requested by you or that it is not possible to conclude a contract with you.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other rights, you have the right to lodge a complaint with a data protection supervisory authority at any time, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes data protection law.

Date of our Privacy Policy: July 20, 2026

Privacy policy

A. Our contact details and general information on data processing by us

B. Scope of the Processing of Personal Data Through Our Website

C. Rights of data subjects