Data Privacy Notice

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

GoogleAds

Microsoft Ads

LinkedIn Insight Tag

HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when using the relevant marketing tool deployed on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot carry out any remarketing or conversion tracking.

90 days

GoogleAds

Microsoft Ads

LinkedIn Insight Tag

Device data

Data that can be assigned to your device (if applicable, depending on your consent to the relevant website operator), when our ads are displayed to you on search engines or on other websites, when you interact with our ads, or when you access our website:

This includes a unique ID to (re)identify your device.

This data may be stored in cookies (Section F) on your device (if applicable, depending on your consent to operators of other websites) when our ads are displayed to you on search engines or on other websites, when you interact with our ads, or when you access our website. When you access our website or the relevant search engines and other websites participating in the same advertising networks, the information stored in these cookies (Section F) may be read.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot carry out any remarketing or conversion tracking.

90 days

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

GoogleAds

Microsoft Ads

LinkedIn Insight Tag

Profile data

Data that is collected by the relevant marketing tool and stored in a device-related profile (if applicable, depending on your consent to the relevant website operator) when our ads are displayed to you on search engines or on other websites participating in the same advertising network, or when you interact with such ads:

This includes a unique ID assigned to your device and information on our ads that are displayed to you on search engines or on other websites participating in the same advertising network, or that you have interacted with there. This also includes information on use of the relevant search engine or other website.

This can also include hashed contact data (e.g. an email address) that is known to the marketing tool concerned as well as technical information on your device that can be read from it (e.g. screen size).

Collected by the marketing tool on search engines or other websites

-

90 days

Data generated by the marketing tool used on our website and additionally stored in the device-related profile when you visit our website.

This includes the unique ID assigned to your device as well as information about the use of our website, in particular page views, frequency of views, and time spent on viewed pages, including the “conversions” triggered by you.

This can also include hashed contact data (e.g. an email address) entered by you on our website as well as technical information on your device that can be read from it (e.g. screen size).

This also includes the results of the evaluation of this information, in particular the allocation of your device-related profile to certain advertising segments.

Collected by the marketing tool on our website

-

90 days

Purpose of processing the personal data

Categories o personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Conversion tracking:

“Conversions” are user activities on our website that are defined by us. “Conversion tracking” is a process recording what happens after our adverts have been shown to you on search engines or on other websites or after you have interacted with our adverts on search engines or on other websites. For example, we can see whether you have subsequently performed a certain action on our website.

If our adverts are displayed to you on search engines or on other websites or if you interact with our adverts, information about this may be collected (if applicable, depending on your consent to the relevant website operator) and stored in a device-related profile. To be able to assign this information to your device, a unique ID may be assigned to your device (if applicable, depending on your consent to the relevant website operator), which is linked to the device-related profile. This ID can (if applicable, depending on your consent to the relevant website operator) be stored in cookies (Section F) on your device. When you subsequently visit our website, the information stored in these cookies can be read. In this way, your device can be recognized using the ID and the information stored in the device-related profile about your visit to our ads can be retrieved and further data can be stored using this ID. This enables us to record information about the use of our website, in particular the “conversions” triggered by you.

Such an assignment can also be made by performing a comparison of hashed contact information instead of via the ID or, where applicable, via a link to your account with the relevant provider (e.g. your Google account if you have activated personalized advertising). In this way, actions taken by you using different devices can also be assigned to you as a unique user.

This allows us to observe which keywords, ads, ad groups, and campaigns lead to the user actions we want. We can also understand how our return on investment (ROI) is generated and make more informed decisions about our advertising expenses. We can also automatically optimize our advertising campaigns according to our business goals.

For Google:

GoogleAds HTTP data

GoogleAds device data

GoogleAds profile data

For Microsoft:

Microsoft Ads HTTP data

Microsoft Ads device data

Microsoft Ads profile data

For LinkedIn:

LinkedIn Insight Tag HTTP data

LinkedIn Insight Tag device data

LinkedIn Insight Tag profile data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Marketing tool providers

Remarketing:

“Remarketing” (or “retargeting”) means that we can specifically re-address users who have already interacted with our website, for example with ads on search engines or on other websites that participate in the same advertising networks as us.

When you visit our website, information about your use of our website is collected and stored in a device-related profile. In order to associate this information with your device, your device is assigned a unique ID that is linked to the device-related profile. This ID is stored in cookies (Section F) on your device. If you subsequently use search engines with the same device or visit other websites that participate in the same advertising network, your device can be recognized there on the basis of the ID as-signed to it (possibly subject to your consent to the relevant operator of the website) and on the basis of this ID the stored information about the use of our website, including the assignment of your device-related profile to certain advertising segments, can be retrieved. In this way, the provider of the remarketing tool we use can present our ads to you there specifically.

Such an assignment can also be made by performing a comparison of hashed contact information instead of via the ID or, where applicable, via a link to your account with the relevant provider (e.g. your Google account if you have activated personalized advertising). In this way, actions taken by you using different devices can also be assigned to you as a unique user.

In this way, the provider of the remarketing tool we use can present our ads to you there specifically.

For Google:

GoogleAds HTTP data

GoogleAds device data

GoogleAds profile data

For Microsoft:

Microsoft Ads HTTP data

Microsoft Ads device data

Microsoft Ads profile data

For LinkedIn:

LinkedIn Insight Tag HTTP data

LinkedIn Insight Tag device data

LinkedIn Insight Tag profile data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Marketing tool providers

Profile enrichment by the provider of the remarketing tool used by us:

When you visit search engines or other websites that participate in the same advertising network, the provider of the remarketing tool used by us may add information about your use of that the relevant search engine or other website and information about the ads you are presented with or have interacted with there to the device-related profile in order to enable better personalization.

In addition, the enrichment of profiles enables the provider of the remarketing tool used by us to optimize how various ads are displayed for us and other companies for which it displays ads (e.g. controlling the frequency with which certain ads are displayed).

