Privacy Policy

PRIVACY POLICY

Thank you for visiting our online store. The secure handling of your data is particularly important to us. We would therefore like to provide you with detailed information about how your data is used when you visit our website.

1. Definitions

This Privacy Policy is based on the terminology used by the European legislative and regulatory bodies when enacting the General Data Protection Regulation (GDPR). Our Privacy Policy is intended to be easy to read and understand for the general public as well as for our customers and business partners. To ensure this, we would like to explain the terminology used in advance.

In this Privacy Policy, we use the following terms, among others:

• Personal Data: Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A natural person is considered identifiable if that person can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Data Subject: A data subject is any identified or identifiable natural person whose personal data is processed by the controller.
• Processing: Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of making available; the alignment or combination; the restriction; the erasure; or the destruction.
• Restriction of processing: Restriction of processing means the marking of stored personal data with the aim of limiting its future processing.
• Profiling: Profiling is any type of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
• Pseudonymization: Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures that ensure the personal data is not attributed to an identified or identifiable natural person.
• Controller: The controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. If the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for under Union law or the law of the Member States.
• Processor: A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
• Recipient: A recipient is a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, regardless of whether or not that body is a third party. However, public authorities that may receive personal data in the course of a specific investigative mandate under Union law or the law of the Member States are not considered recipients.
• Third Party: A third party is a natural or legal person, public authority, agency, or other body other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.
• Consent: Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed by a statement or by a clear affirmative action, by which the data subject signifies agreement to the processing of personal data relating to him or her.

2. Data Collection

Our website collects a range of general data and information each time a data subject or an automated system accesses the website. This general data and information is stored in the server’s log files. The following may be collected:

a) the types and versions of browsers used,

b) the operating system used by the accessing system,

c) the website from which an accessing system reaches our website (so-called “referrer”),

d) the subpages accessed via an accessing system on our website,

e) the date and time of access to the website,

f) the name and URL of the file retrieved,

g) an Internet Protocol address (IP address) of the,

h) the date and time of access,

i) the Internet service provider of the accessing system, and

j) other similar data and information used for security purposes in the event of attacks on our information technology systems.

We do not draw any conclusions about the data subject when using this general data and information. Rather, this information is needed to

a) correctly display the content of our website,

b) ensure smooth access to our website,

c) optimize the content of our website as well as the advertising displayed on it,

d) ensure the long-term functionality, as well as the evaluation of system security and stability, of our information technology systems and the technology underlying our website, and

e) provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack.

We therefore evaluate this anonymously collected data and information both for statistical purposes and with the aim of enhancing data protection and data security within our company, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from any personal data provided by a data subject.

The legal basis for data processing is Art. 6(1), sentence 1, subparagraph f of the GDPR. Our legitimate interest stems from the purposes of data collection listed above. Under no circumstances do we collect the data for the purpose of drawing conclusions about your identity.

3. Disclosure of Data

Your personal data will only be disclosed to third parties for purposes other than those listed below if:

• You have given your explicit consent pursuant to Article 6(1)(a) of the GDPR,
• the disclosure is necessary pursuant to Article 6(1)(f) of the GDPR to assert, exercise, or defend legal claims, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data,
• there is a legal obligation to disclose the data pursuant to Article 6(1)(c) of the GDPR, and
• such disclosure is permitted by law and necessary pursuant to Article 6(1)(b) of the GDPR for the performance of contractual relationships with you.

4. Legal or contractual requirements for the provision of personal data; necessity for the conclusion of a contract; obligation of the data subject to provide personal data; possible consequences of failure to provide data

We hereby inform you that the provision of personal data is in some cases required by law (e.g., tax regulations) or may also arise from contractual provisions (e.g., information about the contractual partner). In some cases, it may be necessary for a data subject to provide us with personal data in order to conclude a contract, which we must subsequently process. For example, the data subject is obligated to provide us with personal data when our company enters into a contract with them. Failure to provide the personal data would result in the contract with the data subject not being able to be concluded. Before providing personal data, the data subject must contact our Data Protection Officer. Our Data Protection Officer will inform the data subject, on a case-by-case basis, whether the provision of personal data is required by law or contract, or is necessary for the conclusion of a contract; whether there is an obligation to provide the personal data; and what the consequences of failing to provide the personal data would be.

5. Use of Data When Subscribing to an Email Newsletter

On our website, we may offer users the option to subscribe to our company’s newsletter, in which case the following applies:

We will use your email address to send you a newsletter only if you have expressly consented to this in accordance with Article 6(1)(a) of the GDPR.

The personal data transmitted to the data controller when subscribing to the newsletter is determined by the input form used for this purpose.

