Data privacy statement

2. Rights of data subjects

You have the right:

• to request information about your personal data processed by us pursuant to Article 15 GDPR. If we process your data, you may, in particular, request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, in particular in the case of recipients in third countries, the planned storage period or the criteria for determining it, the existence of a right to rectification, erasure, restriction of processing or to object, the existence of a right to lodge a complaint with a supervisory authority, the origin of your data, if not collected by us, as well as the existence of automated decision-making including profiling and, where applicable, meaningful information on the details thereof;
• pursuant to Article 16 GDPR, to immediately request the rectification of incorrect or incomplete personal data stored by us;
• pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary to, in particular, exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
• pursuant to Article 18 GDPR, to demand the restriction of processing of your personal data if the accuracy of the data is disputed by you, if the processing is unlawful but you refuse to delete it and we no longer require the data, but you require the data for the assertion, exercise or defence of legal claims, or if you have lodged an objection to processing pursuant to Article 21 GDPR and it has not yet been established whether our legitimate reasons outweigh your interests;
• pursuant to Article 20 GDPR, to receive your personal data that you have provided us with in a structured, conventional and machine-readable format or to request that it be transferred to another controller, provided that the processing is based on your consent or a contract and that the processing is carried out using automated procedures;
• pursuant to Article 7(3) GDPR, to withdraw your consent given to us at any time. As a consequence, we may no longer continue the data processing that was based on this consent in the future; and
• pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority at your usual place of residence or work or at our company headquarters for this purpose.

3. Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(1)(e) or (f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to processing of your personal data if there are reasons for doing so arising from your particular situation or if the objection is directed against direct marketing.

In the former case, we will no longer process your data unless we can prove compelling reasons that outweigh your interests, freedoms and rights or unless our processing serves to assert, exercise or defend legal claims.

In the latter case, you have a general right to object, which will be implemented by us without specifying a special situation. If you would like to exercise your right of withdrawal or right to object, an e-mail to info@dont-want-spam.schmersal.com shall suffice.
 

4. Disclosure of information

Your personal data will not be transferred to third parties for purposes other than those listed below. We only pass on your personal data to third parties if:

• you have given your express consent in accordance with Article 6(1)(1)(a) GDPR;
• the disclosure pursuant to Article 6(1)(1)(f) GDPR is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data;
• in the event that there is a legal obligation to pass on the data pursuant to Article 6(1)(1)(c) GDPR; and
• this is legally permissible and required under Article 6(1)(1)(b) GDPR for the processing of contractual relationships with you.

In addition, our processors receive your personal data for processing bound by instructions, insofar as this is necessary for the fulfilment of the order. Our processors have no personal rights of use to your data.
 

5. Data security

We use the common SSL (Secure Socket Layer) procedure within the website visit combined with the highest encryption supported by your browser. This is usually a 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol or by the use of https in front of the address of our (sub-)website. We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.
 

6. Third countries

Data will only be transferred by us to third countries in accordance with legal regulations.

The admissibility of data transfer to third countries is governed by Article 44 et seq. GDPR. If we transfer your data to a third country, you will be informed of this in the special data protection information on the respective processing procedure, stating the respective legal regulation.
 

Specific data protection information for data processing procedures on the website

1. When visiting the website

When you access our website, the browser used on your end device automatically sends information to our website server. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until it is automatically deleted:

• IP address of the requesting computer;
• date and time of access;
• name and URL of the retrieved file;
• website from which the access takes place (referrer URL);
• the browser used and, if applicable, your computer operating system and the name of your access provider.

We process the data mentioned above for the following purposes:

• to ensure a seamless connection to the website;
• to ensure easy use of our website;
• to assess system security and stability; and
• for other administrative purposes.

The legal basis for data processing is Article 6(1)(1)(f) GDPR. Our legitimate interest lies in the operation of our website and the associated representation of our company.

Your data will be deleted as soon as it is no longer required for the purposes stated, no later than after 6 months.