For Google:

GoogleAds device data

GoogleAds profile data

For Microsoft:

Microsoft Ads device data

Microsoft Ads profile data

For LinkedIn:

LinkedIn Insight Tag device data

LinkedIn Insight Tag profile data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Marketing tool providers

Personalization of ads:

We and the provider of the remarketing tool used by us personalize our ads specifically for you on the basis of your device-related profile, in particular on the basis of your use of our website.

For this purpose, we analyze the information stored in your profile and on this basis assign your profile to certain advertising segments.

For Google:

GoogleAds profile data

For Microsoft:

Microsoft Ads profile data

For LinkedIn:

LinkedIn Insight Tag profile data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Marketing tool providers

Determination of billing-relevant factors for ads placed by the provider of the remarketing tool used by us:

The information stored in your device-related profile is also used by the provider of the remarketing tool we use to evaluate the ads displayed to your device that lead to our website via the provider in order to bill us for its services. For the purpose of billing us, the provider must determine the number of visits to our website via these ads and other factors relevant for billing.

For Google:

GoogleAds profile data

For Microsoft:

Microsoft Ads profile data

For LinkedIn:

LinkedIn Insight Tag profile data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Marketing tool providers

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Meta Pixel HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when using the Meta Pixel deployed on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, functioning of the Meta Pixel is not possible.

We do not collect or store this data ourselves.

This data is collected and processed within the sphere of Meta. The data is deleted as soon as it is no longer needed for processing purposes (as a rule after two years maximum).

Meta Pixel device data

Data that is assigned to your device by the Meta Pixel:

These includes a unique ID to re(identify) recognizing returning visitors.

This data is stored in a cookie on your device (Section F) and can be read when you visit our website. These cookies can also be read (if applicable, depending on your consent to Meta) if you visit the Meta website or another website that uses the Meta Pixel with the same device.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, functioning of the Meta Pixel is impossible or only possible to a limited extent.

We do not collect or store this data our-selves.

This data is collected and processed within the sphere of Meta. The data is deleted as soon as it is no longer needed for processing purposes.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Meta Pixel event data

Data that Meta collects through the Meta Pixel, which is matched with the unique visitor ID of the visitor stored in the Meta Pixel Device Data:

These include actions that take place on our website (”events“). These include, for example, completing a newsletter registration, performing searches, completing other forms or viewing content, and downloading content (e.g. white papers).

This also includes information related to the actions recorded in each case (“parameters”). These include, for example, the value of purchases made.

This also includes events taking place on other participating websites (e.g. Facebook), such as when are ads are displayed on such sites.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, functioning of the Meta Pixel is impossible or only possible to a limited extent.

We generally do not collect or store this data our-selves.

This data is generally collected and processed within the sphere of Meta. The data is deleted as soon as it is no longer needed for processing purposes (as a rule after two years maximum).

We transmit certain events occurring during use of our site to Meta via servers. The duration of storage is based on the storage duration stated for the specific function of our website specified in this Data Privacy Notice.

Meta Pixel analysis data

Data that Meta generates based on the information collected by the Meta Pixel, which is matched with the unique visitor ID of the visitor stored in the Meta Pixel Device Data:

These include information about the effectiveness of Meta ads and user association to target groups for Meta ads.

Meta may use the information collected to generate additional information for its own purposes or for the purposes of third parties. We have no knowledge of the details of the data generated by Meta.

Independently generated by Meta

-

Meta provides us with analyses or further information based on the collected data only in aggregated, anonymized form. We cannot associate the information provided to us with any natural person.

This data is collected and processed within the sphere of Meta. The data is deleted as soon as it is no longer needed for processing purposes (as a rule after two years maximum).

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Evaluation of the effectiveness of our Meta ads and creating of target groups for our Meta ads:

The ”Meta Pixel“ records actions that users perform on our website (e.g. completing a purchase) and reports these actions to Meta.

Based on the information collected by Meta, Meta provides us with aggregated, anonymized measurement results for our Meta ads. In particular, this enables us to know whether users who receive our Meta advertisements execute certain actions on our website, such as making a purchase (so-called ”conversions“).

In addition, Meta will allow us to reach people who have visited our website or performed a specific action on our website on the basis of information collected by Meta, again via Meta and to optimize our types of target groups (”audiences“).

In addition, Meta enables us to create similar target groups (”lookalike audiences“) for us based on the information collected by Meta in order to reach people with our Meta advertisements who have similar characteristics as the users of our website.

Meta provides us with evaluations or further information based on the collected data only in aggregated, anonymous form. We cannot associate the information provided to us with any natural person. The collection and processing of personal data lies within Meta’s sphere of responsibility. We have no knowledge of the details of the processing of data in Meta’s area of responsibility.

In order to reidentify you on our website (if applicable, depending on your consent to Meta) as well as on the website of Meta and possibly on other websites that use the Meta pixel, cookies (Section F) are stored on your device and read by Meta.

Meta Pixel HTTP data

Meta Pixel device data

Meta Pixel event data

Meta Pixel analysis data

Legal basis allowing the collection of personal data through our website by Meta:

Consent (if the GDPR applies: Article6(1)(a) GDPR)

We do not process personal data in our area of responsibility. We have no knowledge of the details of the processing of data in Meta’ area of responsibility, in particular of the legal basis used by Meta for the processing.

Meta

Evaluation of activities of users of our website for use for Meta’s own purposes or for the purposes of third parties:

Meta may also use the information collected via ”Meta Pixel“ for its own purposes or for the purposes of third parties, for example to create target groups for other advertisement clients.

Meta is responsible for the collection and processing of personal data. We have no knowledge of the details of the processing of data in Meta’s area of responsibility.

In order to reidentify you on our website (if applicable, depending on your consent to Meta) as well as on the website of Meta and possibly on other websites that use the Meta Pixel, cookies (Section F) are stored on your device and read by Meta.

