Date protection declaration and the use of Piwik analytics
I. Name and address of the controller
The controller, as defined by the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations, is:
GMÖHLING Transportgeräte GmbH
Stadelner Hauptstr.34
90765 Fürth
Germany
Tel.:0 911 7669-0
Email:info@gmoehling.com
Website: www.gmoehling.com
II. Name and address of the Data Privacy Officer
The Data Privacy Officer of the controller is:
Frank A. Keller
Glöckner Keller Rechtsanwälte
Johannisstraße 5
90419 Nuremberg
Germany
Email: info@gmoehling.com
Website: www.anwaelte-gkr.de
III. General information on data processing
1. Scope of the processing of personal data
We collect and utilise our users’ personal data only to the extent necessary in order to provide a functional website and to provide our contents and services.Our users’ personal data are collected and utilised on a regular basis, only with the consent of the user.An exception is made in cases where prior consent cannot be obtained for factual reasons and the law permits the processing of the data.
2. Legal basis for the processing of personal data
In cases where we obtain the consent of the data subject to process their personal data, we do so on the basis of Art. 6 Sect. 1 lit. a of the General Data Protection Regulation (GDPR).
When processing personal data required in order to fulfil a contract, the contracting party of which is the data subject, the legal basis is Art. 6 Sect. 1 lit. b GDPR.This also applies to processing operations which are required in order to perform pre-contractual duties.
To the extent that personal data have to be processed in order to fulfil a legal obligation on the part of our company, the legal basis is Art. 6 Sect. 1 lit. c GDPR.
In cases where personal data must be processed in order to ensure vital interests of the data subject or another natural person, the legal basis is Art. 6 Sect. 1 lit. d GDPR.
If processing is required in order to safeguard a legitimate interest of our company or a third party, and if the aforementioned interest does not outweigh the interests, basic rights and basic freedoms of the data subject, then the legal basis is Art. 6 Sect. 1 lit. f GDPR.
3. Data deletion and term of storage
The personal data of the data subject are deleted and blocked as soon as there is no longer a need to store it.Data can be stored longer if provided for by European or national legislation in EU directives, laws or other regulations to which the controller is subject.Data are also blocked or deleted if a term of storage stipulated by one of the aforementioned standards expires, unless the data need to be stored longer in order to conclude or fulfil a contract.
IV. Data processing for fulfilment of contract
1. Description and scope of data processing
For the purpose of contract fulfilment, we collect and store the following data:
(1) name, contact information and contact person of the contracting party, insofar as these data are disclosed by the contracting party.
(2) Documents and contracts can be filed in our records as originals or photocopies or filed electronically in electronic records.
(3) Email contacts are also stored electronically.For details, refer to Section X. Privacy Statement on email contacts.
1. Legal basis for data processing
In case of consent, the legal basis for processing the data of the contracting party is Art. 6 Sect. 1 lit. a GDPR.
If the data collected is used for the purpose of fulfilling a contract, the contracting party of which is the contracting party or to perform pre-contractual duties, the additional legal basis for processing the data is Art. 6 Sect. 1 lit. b GDPR.
2. Purpose of data processing
The recording of the aforementioned data is necessary in order to fulfil a contract with the contracting party or to perform pre-contractual duties.
The data are required in order to fulfil a contract, because the purchaser needs the contact information and contact person in order to contact them and, in particular, to send them documents.
3. Term of storage
The data are deleted, as soon as they are no longer required for the purpose for which they were collected.
This is the case for the duration of the long-term obligation to fulfil a contract or to perform pre-contractual duties if the data are no longer required in order to perform the contract.After contract conclusion, there can still be a need to store personal data of the contracting party in order to meet contractual or legal obligations.
In conjunction with our business activities, we are generally obligated to retain our business documents and the personal data contained therein for a period of ten years.
Provided there are no other contractual or legal obligations, the data are deleted once the aforementioned deadline expires.