2. When registering for our newsletter

If you have given express consent, in accordance with Article 6(1)(1)(a) GDPR, we will use your e-mail address to send you our newsletter on a regular basis. To receive the newsletter, you are simply required to provide an e-mail address. With your registration we also save your transmitted IP address as well as the time (date and time) of registration, in order to be able to trace possible misuse of the e-mail address entered. You can unsubscribe at any time, for example via a link at the end of each newsletter. Alternatively, you can send your unsubscribe request at any time by e-mail to webmaster@dont-want-spam.schmersal.com.

We store your data until you withdraw your data.
 

3. When making your application

It is particularly important to the KAS to ensure the highest possible protection of your personal data. All personal data collected and processed within the framework of an application to KAS is protected against unauthorized access and manipulation by technical and organizational measures.

We require your personal data in the application documents in order to be able to consider you as an applicant in the application process and to verify whether you are eligible to work for our company. If you provide information that goes beyond this required information, you are voluntarily providing us with this information and agree to its processing.

The legal basis for processing is therefore Article 6(1)(1)(a) and (b) GDPR. It is possible to withdraw consent at any time. You can send your withdrawal at any time by e-mail to webmaster@dont-want-spam.schmersal.com.

Upon completion of the application process, we will store your documents for a further 4 months for evidence purposes.

For a possible conclusion of a contract it is necessary that you provide us with your personal data in the application documents. Otherwise we will be unable to consider you in the application process.

4. When registering for and using the online shop

As an entrepreneur you have the option to register as a user on our website to gain access to our online shop. For your registration we require your name, address, e-mail address and telephone number as well as the name of your company and your sales tax identification number in order to check whether you are an entrepreneur within the meaning of Section 14 BGB (German Civil Code), as we only address our services to entrepreneurs. Furthermore, the data is required for contract initiation and processing. In the case of an order via the online shop, we also process your payment data, which is required for the selected payment method. The legal basis for processing is Article 6(1)(1)(b) GDPR.

You can amend the information in your user profile at any time.

We process your data for the duration of your registration as a user or as long as this is necessary for the fulfilment of contractual obligations. Subsequently, we store the data for the duration of the statutory retention periods.

If you do not provide us with the information requested, you will be unable to register as a user or place orders with us.

We also use a login counter to collect data on the login behavior of users of the webshop. The data is evaluated internally in order to be able to address customers in a targeted manner. Based on this evaluation, we may ask you about your experience in the webshop or your login behavior. In addition, we use Microsoft Forms to collect anonymized data with regard to the user experience of the webshop. The legal basis for the processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in optimizing the customer approach to improve the shop experience. The data is stored as long as you are a user of the webshop or until you object to the processing in accordance with Art. 21 GDPR. The legal basis for the processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in optimizing the customer approach to improve the shop experience. The data is stored as long as you are a user of the webshop or until you object to the processing in accordance with Art. 21 GDPR.

5. Contact

You can contact us using the contact details provided on the website or via the chat tool. Depending on the communication channel, your contact data (e.g. e-mail address, telephone number, address) will also be transmitted and processed by us. We process this data to respond to your contact requests. Processing is carried out either on the basis of your consent, which you give by contacting us, on the basis of our legitimate interest in communicating with our customers/interested parties or for the initiation or fulfilment of a contract. Legal bases are therefore Article 6(1)(1)(a), (b) or (f) GDPR.

6. Payment provider for purchases in the web shop

The data controller has integrated components from Novalnet AG on this website. Novalnet AG is a full payment service provider, which, among other things, takes over payment processing.

If the data subject selects a payment method during the ordering process in the online shop, data from the data subject will be automatically transmitted to Novalnet AG. By selecting a payment option, the data subject consents to the transfer of personal data for the purpose of processing the payment.

The personal data transmitted to Novalnet is usually first name, last name, address, date of birth, gender, e-mail address, IP address, telephone number, cell phone number and other data necessary to process a payment. Personal data is also required to process the sales contract, which is in connection with the respective order. In particular, there may be a mutual exchange of payment information, such as bank details, card number, expiry date and CVC code, data on goods and services, prices.

The transmission of data is intended in particular for identity verification, payment administration and fraud prevention. The data controller will transmit personal data to Novalnet AG in particular if there is a legitimate interest in the transmission. The personal data exchanged between Novalnet AG and the data controller will, if necessary, be transferred by Novalnet AG to credit agencies. The purpose of this transmission is to check identity and creditworthiness.