Meta Pixel HTTP data

Meta Pixel device data

Meta Pixel event data

Meta Pixel analysis data

Legal basis allowing the collection of personal data through our website by Meta:

Consent (if the GDPR applies: Article6(1)(a) GDPR)

We do not process personal data in our area of responsibility. We have no knowledge of the details of the processing of data in Meta’s area of responsibility, in particular of the legal basis used by Meta for the processing.

Meta

Joint controllers

Agreement between joint controllers

Meta:

Meta Platforms Ireland Ltd.

Merrion Road, Dublin 4, D04 X2K5, Ireland

We have entered into a joint controllership agreement with Meta in order to set down the various responsibilities to comply with the GDPR for processing as joint controllers (Article26 GDPR).

Under this agreement, we are required to inform you of the following:

· Meta’s contact details and the contact details of Meta’s data protection officer can be found in Meta’s privacy policy.

· Further information on how Meta processes personal data, including information on the legal basis for the processing and the assertion of data protection rights against Meta, can also be found in Meta’s privacy policy.

· Meta is responsible for safeguarding data protection rights under Articles15 to 20 GDPR for the data stored at Meta after joint processing.

Meta’s privacy policy can be found here:

https://www.facebook.com/about/privacy/

We will be happy to provide you with the main points of the agreement between Meta and us on request (contact data Section A. I).

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Newsletter form HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when accessing the form for subscribing to and unsubscribing from our newsletter on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the newsletter subscription and unsubscription form.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Newsletter form device data

Data that is assigned to your device when using the form to subscribe to and unsubscribe from the newsletter on our website:

This includes a unique ID for the form session (”session ID“) and the expiry date of the session.

This data is stored in cookies on your device (Section F) and can be read during the use of the newsletter subscription and unsubscription form on our website.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the newsletter subscription and unsubscription form.

We only process the data temporarily for the period the newsletter subscription and unsubscription form is used.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Newsletter subscription data

Data we collect during the subscription for the newsletter:

These include the following mandatory information: email address

These include the following optional information: title, first name, last name, company name, type of newsletter.

Newsletter subscribers

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the mandatory information is not provided, we cannot provide you with a newsletter.

We store this data as long as you are registered for our newsletter.

In addition, we store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for two years from the time you unsubscribed and in the event of any legal disputes until the dispute has been concluded.

Newsletter opt-in data

Log data that is generated when subscribing to and unsubscribing from the newsletter:

This includes date and time of subscription to the newsletter, and date and time when the registration notification is sent in the double opt-in procedure, date and time of the confirmation of the registration in the double opt-in procedure as well as the IP address of the device used for the confirmation, and date and time of any unsubscription from the newsletter.

Newsletter subscribers

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide you with a newsletter.

We store this data as long as you are registered for our newsletter.

In addition, we store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for two years from the time you unsubscribed and in the event of any legal disputes until the dispute has been concluded.

Newsletter tracking pixel data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) when accessing our newsletter via the “tracking pixels2 contained in the newsletter:

Tracking pixels are small graphics in HTML emails that allow a log file to be recorded and a log file analysis of access to these emails.

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), date and time of the visit. This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Newsletter subscribers

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot carry out any analysis of newsletter usage behavior and cannot personalize newsletters on this basis.

We only store this data as long as you are registered for our newsletter.

Newsletter profile data

Data in usage profiles that we create by analyzing usage behavior regarding the newsletter:

This includes data about the use of the newsletter, in particular links to our website contained in the newsletter that are accessed, access frequency, and time spent in the newsletters accessed.

Independently generated

-

We only store this data as long as you are registered for our newsletter.

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of the newsletter subscription and unsubscription form on our website and acceptance of subscriptions:

For this purpose, HTTP data is temporarily processed on our web server.

For this purpose, HTTP data is temporarily processed on our web server.

In addition, information on the current form session is stored in cookies (Section F) on your device. The cookies and the information stored in them can be read during the use of the newsletter subscription and unsubscription form in order to maintain the current form session.

Newsletter form HTTP data

Newsletter subscription data

Newsletter opt-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of the newsletter subscription and unsubscription form on our website requested by the user.

Website providers

Email newsletter providers

Ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of disruptions (e.g. DDoS attacks):

For this purpose, data is temporarily stored and evaluated in log files on our web server.

Newsletter form HTTP data

Newsletter subscription data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used to provide the form, in particular to identify, eliminate, and preserve evidence of disruptions (e.g. DDoS attacks).

Website providers

Email newsletter providers

”Double opt-in” procedure to confirm the subscription:

For this we send an email message requesting confirmation to the email address provided when registering for the newsletter. Any subscription only becomes effective when the subscriber has confirmed the email address by accessing the confirmation link in the email.

Newsletter form HTTP data

Newsletter subscription data

Newsletter opt-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the legally secure documentation of your consent to receipt of the newsletter.

Website providers

Email newsletter providers

Sending of the personalized newsletter to the newsletter subscriber:

We use the optional information provided during subscription for personalizing the newsletter and for a targeted selection of information relevant for the recipient.

If you have given your consent to this,

· the newsletter contents will be personalized on the basis of your use of our newsletter and/or

· on the basis of certain user actions on our website and other information stored in our personalized web tracking technology “Account Engagement” (formerly “Pardot”).

The aim of personalization is to tailor our newsletter contents as far as possible to the topics that we assume will be particularly relevant to you.

Newsletter subscription data

Newsletter opt-in data

If applicable, newsletter profile data

If applicable, Pardot profile data (Section B. III. 1)

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Website providers

Email newsletter providers

Storage and processing for evidence purposes for any assertion, exercise, or defense of legal claims

Newsletter subscription data

Newsletter opt-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Website providers

Email newsletter providers

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Newsletter subscription data

Newsletter opt-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers

Analysis of the usage behavior of newsletter subscribers and creation of usage profiles for the purposes of personalizing the newsletter.

In the course of this, we can in particular track clicks on links to our website contained in our newsletter. We are not able to further track the surfing behavior on our website possibly following such a click in this way and are not able to assign it to your newsletter usage profile.