4. Opting out and deletion of data
As the data subject, you have, at all times, the option of opt out of the storage of your personal data and/or to request that they be deleted.You can have the data stored on you modified at any time.
If the data are required in order to fulfil a contract or perform pre-contractual duties, the data can only be deleted early if no contractual or legal obligations prevent it from being deleted.
V. Providing the website and creating log files
1. Description and scope of data processing
Each time our website is accessed, our system automatically logs data and information on the computer system of the accessing computer.
The following data are collected:
(1) Browser type / browser version
(2) Operating system used
(3) Referrer URL
(4) Host name of the accessing computer
(5) Time of server request
The data are also saved in the log files of our system.This does not pertain to IP addresses of the user or other data which make it possible to associate the data with a user.These data are not stored together with other personal data of the user.
2. Legal basis for data processing
The legal basis for the temporary storage of the data is Art. 6 Sect. 1 lit. f GDPR.
3. Purpose of data processing
Temporary storage of the IP address is required by the system in order to bring the website to the user’s computer.For this purpose, the user’s IP address must be retained for the duration of the session.
Log files are stored in order to ensure the functionality of the website.We also use the data in order to optimise the website and to ensure the security of our IT systems.The data are not evaluated for marketing purposes in conjunction with this.
These purposes also include our legitimate interest in data processing as per Art. 6 Sect. 1 lit. f GDPR.
4. Term of storage
The data are deleted, as soon as they are no longer required for the purpose for which they were collected.When data are logged in order to provide the website, this occurs once the session is ended.
When data are stored in log files, this occurs no later than one month later.Any further storage is excluded.In this case, the user’s IP addresses are deleted or altered such that they can no longer be associated with the accessing client.
5. Opting out and deletion of data
It is absolutely necessary to log data in order to provide the website and to store data in log files in order to operate the website.The user has no option to opt-out.
VI. Email contact
1. Description and scope of data processing
The user can be contacted using the email address provided.In this case, we store the user’s personal data which is transferred to us with the email.
We do not disclose these data to third parties in this context.The data are used exclusively for the purpose of processing the conversation.
2. Legal basis for data processing
The legal basis for processing the data transmitted to us in the course of sending an email is Art. 6 Sect. 1 lit. f GDPR.If the purpose of the email contact is to conclude a contract, then Art. 6 Sect. 1 lit. b GDPR serves as an additional legal basis.
3. Purpose of data processing
The sole purpose for which we process personal data from email correspondences is to process the correspondence.This is also in the necessary, legitimate interest of processing the data.
4. Term of storage
The data are deleted, as soon as they are no longer required for the purpose for which they were collected.For personal data transmitted via email, this occurs once the conversation with the user is ended.The conversation is ended when the circumstances imply that the given issue has been resolved.
5. Opting out and deletion of data
The user can, at any time, revoke their consent to allow us to process their data.If the user contacts us by email, they can revoke their consent allow us to store their personal data at any time.In such a case, the conversation cannot be continued.
Consent can be revoked using the email contact of the controller.
In this case, all personal data stored in the course of correspondence will be deleted.
VII. Web analysis by Matomo (formerly PIWIK)
1. Scope of the processing of personal data
On our website, we use the open-source software tool Matomo (formerly PIWIK) in order to analyse the surfing behaviour of our users.The software does not set any cookies on the user’s computer.When the individual pages of our website are accessed, the following data are stored:
(1) Two bytes of the IP address of the user’s accessing system
(2) The website accessed
(3) The website from which the user arrived at the website accessed (referrer)
(4) The subpages accessed from the website which was accessed
(5) The amount of time spend on the website
(6) The frequency with which the website is accessed
The software runs exclusively on the servers of our website.This is the only location we store users’ personal data.We do not disclose the data to third parties.
The software is set up such that the IP addresses are not saved in full; rather 2 bytes of the IP address are masked (e.g.:192.168.xxx.xxx).Thus, the abbreviated IP address can no longer be associated with the accessing computer.