We inform our customers and business partners at regular intervals via a newsletter about the company’s offers. In principle, the data subject can only receive our company’s newsletter if

a) the data subject has a valid email address and

b) the data subject registers to receive the newsletter.

For legal reasons, a confirmation email is sent via the double opt-in procedure to the email address initially provided by a data subject for the newsletter. This confirmation email serves to verify whether the owner of the email address, as the data subject, has authorized receipt of the newsletter.

When a data subject subscribes to the newsletter, we also store the IP address assigned by the Internet service provider (ISP) to the computer system used by the data subject at the time of registration, as well as the date and time of registration. The collection of this data is necessary to be able to trace any (potential) misuse of a data subject’s email address at a later date and therefore serves to provide legal protection for the data controller.

The personal data collected as part of a newsletter subscription is used exclusively for sending our newsletter. Furthermore, newsletter subscribers may be informed by email if this is necessary for the operation of the newsletter service or a related registration, as might be the case with changes to the newsletter offering or alterations to the technical conditions. Personal data collected in connection with the newsletter service is not disclosed to third parties.

The data subject may cancel their subscription to our newsletter at any time. Consent to the storage of personal data, which the data subject has granted to us for the purpose of sending the newsletter, may be revoked at any time. A link for revoking consent is provided in every newsletter. Furthermore, it is possible to unsubscribe from the newsletter at any time directly on the data controller’s website or to notify the data controller of this in another manner.

6. Newsletter Tracking

Our newsletters contain so-called web beacons. A web beacon is a miniature graphic embedded in emails sent in HTML format to enable log file recording and analysis. This allows for a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded web beacon, we can determine whether and when a data subject opened an email and which links contained in the email were accessed by the data subject.

Such personal data collected via the tracking pixels contained in the newsletters is stored and analyzed by the data controller to optimize newsletter distribution and to better tailor the content of future newsletters to the data subject’s interests. This personal data is not disclosed to third parties. Data subjects are entitled at any time to revoke the separate declaration of consent provided in this regard via the double opt-in procedure. Following revocation, this personal data will be deleted by the data controller. We automatically interpret unsubscribing from the newsletter as a revocation.

7. Contact Options via the Website

In accordance with legal requirements, our website contains information that enables quick electronic contact with our company as well as direct communication with us, which also includes a general electronic mail address (e-mail address). If a data subject contacts the data controller via email or through a Contact Form, the personal data transmitted by the data subject is automatically stored. Such personal data, voluntarily transmitted by a data subject to the data controller, is stored for the purposes of processing the request or contacting the data subject. This personal data is not disclosed to third parties.

8. Use of Cookies

To make visiting our website more appealing and to enable the use of certain features, we use so-called cookies on various pages. These are small text files that are stored on your device.

The data processed by cookies is necessary for the stated purposes to safeguard our legitimate interests and those of third parties in accordance with Article 6(1)(f) of the GDPR.

Some of the cookies we use are deleted at the end of the browser session—that is, when you close your browser (so-called session cookies). Other cookies remain on your device and allow us to recognize your browser on your next visit (persistent cookies). You can configure your browser to notify you when cookies are set and to decide on a case-by-case basis whether to accept them, or to block the acceptance of cookies in specific cases or generally. If you do not accept cookies, the functionality of our website may be limited.

9. Use of Google (Universal) Analytics for Web Analytics

This website uses Google (Universal) Analytics, a web analytics service provided by Google Inc. (www.google.de). Google (Universal) Analytics employs methods that enable the analysis of your use of the website, such as so-called “cookies,” which are text files stored on your computer. The information generated about your use of this website is generally transmitted to a Google server in the United States and stored there. By enabling IP anonymization on this website, the IP address is truncated within the member states of the European Union or in other signatory states to the Agreement on the European Economic Area prior to transmission. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. The anonymized IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.

You can prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plug-in available at the following link: http://wbs.is/rom89.

As an alternative to the browser plug-in, you can click this link to prevent future data collection by Google Analytics on this website. This will place an opt-out cookie on your device. If you delete your cookies, you will need to click the link again.

Users have the option to set an opt-out cookie by clicking “this link” in the privacy policy. For the opt-out cookie to function, a script must always be inserted in the source code before the actual Google Analytics script. You can find out how to do this on the Google Analytics website at http://wbs.is/rom71.

10. Use of Facebook Social Plug-ins Using the “2-Click Solution”

Our website may use so-called social plug-ins (“plug-ins”) from the social network Facebook. This service is provided by Facebook Inc. (“Provider”).

Facebook is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). An overview of Facebook’s plug-ins and their appearance can be found here: http://wbs.is/rom90.