Newsletter subscription data

Newsletter opt-in data

Newsletter tracking pixel data

Newsletter profile data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Website providers

Email newsletter providers

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Contact form HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when contact forms are access on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

This also includes data collected from your end device that is required to protect our contact form (e.g. mouse movements or responses to computing tasks sent to your device).

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the content of our website requested by you.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Contact form device data

Data that is assigned to your end device when you use the contact forms:

This includes a unique ID for the contact form session ("session ID") and the expiry date of the session.

This data is stored in cookies on your device (Section F) and can be read during the use of the contact forms.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide contact forms on our website.

We only process this data temporarily for the duration of use of the relevant contact form.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Contact form data

Data you provide us with in contact forms on our website:

These include the information you provide to us in the relevant contact form. In particular this could include your name, date of birth, address, telephone number, email address, company name, and the contents of your request.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot process your request.

The data is stored until your request has been dealt with.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of one year commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of the contact forms on our website and receiving queries:

For this purpose, data is processed temporarily on our web server.

For this purpose, in addition, information on the current contact form session is stored in cookies (Section F) on your device. The cookies and the information stored in them can be read during the use of the contact form in order to maintain the current contact form session.

Contact form HTTP data

Contact form device data

Contact form data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of the contact forms on our website requested by the user.

Website providers

Hosting providers

Ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks):

For this purpose, data is temporarily stored and evaluated in log files on our web server.

This also includes protecting our contact forms against unwanted automated access by machines (bots) by means of “captchas”, which run in the background of our website and use certain parameters (e.g. the time spent on the registration form, mouse movements or responses to computing tasks directed to your device) to determine whether such automated access or access by a human being is involved.

Contact form HTTP data

Contact form device data

Contact form data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks).

Website providers

Hosting providers

Processing of your request:

If you have consented to this separately, we will also use information about you that we have stored in our personalized web tracking technology “Account Engagement” (formerly “Pardot”) to process your request (e.g. information about certain user actions on our website and the use of our newsletter) in order to be able to respond better and more individually to your request.

In order to process your request, we may forward your enquiry and, subject to your separate consent, the corresponding Pardot profile data to one of our affiliated companies or to third party sales partners if this is necessary to process your request (e.g. if your company is located in a region for which one of our affiliated companies or a sales partner is responsible).

Contact form data

Where applicable, Pardot profile data (Section B. III. 1)

If your request concerns a contract to which you are party or steps taken prior to entering into a contract:

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Otherwise:

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

In this case, our legitimate interest is the processing of your request.

For optional combination with Pardot profile data:

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Where applicable, one of our affiliated companies or a third-party sales partner

Storage and processing for evidence purposes for the possible assertion, exercise, or defense of legal claims

Contact form data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

-

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Contact form data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers

Retention of data in order to comply with statutory retention obligations, in particular under commercial and tax law:

Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Contact form data

Fulfilment of a legal obligation (if the GDPR applies: Article6(1)(c) GDPR)

-

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Registration form HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when registration forms are access on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the content of our website requested by you.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Registration form device data

Data that is assigned to your device when you use the registration forms:

This includes a unique ID for the registration form session (“session ID”) and the expiry date of the session.

This data is stored in cookies on your device (Section F) and can be read during use of the registration forms.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide application forms on our website.

We only process the data temporarily for the duration of use of the relevant application form.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Master data

This may include above all the following data:

Title, name, gender, address, contact details (such as email address, telephone, and fax number),

Company, possibly different billing address,

Additional personal data (depending on the event), e.g. home address, date of birth.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, it may not be possible to take part in the seminar/event.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for 12 months from the end of the event and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Employee data

Features of the organizational classification of employees (organizational key, cost code, and personnel number), e.g. to create expense reports.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, it may not be possible to take part in the seminar/event.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for 12 months from the end of the event and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Event dates

Details of the booked event (name of the event, date, time, costs)

Assigned hotels and travel options for booking resources

Where applicable, special data required for the relevant event, such as travel dates, clothing size, special dietary preferences, passport number (for visa applications), etc.

Any comments/remarks you may have.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, it may not be possible to take part in the seminar/event.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for 12 months from the end of the event and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of our registration forms on our website and receiving registrations:

For this purpose, data is temporarily processed on our web server.

For this purpose, in addition, information on the current registration form session is stored in cookies (Section F) on your device. The cookies and the information stored in them can be read during use of the registration form in order to maintain the current registration form session.

Registration form HTTP data

Registration form device data

Master data

Employee data

Event data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of our registration forms requested by the user on our website.

Website providers

Hosting providers

Ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks):

For this purpose, data is temporarily stored and evaluated in log files on our web server.

Registration form HTTP data

Registration form device data

Master data

Employee data

Event data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks).

Website providers

Hosting providers

Organization and preparation of the seminars or events you register for

Master data

Employee data

Event data

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Event service providers

Where applicable hotel/venue

Storage and processing for evidence purposes for the possible assertion, exercise, or defense of legal claims

Master data

Employee data

Event data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

-

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Master data

Employee data

Event data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers

Retention of data in order to comply with statutory retention obligations, in particular under commercial and tax law:

Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Master data

Employee data

Event data

Fulfilment of a legal obligation (if the GDPR applies: Article6(1)(c) GDPR)

-

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Survey form HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when survey forms are accessed on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Survey participants

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the content of our website requested by you.

The data is stored in server log files for a maximum period of 12 months, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Survey form device data

Data that is assigned to your device when you use survey forms:

This includes a unique ID for the survey session (“session ID”) and the expiry date of the session.

This data is stored in cookies on your device (Section F) and can be read during use of the survey form.

Survey participants

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide survey forms on our website.

We only process the data temporarily for the duration of use of the relevant survey form.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Contact data

Data that we may collect from you to send invitations, survey links or reminders:

Email address

Information on which surveys we may contact you about.