2. Legal basis for the processing of personal data
The legal basis for the processing of users’ personal data is Art. 6 Sect. 1 lit. f GDPR.
3. Purpose of data processing
Processing users’ personal data allows us to analyse the surfing behaviour of our users.Using the evaluation of the data we acquire, we are able to compile information regarding the usage of individual components of our website.This helps us to continually improve our website and make it more user-friendly.These purposes also include our legitimate interest in data processing as per Art. 6 Sect. 1 lit. f GDPR.By anonymising the IP address, we are also adequately supporting the interest of the user in protecting their personal data.
4. Term of storage
The data are deleted as soon as they are no longer required for our record-keeping purposes.
In our case, this means 180 days after collection.
5. Opting out and deletion of data
Since connection data can only be stored anonymised, and the software is also set up such that it does not save any cookies on the user’s computer, there is no option to opt out.
VIII. Rights of the data subject
If your personal data are processed, then you are the data subject as defined bythe GDPR, and you have the following rights with regard to the controller:
1. Right to access information
You can request that the controller confirms whether or not we process personal data pertaining to you.
If we do process such data, you can request the following information from the controller:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data being processed;
(3) the recipient or categories of recipients to whom your personal data have been disclosed or are still being disclosed;
(4) how long your personal data are scheduled to be stored or, if no specific length of time can be indicated, criteria for determining how long they will be stored;
(5) the existence of a right to have your personal data corrected or deleted, a right to restrict the processing by the controller or opt out of this processing;
(6) the existence of a right to appeal through a controlling authority;
(7) all available information relating to origin of the data if the personal data were not collected from the data subject;
(8) the existence of an automated decision-making system, including profiling, as per Art. 22 Sect. 1 and 4 GDPR and – at least in these cases – meaningful information relating to the implicated logic, as well as the range and targeted effects of such processing for the data subject.
You are entitled to request to be notified of whether or not your personal data are being disclosed to a third country or to an international organisation.In this context, you can request to be informed of the suitable guarantees as per Art. 46 GDPR in conjunction with the disclosure.
2. Right to correction
You have the right to have your data corrected and/or completed by the controller if the personal data pertaining to you which we process are incorrect or incomplete.The controller must make the correction immediately.
3. Right to restrict processing
Under the following conditions, you can request that the processing of your personal data be restricted:
(1) if you dispute the accuracy of the personal data pertaining to you for a period of time which allows the controller to verify the accuracy of the personal data;
(2) the processing is illegal and you reject the deletion of your personal data and instead demand that the use of the personal data be restricted;
(3) the controller no longer needs the personal data for the purposes for which they were processed, but you need them in order to enforce, exercise or defend legal claims, or
(4) if you have entered an objection to the processing as per Art. 21 Sect. 1 GDPR and have not yet established whether or not the justified reasons of the controller outweigh your own reasons.
If the processing of your personal data has been restricted, these data may not - except for your own storage - be processed without your consent, except in order to enforce, exercise or defend legal claims or to defend the rights of another natural or legal person or for reasons of a major public interest of the Union or a member state.
If the processing restriction has been restricted in accordance with the aforementioned constraints, you will be notified by the controller before the restriction is lifted.
4. Right to deletion
a) Obligation to delete data
You can request that the controller immediately delete your personal data, and the controller is obligated to delete these data immediately if one of the following reasons applies:
(1) The personal data pertaining to you are no longer required for the purposes for which they were collected or otherwise processed.
(2) You revoke your consent, on which the processing as per Art. 6 Sect. 1 lit. a or Art. 9 Sect. 2 lit. a GDPR is based, and there is no other legal basis for processing.
(3) You enter an objection to the processing in accordance with Art. 21 Sect. 1 GDPR and there are no higher-priority justified reasons for the processing, or you enter an objection to the processing in accordance with Art. 21 Sect. 2 GDPR.
(4) The personal data pertaining to you were processed illegally.