To enhance the protection of your data when visiting our website, the plug-ins are integrated into the page using a so-called “2-click solution.” This integration ensures that when you access a page on our website that contains such plug-ins, no connection to Facebook’s servers is established yet. Only when you activate the plug-ins—and thereby give your consent to the data transfer—does your browser establish a direct connection to Facebook’s servers. The content of the respective plug-in is transmitted directly to your browser and integrated into the page. Through the integration of the plug-ins, Facebook receives the information that your browser has accessed the corresponding page of our website, even if you do not have a Facebook Profile or are not currently logged in. This information (including your IP address) is transmitted directly from your browser to a Facebook server in the United States and stored there. If you interact with the plugins—for example, by clicking the “Like” button—the corresponding information is also transmitted directly to a Facebook server and stored there. The information is also published on Facebook and displayed to your Contacts there. For information on the purpose and scope of data collection, as well as the further processing and use of the data by Facebook, and your rights in this regard and privacy settings, please refer to Facebook’s privacy policy at http://wbs.is/rom91.

11. Embedded Videos and Images from External Websites

Some of our pages may contain embedded content from YouTube or Instagram. Simply accessing a page on our website that contains embedded videos or images from our YouTube and/or Instagram channel does not result in the transmission of any personal data, with the exception of the IP address. In the case of YouTube, the IP address is transmitted to Google Inc., 600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), and in the case of Instagram, to Instagram Inc., 181 South Park Street, Suite 2, San Francisco, California 94107, USA (“Instagram”).

12. Notification of Changes

Changes in the law or changes to our internal processes may require an update to this Privacy Policy.

In the event of such a change, we will notify you no later than six weeks before it takes effect. You generally have (No. 6) a right to withdraw your consent.

Please note that (unless you exercise your right to withdraw consent) the most current version of the Privacy Policy is the valid one.

13. Updating/Deleting Your Personal Data

You may review, modify, or delete the personal data you have provided to us at any time by sending us an email to the address listed at the end of this text. If you are a member of our organization, you may also opt out of receiving further information in the future through that channel.

You also have the right to revoke any consent you have previously given at any time, with effect for the future.

Stored personal data will be deleted if you revoke your consent to its storage.

The data controller processes and stores the data subject’s personal data only for the period necessary to achieve the purpose of storage or to the extent provided for by European legislative bodies or other legislative authorities in laws or regulations to which the data controller is subject.

If the purpose of storage no longer applies or if a retention period prescribed by the European legislative and regulatory authorities or another competent legislative authority expires, the personal data will be routinely blocked or deleted in accordance with legal requirements.

14. Rights of Data Subjects

Every data subject has the right, granted by European legislative bodies, to request confirmation from the data controller as to whether personal data concerning them is being processed. If a data subject wishes to exercise this right to confirmation, they may contact our data protection officer or another employee of the data controller at any time.

Every data subject affected by the processing of personal data has the right, granted by European legislation, to obtain from the controller, free of charge, information at any time regarding the personal data stored about them and a copy of such information (Art. 15 GDPR). Furthermore, European legislation grants the data subject the right to obtain the following information:

• the purposes of the processing
• the categories of personal data being processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
• where possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration
• the existence of a right to have the personal data concerning them rectified or erased, or to have processing restricted by the controller, or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• if the personal data are not collected from the data subject: All available information regarding the origin of the data
• the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended effects of such processing on the data subject

Furthermore, the data subject has the right to be informed whether personal data has been transferred to a third country or to an international organization. If this is the case, the data subject also has the right to receive information about the appropriate safeguards in connection with the transfer.

If a data subject wishes to exercise this right of access, they may contact our Data Protection Officer or another employee of the controller at any time.

Every data subject affected by the processing of personal data has the right, granted by European legislation, to request the immediate rectification of inaccurate personal data concerning them (Art. 16 GDPR). Furthermore, the data subject has the right, taking into account the purposes of the processing, to request the completion of incomplete personal data—including by means of a supplementary statement.

If a data subject wishes to exercise this right to rectification, they may contact our Data Protection Officer or another employee of the data controller at any time.

Every data subject affected by the processing of personal data has the right, granted by European legislation, to request that the controller erase the personal data concerning them without delay (Art. 17 GDPR), provided that one of the following grounds applies and to the extent that the processing is not necessary:

• The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
• The data subject withdraws their consent which supported the processing pursuant to Art. 6(1)(a) of the GDPR or Art. 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.
• The personal data has been processed unlawfully.
• The erasure of the personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data was collected in connection with information society services offered pursuant to Article 8(1) of the GDPR.

If any of the above grounds apply and a data subject wishes to request the erasure of personal data stored by us, they may contact our Data Protection Officer or another employee of the controller at any time. Our Data Protection Officer or another employee will ensure that the erasure request is complied with without delay.