Survey participants

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, it will not be possible to send invitations, survey links or reminders.

12 months (calculated from the end of the ongoing calendar year)

Survey form data

Data that you provide to us in the survey forms:

This includes, in particular, the information that you provide to us in the relevant survey form as a survey response (e.g. your assessment of your satisfaction with our products) and, depending on the context, any additional fields for specifying your response or for free text.

Depending on the type of survey, this may also include the following data in individual cases, which can usually be provided optionally (except in the case of “test panels”, in which this data is mandatory):

Name, postal address, country

Survey participants

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If mandatory data is not provided, participation in the survey is not possible.

12 months (calculated from the end of the ongoing calendar year)

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of our survey forms on our website and receipt of your responses:

For this purpose, data is temporarily processed on our web server.

For this purpose, in addition, information on the current survey form session is stored in cookies (Section F) on your device. The cookies and the information stored in them can be read during use of the survey forms in order to maintain the current survey form session.

Survey form HTTP data

Survey form device data

Survey form data

Contact data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of our survey forms requested by the user on our website.

Hosting providers

Survey service providers

Ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks):

For this purpose, data is temporarily stored and evaluated in log files on our web server.

Survey form HTTP data

Survey form device data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks).

Hosting providers

Survey service providers

Evaluation of the information provided in the surveys:

We statistically evaluate the answers provided by all participants and thus obtain aggregated statistical information that is no longer related to individual participants. We use these aggregated survey results to improve our product range

To participate in certain surveys (test panels), it is necessary to provide contact details in order to coordinate the test panels. We do not merge this data with the survey responses.

Survey form data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is to receive feedback from our (potential) business partners in order to improve our product range and tailor it to the needs of our (potential) business partners.

Survey service providers

Sending invitations to participate in test panels/surveys, personalized survey links, and reminder emails

Contact data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Survey service providers

Storage and processing for evidence purposes for the possible assertion, exercise, or defense of legal claims

Survey form data

Contact data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

-

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Survey form data

Contact data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Chat function HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when the chat function is accessed on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we will not be able to provide the chat function.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Chat function device data

Data that is assigned to your device when you use the chat function:

This includes a unique ID for the chat session (“session ID”) and the expiry date of the session.

This data is stored in cookies on your device (Section F) and can be read during use of the chat function.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we will not be able to provide the chat function.

We only process this data temporarily for the duration of use of the chat function.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Chat data

Data that you provide to us in dialogs with our chat employees:

This may include above all the following information: name, address, telephone number, email address, and the contents of your request.

Users of our website

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot use them to process your request.

We store the data until your request has been dealt with.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Data that our chat employees communicate to you in dialogs using our chat:

This may include above all the following information: answers to your request.

Independently generated

-

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of the chat function on our website:

For this purpose, data is temporarily processed on the web server for our chat function.

For this purpose, in addition, information on the current chat session is stored in cookies (Section F) on your device. The cookies and the information stored in them can be read during use of the chat function in order to maintain the current chat session.

Chat function HTTP data

Chat function device data

Chat data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of the chat function.

Chat function providers

Ensuring the security of the IT infrastructure used for provision of the chat function, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks):

For this purpose, data is temporarily stored and evaluated in log files on the web server of our chat function.

Chat function HTTP data

Chat function device data

Chat data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used to provide the chat function, in particular to identify, eliminate, and preserve evidence of disruptions (e.g. DDoS attacks).

Chat function providers

Processing of your request:

The request you communicate to our chat employees is processed by them and you will generally receive a response to your request straight away in the chat.

If our chat employees are not able to handle your request completely straight away, our customer service will contact you be other means (e.g. by email) in order to process your request further.

Chat data

If your request concerns a contract to which you are party or steps taken prior to entering into a contract:

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR).

Otherwise:

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

In this case, our legitimate interest is the processing of your request.

-

Storage and processing for evidence purposes for the possible assertion, exercise, or defense of legal claims

Chat data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

-

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Chat data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers

Retention of data in order to comply with statutory retention obligations, in particular under commercial and tax law:

Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Chat data

Fulfilment of a legal obligation (if the GDPR applies: Article6(1)(c) GDPR)

-

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

E-shop HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when the e-shop is accessed on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

In connection with our registration form, this also includes data collected from your end device that is required to protect our registration form (e.g. mouse movements).

Users of the e-shop

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the content of our website requested by you.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Registration data

Data that you provide to us in the relevant registration form on our website in order to register for the e-shop for the first time (opening a customer account).

This includes the following mandatory information: email address, password, first name, last name

Users of the e-shop when registering

Provision of the information marked as mandatory during the registration process is a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the mandatory information is not provided, registration will not be possible.

The data will in principle be saved until you submit a request for deletion.

Documents subject to a statutory retention period will be deleted at the end of the retention period under the applicable law (as a rule 10 years maximum).

Access data will be disabled without undue delay after we gain knowledge that a customer or contact person at a customer has left.

Additional customer account data

Data that you can add to your customer account:

This includes information on your company and function, if applicable your Phoenix Contact customer number, telephone number, invoice and delivery addresses, and payment method (e.g. credit card details).

This also includes product-related information saved by you in your customer account, such as wish lists, projects, or product comparisons.

Users of the e-shop

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot store this data in your customer account for later use. This means that you must provide this data separately if you wish to use certain functions (e.g. specifying the alternative delivery address during a specific order process). If the data is not provided, we may also not be able to open your customer account (if we cannot determine whether you are a business owner or acting on behalf of a company).

The data will in principle be saved until you submit a request for deletion.

Documents subject to a statutory retention period will be deleted at the end of the retention period under the applicable law (as a rule 10 years maximum).

Access data will be disabled without undue delay after we gain knowledge that a customer or contact person at a customer has left.

Login data

Data that is generated when logging into your customer account:

This includes your email address and your password.

This also includes a unique ID for the session in which you are logged into your customer account (“session ID”) and the expiry date of the session. This data is stored in cookies on your device (Section F) and can be read during use of our e-shop.