(5) The deletion of the personal data pertaining to you is necessary in order to fulfil a legal obligation in accordance with Union law or the right of the member states, to which the controller is subject.
(6) The personal data pertaining to you were collected in line with the services offered by the information society in accordance with Art. 8 Sect. 1 GDPR.
b) Disclosure to third parties
If the controller has disclosed your personal data to third parties and is obligated to delete them in accordance with Art. 17 Sect. 1 GDPR, then they will take reasonable steps, including technical steps, with due consideration of the available technologies and implementation costs, in order to inform those responsible for data processing that you, as the data subject, have requested that they delete all links to these personal data or copies or replications of these personal data.
c) Exceptions
The right to deletion does not apply if the processing is required
(1) in order to exercise the right to free speech and information;
(2) in order to fulfil a legal obligation which requires processing under the laws of the Union or the member states, to which the controller is subject, or to exercise a duty which is in the public interest or in exercise of official authority which has been conferred on the controller;
(3) for reasons of public interest in the sphere of public health as per Art. 9 Sect. 2 lit. h and i, as well as Art. 9 Sect. 3 GDPR;
(4) for archiving, scientific or historical research purposes in the public interest or for statistical purposes as per Art. 89 Sect. 1 GDPR, as far as the law stipulated under Section a) likely renders the realization of the goals of this processing impossible or seriously impacts it, or
(5) in order to enforce, exercise or defend legal claims.
5. Right to information
If you have enforced your right to rectification, deletion or restriction of processing against the controller, the latter is obligated to notify all recipients to whom your personal data was disclosed of this rectification or deletion of the data or restriction of processing, unless this is found to be impossible or would give right to disproportionate difficulties.
You have the right to be informed of these recipients by the controller.
6. Right to data transmission
You have the right to receive the personal data pertaining to you which have provided to the controller in a structured, conventional and machine-readable format.In addition, you have the right to transmit these data to another controller without disruption to the controller to whom the personal data was provided, as far as
(1) the processing is based on consent as specified in Art. 6 Sect. 1 lit. a GDPR or Art. 9 Sect. 2 lit. a GDPR or on a contract in accordance with Art. 6 Sect. 1 lit. b GDPR and
(2) the processing is done using automated procedures.
In exercising this right, you also have the right to have the personal data pertaining to you transmitted directly from one controller to another controller, as long as this is technically feasible.Freedoms and rights of other persons may not be adversely affected by this.
The right to data transmission does not apply to process of personal data which are required in order to exercise a duty in the public interest or in exercise of official authority which has been conferred on the controller.
7. Right to opt out
You have the right to object at any time to the processing of your personal data in accordance with Art. 6 Sect. 1 lit. e or f GDPR for reasons stemming from your particular situation; this also applies to profiling based on these terms.
The controller will no longer process your personal data unless they are able to demonstrate compulsory and legitimate reasons which take precedence over your interests, rights and freedoms or demonstrate that the data are being processed in order to enforce, exercise or defend legal claims.
If your personal data are processed for the purpose of direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling, as far as it is related to such direct advertising.
If you opt out of processing for the purpose of direct advertising, we will no longer use your personal data for this purpose.
In conjunction with the use of services of the information society – regardless of Directive 2002/58/EC – you have the option of exercising your right to opt out using automated processes which utilise technical specifications.
8. Right to revoke the data privacy statement of consent
You have the right to revoke your data privacy statement of consent at any time.Revoking your consent will not affect the legality of the processing which occurred based on the consent prior to its revocation.
9. Right to appeal through a controlling authority
Without prejudice to an other type of administrative or legal remedy, you have the right to appeal through a controlling authority, in particular in the member state of your residence, your workplace or the location of the alleged violation if you believe that the processing of your personal data violates the GDPR.
The controlling authority through which you filed your appeal will inform the complainant of the status and the results of the complaint, including the possibility of a legal remedy as per Art. 78 GDPR.