If the personal data was generated by us and our company, as the controller pursuant to Article 17(1) of the GDPR, is obligated to erase the personal data, we will take appropriate measures—including technical measures—taking into account the available technology and the costs of implementation, to inform other controllers who process the published personal data that the data subject has requested that these other data controllers delete all links to such personal data or copies or replicas of such personal data, to the extent that the processing is not necessary. Our Data Protection Officer or another employee will take the necessary steps on a case-by-case basis.

Any data subject affected by the processing of personal data has the right, granted by European legislation (directives and regulations), to request that the controller restrict processing if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, the data subject objects to the erasure of the personal data, and instead requests the restriction of the use of the personal data.
• The data controller no longer needs the personal data for the purposes of the processing, but the data subject needs it to assert, exercise, or defend legal claims.
• The data subject has objected to the processing pursuant to Article 21(1) of the GDPR, and it has not yet been determined whether the controller’s legitimate interests outweigh those of the data subject.

If any of the above conditions are met and a data subject wishes to request the restriction of personal data stored by us, they may contact our Data Protection Officer or another employee of the controller at any time. Our Data Protection Officer or another employee will arrange for the restriction of processing.

Every data subject affected by the processing of personal data has the right, granted by European legislation, to receive the personal data concerning them—which the data subject has provided to a controller— in a structured, commonly used, and machine-readable format. They also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising their right to data portability pursuant to Article 20(1) of the GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another controller, provided this is technically feasible and does not infringe upon the rights and freedoms of others.

To exercise the right to data portability, the data subject may contact the data protection officer appointed by us or another employee at any time.

Any data subject affected by the processing of personal data has the right, granted by the European legislator, to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them that is carried out on the basis of Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.

In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject or that serve to establish, exercise, or defend legal claims.

If we process personal data for the purpose of direct marketing, the data subject has the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to us regarding processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, the data subject has the right, for reasons arising from their particular situation, to object to the processing of personal data concerning them that we carry out for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

To exercise the right to object, the data subject may contact our Data Protection Officer or another employee directly. The data subject is also free, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise their right to object through automated means using technical specifications.

Any data subject affected by the processing of personal data has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning the data subject or similarly significantly affects the data subject, provided that the decision

(a) is not necessary for the conclusion or performance of a contract between the data subject and the controller; or

(b) is authorized by Union or Member State law to which the controller is subject, and such law provides for appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject; or

(c) is based on the explicit consent of the data subject.

If the decision

a) is necessary for the conclusion or performance of a contract between the data subject and the controller, or

b) is based on the data subject’s explicit consent, we will take appropriate measures to safeguard the data subject’s rights and freedoms as well as their legitimate interests, including at least the right to request human intervention by the controller, to express their point of view, and to contest the decision.

If the data subject wishes to exercise rights relating to automated decisions, he or she may contact our Data Protection Officer or another employee of the controller at any time.

Every data subject affected by the processing of personal data has the right, granted by European legislation, to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise their right to withdraw consent, they may contact our Data Protection Officer or another employee of the data controller at any time.

15. Legal Basis for Processing

Article 6(1)(a) of the GDPR serves as the legal basis for our company’s processing operations in which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of other services or consideration, the processing is based on Article 6(1)(b) of the GDPR. The same applies to processing operations necessary for the implementation of pre-contractual measures, such as in cases of inquiries regarding our products or services. If our company is subject to a legal obligation that requires the processing of personal data—such as to fulfill tax obligations—the processing is based on Article 6(1)(c) of the GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance information, or other vital information subsequently had to be disclosed to a doctor, a hospital, or other third parties. In such cases, the processing would be based on Article 6(1)(d) of the GDPR. Finally, processing operations may be based on Article 6(1)(f) of the GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases, provided that the processing is necessary to safeguard a legitimate interest of our company or a third party, unless the interests, fundamental rights, and fundamental freedoms of the data subject override such interests. We are permitted to carry out such processing operations in particular because they were specifically mentioned by the European legislator. In this regard, the legislator took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47, second sentence, of the GDPR).

16. Legitimate Interests in Processing Pursued by the Controller or a Third Party

If the processing of personal data is based on Article 6(1)(f) of the GDPR, our legitimate interest is the conduct of our business activities for the benefit of the well-being of all our employees and our shareholders.

17. Current Status

This Privacy Policy is currently in effect and is dated January 2020.

18. The Data Controller or Your Contact Persons

If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, correction, restriction, or erasure of data, as well as to withdraw consent or object to a specific use of your data, please contact us directly at:

Company

Feldmann Metall & Schmiedekunst GmbH
Mühlsteig 25
90579 Langenzenn

Phone: 09101 / 49 77-0
Fax: 09101 / 49 77-10

Email: datenschutz@feldmann.de