Users of the e-shop

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot enable you to log into the customer section.

We only process this data temporarily as long as you are logged into your customer account.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Shopping cart data

Data that is generated when using the shopping cart function:

This includes information on the products which you place in the shopping cart.

This also includes a unique ID for the shopping cart session (“session ID”) and the expiry date of the session. This data is stored in cookies on your device (Section F) and can be read during use of our e-shop.

Users of the e-shop

Provision of the data is a requirement necessary to enter into a sales contract. There is no obligation of the data subject to provide the data.

If the data is not provided, you cannot use the shopping card function. This means that you cannot purchase items from our e-shop.

We only process the data temporarily for the period the shopping cart function is used.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Contact data

Data that you provide us during the ordering process (including the process for requesting cost estimates) to contact you to process your order:

This includes company, title, first name, last name, postal address (billing address), telephone number, email address, business address, if applicable different delivery address, business contact details, department, and function in the company.

Users of the e-shop

If you are logged into your customer account when using the e-shop, this data will be taken from your customer account.

Provision of the data is a requirement necessary to enter into a sales contract. There is no obligation of the data subject to provide the data.

If the data is not provided, you may not be able to purchase any items from our e-shop.

We store the data until the handling of your order is complete, i.e. until shipping of the ordered item.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Shipping data

Data that you provide us with in the ordering process (including the process for obtaining cost estimates) for shipping your ordered items:

This includes the chosen shipping method and, if applicable, the delivery address entered that differs from the billing address.

Users of the e-shop:

If you are logged into your customer account when using the e-shop, this data will be taken from your customer account.

Provision of the data is a requirement necessary to enter into a sales con-tract. There is no obligation of the data subject to provide the data.

If the data is not provided, you cannot purchase any items from our e-shop.

We store the data until the handling of your order is complete, i.e. until the goods have been shipped.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Payment data

Data that you provide us with in the ordering process (including the process for obtaining cost estimates) for payment of your ordered items:

This includes your chosen payment method and, depending on the chosen payment method, further information that must be provided for that payment method (e.g. bank details, credit card numbers)

Users of the e-shop

If you are logged into your customer account when using the e-shop, you may use the data for select payment methods which you previously stored in your customer account.

Provision of the data is a requirement necessary to enter into a sales contract. There is no obligation of the data subject to provide the data.

If the data is not provided, you cannot purchase any items from our e-shop.

We store the data until the handling of your order is complete, i.e. until the goods have been shipped.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Order data

Information about your order or your request for a cost estimate:

This includes information about the requested items (item name, item number, quantity, size, color, price, currency, order number), store version used, date and time of purchase, and status of your order.

Independently generated

-

We store the data until the handling of your order is complete, i.e. until the goods have been shipped.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

If you have a customer account, we also store this data for the purpose of providing the customer account functions.

Transaction email data

Data from transaction emails that we send for the (re-)processing of your order or your request for a cost estimate (e.g. order acknowledgment):

This includes the content and time of the transaction emails.

Independently generated

-

We store the data until the handling of your order is complete, i.e. until the goods have been shipped.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Debtor data

Data that we process for the administration of our purchase price receivables in our internal accounts receivable management system:

This includes information on current o-pen items, incoming payments, transaction numbers of payment service providers, dunning levels, ongoing collection processes, and returns.

Payment service provider

Debt collection agency

Independently generated

-

We store the data until the handling of your order is complete, i.e. until the goods have been shipped.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Advertising management data

Information on any advertising consents you have given and any objections you may have to advertising:

This includes the date and time of consent, the IP address of the device used for consent, the date and time of any withdrawal of consent, or objection to the processing of personal data for advertising purposes.

Users of the e-shop

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we will not be able to process your consents and/or your objections to advertising.

We store this data as long as consent exists or as long as we carry out advertising measures without consent on the basis of the information provided to you in each case for this advertising.

We also store this data for evidence purposes for the possible assertion, exercise, or defense of legal claims for an interim period of three years from the end of the year in which you have withdrawn your consent or we have ended the relevant advertising measure and in the event of any legal disputes until the dispute has been concluded.

A This also includes the documentation of the information that we have provided to you in order to obtain your consent and/or for advertising that we have carried out without your consent.

Independently generated

-

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of our online shop for informational use:

For this purpose HTTP data is processed temporarily on our web server.

E-shop HTTP data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of our online shop requested by the user for informational use.

Website providers

Hosting providers

Creation of a customer account for the use of our online shop as a registered customer and provision of the customer account functions on our website:

This includes the check on whether you are a business owner or acting on behalf of a company, Provision of the log-in to the customer account, the storage of contact information, addresses, and payment information stored by the customer in the customer account for the use of the online shop. If the customer is logged into the customer account when using the online shop, the information required for the order is prefilled with the information stored in the customer account in order to make the ordering process in the online shop as convenient as possible for the customer.

This also includes displaying details of the orders made in the online shop, in particular the processing and delivery status and details of the ordered items.

Information on the session during which you are logged into your customer account is stored in cookies on your device (Section F) on your device. The cookies and the information stored in them can be read during your use of our online shop in order to maintain the current session.

E-shop HTTP data

Registration data

Additional customer account data

Log-in data

Order data

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Website providers

Hosting providers

Identity management providers

Provision of our shopping cart function:

For this purpose Information on the current shopping cart session is stored in cookies on your device (Section F) on your device. The cookies and the information stored in them can be read during your use of our e-shop in order to maintain the current shopping cart session.

E-shop HTTP data

Shopping cart data

Where placing an item into the shopping cart is used to enter into a contract:

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Otherwise:

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of the functions of our online shop requested by the user.

Website providers

Hosting providers

Performance of steps prior to entering into a contract, including preparing cost estimates, and performance of sales contracts concluded via the online shop:

This includes in particular the receipt of your request for a cost estimate or your order, the handling of the payment, the shipping of the ordered items and the sending of transaction emails to inform you about the status of your cost estimate and/or order.