Novalnet AG also passes on the personal data to service providers or subcontractors, as far as this is necessary to fulfil the contractual obligations or if the data is to be processed.

The data subject has the option to withdraw consent to Novalnet AG to handle personal data at any time. Withdrawal does not affect personal data that must be processed, used or transmitted for the (contractual) processing of payments.
 

Google Adwords Conversion Tracking
In order to record the use of our website statistically and analyse it for the purpose of optimizing our website for you, we also use Google Conversion Tracking, a service from Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter "Google"). Google Adwords will set a cookie on your computer if you have accessed our website via a Google ad. These cookies expire after 30 days and are not used for personal identification. If a user visits certain pages of the AdWords client's website and the cookie has not expired, Google and the client will be able to recognize that the user clicked on the ad and was redirected to that page.

Every Adwords client receives a different cookie. Cookies can therefore not be tracked through the websites of Adwords clients. The information collected using the conversion cookie is used to generate conversion statistics for Adwords customers who have opted for conversion tracking. Adwords customers are informed of the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, you will not receive information that can be used to personally identify users. The information obtained is transferred to a Google server in the USA and stored there.

Google's privacy policy on conversion tracking can be found here (https://services.google.com/sitestats/en.html).

In accordance with Article 49(1)(a) GDPR, the data will be transferred with your consent to the USA as a third country if you have given us your consent after we have informed you of the possible lack or limitation of legal protection and the lower level of data protection in the USA compared with the EU.

Google Maps
This site uses the map service Google Maps via an API. Provider of the map service is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The integration of this plug-in by us takes place by means of the so-called two-click method to protect visitors to our website in the best possible way. This means that your personal data (in particular your IP address) is not already transmitted to Google when you access the website. In fact, you must first activate the integrated map by clicking it. With this click, you give your consent to the map showing our company location being loaded and, therefore, to data being transferred to Google.

As a rule, your information is not anonymized and is transferred to a Google server in the USA and stored there. You can find more information about how we handle user data in Google's data privacy statement: www.google.com/intl/en/policies/privacy/.

Pursuant to Article 49(1)(a) GDPR, the data will be transferred with your consent to the USA as a third country if you have given us your consent after we have informed you of the possible lack or limitation of legal protection and the lower level of data protection in the USA compared with the EU.

YouTube
We use social plug-ins from YouTube LLC (901 Cherry Avenue, San Bruno, CA 94066, USA) on our website, a subsidiary of Google LLC. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) in order to make our company better known. The plug-ins are marked with a YouTube logo, in the form of a "YouTube camera" or a "Play" button, for example.

The integration of these plug-ins by us takes place by means of the so-called two-click method in order to protect visitors to our website in the best possible way. This means that your personal data (in particular your IP address) is not already transmitted to YouTube when you access the website. In fact, you must first activate the embedded "buttons" and videos by clicking them. With this click you consent to being connected to the YouTube servers.

Through this integration, YouTube receives information that your browser has accessed the corresponding page on our website, even if you do not have a YouTube profile or are not currently logged in to YouTube. This information (including your IP address) is transmitted by your browser directly to a YouTube server in the USA and stored there. If you are logged in to YouTube, YouTube can directly attribute your visit to our website to your YouTube account. When you interact with the plug-ins, for example by clicking the "YouTube" button, this information is also sent directly to a YouTube server and stored there. The information is also published on your YouTube account and displayed to your contacts.

If you do not want YouTube to directly associate the data collected via our website with your YouTube account, you must log out of YouTube before activating the plug-ins. Please see the YouTube privacy policy (https://www.youtube.com/t/privacy) for more information.

In accordance with Article 49(1)(a) GDPR, the data will be transferred with your consent to the USA as a third country if you have given us your consent after we have informed you of the possible lack or limitation of legal protection and the lower level of data protection in the USA compared with the EU.

8. Timeliness and modification of the data privacy statement

This data privacy statement is currently applicable and is the 01/2023 version. Due to the further development of our website and services in addition or due to amended legal or official requirements, it may become necessary to change this data privacy statement. You can access and print out the current data privacy statement on the website at any time at [https://www.schmersal.com/en/privacy-policy/].