If you have a customer account for our online shop and are logged into the customer account during the ordering process (including the process for obtaining cost estimates), the information required for the order is pre-filled with the information stored in the customer account in order to make the ordering process in the online shop as convenient as possible for you.

E-shop HTTP data

Shopping cart data

Contact data

Shipping data

Payment data

Order data

Transaction email data

For customers who are logged into their customer account, additionally:

Registration data

Additional customer account data

Log-in data

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Website providers

Hosting providers

Email providers

Payment providers

Shipping service providers

Identity management providers

Sending advertising by post to holders of a customer account and customers of our online shop:

If you have created a customer account in our online shop or have placed an order as a ”guest“, we may send you interesting offers and information about our products by post, unless you have objected.

We may use information about your previous orders to design the content of this advertising based on your interests.

Registration data

Contact data

Order data

Advertising management data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the promotion of our products to holders of a customer account and to customers of our e-shop.

Website providers

Hosting providers

Email providers

Administration of our purchase price claims in our internal debtor management system

Contact data

Debtor data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is administering our purchase price claims in an orderly manner.

Website providers

Hosting providers

Recovery of our purchase price claims

Contact data

Debtor data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the recovery of our purchase price claims.

Debt collection service providers

Rescission of purchase agreements in the event of cancellation or other reasons for reversal:

We use the same payment method that you used for the payment of the purchase price to refund the price.

Contact data

Shipping data

Payment data

Order data

Transactional email data

Debtor data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the rescission of purchase agreements.

Website providers

Hosting providers

Email providers

Retention for evidence purposes for any assertion, exercise, or defense of legal claims

Contact data

Shipping data

Payment data

Order data

Transactional email data

Debtor data

Advertising management data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Website providers

Hosting providers

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Contact data

Shipping data

Payment data

Order data

Transactional email data

Debtor data

Advertising management data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers

Retention in order to comply with statutory document retention obligations, in particular under commercial and tax law:

Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Contact data

Shipping data

Payment data

Order data

Transactional email data

Debtor data

Fulfilment of a legal obligation (if the GDPR applies: Article6(1)(c) GDPR)

Website providers

Hosting providers

Ensuring the security of the IT infrastructure used for provision of the online shop, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks):

For this purpose, data is temporarily stored and evaluated in log files on our web server.

This also includes protecting our registration form from unwanted automated access by machines (bots) by means of “captchas”, which run in the background of our website and use certain parameters (e.g. the time spent on the registration form or mouse movements) to determine whether such automated access or access by a human being is involved.

E-shop HTTP data

Log-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks).

Website providers

Hosting providers

Captcha provider

Identity management providers

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Registration form HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when the registration form is accessed on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of the supplier portal when registering

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the content of our website requested by you.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Registration form device data

Data that is assigned to your device when you use the registration form:

This includes a unique ID for the registration form session (“session ID”) and the expiry date of the session.

This data is stored in cookies on your device (Section F) and can be read during use of the registration form.

Users of the supplier portal when registering

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the registration form on our website.

We only process the data temporarily for the duration of use of the relevant registration form.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Registration form data

Data that you provide to us in the registration form for our supplier portal or that you may add/change later in the supplier portal:

This includes personal information about you, such as: salutation, name, title, department and function in the company, language, country, and contact details (telephone number, fax number, email address).

This also includes information about the company you wish to register as a supplier, such as company name, addresses, contact de-tails, information on products and delivery areas as well as any attachments to the registration, and comments in free text (e.g. company presentations, catalogs, etc.).

Users of the supplier portal during registration and, where applicable, after registration

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data shown as mandatory fields in the registration form is not provided, we will not be able to register you in the supplier portal. You can provide other data voluntarily so that we can keep it on record. Should we need data that is not specified, we will get in touch with you.

The master data of a supplier is stored in the system for as long as a contractual relationship exists or cannot be ruled out for the future.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

We also store this data to the extent that statutory obligations to do so, in particular commercial and tax law document retention obligations, exist. Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Supplier portal HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when the supplier portal is accessed on our website:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of the supplier portal

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot provide the content of our website requested by you.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Supplier portal account data

Access data for your account: email address and password

Independently generated

-

The master data of a supplier is stored in the system for as long as a contractual relationship exists or cannot be ruled out for the future.

We store this data for evidence purposes for the assertion, exercise, or defense of any legal claims and also for an interim period of three years commencing at the end of the year in which you provide the data to us and in the event of any legal disputes until the dispute has been concluded.

Supplier portal log-in data

Data that is generated when you log into your supplier account:

This includes your email address and your password.

This also includes a unique ID for the session during which you are logged into your supplier account (“session ID”) and the expiry date of the session. This data is stored in cookies on your device (Section F) and can be read during use of our supplier portal.

Users of the supplier portal

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we cannot enable you to log into the customer portal.

We only process the data temporarily as long as you are logged into your customer account.

(You can find more information on the lifetimes of the cookies stored on your device in Section F. III.)

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of our registration form for the supplier portal on our website and acceptance of registrations:

For this purpose, data is temporarily processed on our web server.

For this purpose, in addition, information on the current registration form session is stored in cookies (Section F) on your device. The cookies and the information stored in them can be read during use of the registration form in order to maintain the current registration form session.

Registration form HTTP data

Registration form device data

Registration form data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of our website content accessed by the user.

In the case of registration:

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Website providers

Hosting providers

Checking whether your company is eligible to become our supplier and, where applicable, setting up a supplier account to use our supplier portal

Registration form data

Supplier portal account data

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Website providers

Hosting providers

Provision of the supplier account functions on our website:

This includes providing the login to the supplier account. In the supplier account, registered suppliers can view the data stored about their company and themselves (such as contact information, addresses and company information) and adjust/update it if necessary.

For this purpose, HTTP data is temporarily processed on our web server.

Information about the session during which you are logged into your supplier portal account is stored in cookies (Section F) on your device. The cookies and the information stored in them can be read while you are using our supplier portal in order to maintain the current session.

Supplier portal HTTP data

Registration form data

Supplier portal account data

Supplier portal log-in data

Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (if the GDPR applies: Article6(1)(b) GDPR)

Website providers

Hosting providers

Ensuring the security of the IT infrastructure used for provision of the registration form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks)

For this purpose, data is temporarily stored and evaluated in log files on our web server.

Registration form HTTP data

Registration form device data

Registration form HTTP data

Supplier portal HTTP data

Supplier portal account data

Supplier portal log-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used for provision of the form, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks).

Website providers

Hosting providers

Storage and processing for evidence purposes for the possible assertion, exercise, or defense of legal claims

Registration form data

Supplier portal account data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

-

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Registration form data

Supplier portal account data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers

Retention of data in order to comply with statutory retention obligations, in particular under commercial and tax law:

Depending on the document type, commercial and tax law document retention obligations of six or ten years can exist.

Registration form data

Fulfilment of a legal obligation (if the GDPR applies: Article6(1)(c) GDPR)

-

Categories of personal data processed

Personal data included in the categories

Sources of the data

Obligation of the data subject to provide the data

Storage duration

Blog HTTP data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when our blog is accessed:

This includes IP address, type, and version of your internet browser, operating system used, site accessed, site accessed before visiting the site (referrer URL), and date and time of the visit.

Users of our blogs

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we will not be able to provide our blog.

The data is stored in server log files for a maximum period of seven days, unless a security-relevant event occurs (e.g. a DDoS attack).

If there is a security-relevant event, server log files are stored until the security-relevant event has been eliminated and completely resolved.

Blog subscription data

Data that we collect when you subscribe to our blog articles:

This includes the following mandatory information: email address.

This also includes the following optional information: name.

Users of our blogs

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the mandatory information is not provided, we cannot send you any information about new blog articles by email.

We store this data for as long as you are registered for the subscription.

In addition, we store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for two years from the time you unsubscribed and in the event of any legal disputes until the dispute has been concluded.

Blog opt-in data

Log data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons when subscribing to and unsubscribing from our blog articles:

This includes date and time of subscription, date and time when the registration notification is sent in the double opt-in procedure, date and time of the confirmation of the registration in the double opt-in procedure as well as the IP address of the device used for the confirmation, and date and time of any unsubscription.

Users of our blogs

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the mandatory information is not pro-vided, we cannot send you any information about new blog articles by email.

We store this data for as long as you are registered for the subscription.

In addition, we store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for two years from the time you unsubscribed and in the event of any legal disputes until the dispute has been concluded.

Ratings data

Data generated when you review a blog article:

This includes the number of stars you have awarded.

Users of our blogs

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, you will not be able to submit a rating.

We store this data permanently but only in anonymous form.

Comments data

Data that is generated when a comment is published on our blog:

This includes the following mandatory information: comments text.

This also includes the following optional information: name, email address, website.

Users of our blogs

Provision of the data is not a statutory or contractual requirement or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.

If the data is not provided, we will not be able to publish your comments or any additional optional information.

We store this data until it is no longer required, i.e. basically as long as the relevant blog post is online or until you ask us to delete it.

In addition, we store this data for evidence purposes for the assertion, exercise, or defense of any legal claims for two years from completion of the publication and in the event of any legal disputes until the dispute has been concluded.

Purpose of processing the personal data

Categories of personal data processed

Legal basis and, where applicable, legitimate interests

Recipients
(further details Section H)

Provision of the relevant blog for informational use:

For this purpose, HTTP data is temporarily processed on our web server.

Blog HTTP data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of the blog accessed by the user for informational use.

Website providers

Hosting providers

Provision of the form for subscribing to and unsubscribing from our blog articles and acceptance of subscriptions:

For this purpose, HTTP data is temporarily processed on our web server.

Blog HTTP data

Blog subscription data

Blog opt-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is provision of the form accessed by the user to subscribe to and unsubscribe from our blog articles.

Website providers

Hosting providers

Ensuring the security of the IT infrastructure used for our blog, in particular for the detection, elimination and conclusive documentation of incidents (e.g. DDoS attacks)

For this purpose, data is temporarily stored and evaluated in log files on our web server.

Blog HTTP data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is ensuring the security of the IT infrastructure used for provision of our blog, in particular for the detection, elimination, and conclusive documentation of incidents (e.g. DDoS attacks).

Website providers

Hosting providers

”Double opt-in” procedure to confirm the subscription:

For this purpose, we send an email message requesting confirmation to the email address provided during registration. A subscription only becomes effective when the subscriber confirms the email address by clicking on the confirmation link contained in the email.

Blog HTTP data

Blog subscription data

Blog opt-in data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the legally secure documentation of your consent to receipt of messages about new blog articles.

Website providers

Email providers

Sending email messages about new blog articles

Blog subscription data

Blog opt-in data

Consent (if the GDPR applies: Article6(1)(a) GDPR)

Website providers

Email providers

Receipt and publication of your ratings and/or comments:

We only publish ratings as an aggregated overall rating, i.e. without personal data about you.

We publish comments with the data you provide. You can also submit a comment without personal data or, for example only with your first name or under an alias.

Blog HTTP data

Ratings data

Comments data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is publication of the ratings and/or comments you have submitted for publication.

Website providers

Hosting providers

Storage and processing for evidence purposes for the possible assertion, exercise, or defense of legal claims

Blog subscription data

Blog opt-in data

Ratings data

Comments data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Website providers

Email providers

Assertion, exercise, or defense of legal claims, including cooperation with external lawyers

Blog subscription data

Blog opt-in data

Ratings data

Comments data

Pursuing legitimate interests under balancing of interests (if the GDPR applies: Article6(1)(f) GDPR):

Our legitimate interest is the assertion, exercise, or defense of legal claims.

Courts

Lawyers