Privacy policy

Data Privacy Notice

A. Scope of the Data Privacy Notice

B. Name and contact details of the controller

C. Contact details of the data protection officer

D. Purpose of processing

I. General processing purposes

II. Particular processing purposes in connection with making contact and the application process

1. Processing for the purpose of making contact electronically

2. Processing for application purposes

a) General details for processing application documentation

b) No disclosure of applicants’ data to third parties

c) Application terms

d) Retention and erasure of applicants’ data

III. Particular processing purposes in connection with our online services

1. Processing for service purposes (HubSpot)

2. Processing for security purposes

3. Processing for purpose of measuring scope (Cookies)

a) What are cookies?

b) How can I prevent the use of cookies?

4. Processing for analysis purposes (Google Analytics)

a) What is the purpose of using Google Analytics?

b) How can I prevent the use of Google Analytics?

5. Processing for the purposes of personalised advertising (Google-Re/Marketing Services)

a) What is the purpose of using Google Marketing Services?

b) How can I prevent the use of Google re/marketing services?

6. Processing for the purpose of various social media applications

7. Further services and third-party content

E. Legal basis for processing

F. Legitimate interests

G. Recipients of personal data and transmission in a third country or an international organisation

H. Retention period

I. Your rights based on processing

I. Right of access

II. Right to rectification

III. The right of erasure and restriction of processing

IV. Right to object

J. Right to object where there is consent

K. Right of complaint with a supervisory authority

L. Changes to the Data Privacy Notice

In the following, you will learn how Süddeutsche Gelenkscheibenfabrik GmbH & Co. KG processes your personal data. The Data Privacy Notice also contains spe-cial information for applicants, as well as general information that applies to both applicants and other visitors to our online offer.

A. Scope of the Data Privacy Notice

This Data Privacy Notice informs you about the nature, scope and purpose for which your personal data is processed by Süddeutsche Gelenkscheibenfabrik GmbH & Co KG. The information in this Data Privacy Notice applies to all processing operations associated with your personal data employed by Süddeutsche Gelenkscheibenfabrik GmbH & Co KG. Both the processing of your personal data for general purposes and special processing situations, such as the application process or the use of our online offer and the websites, functions and contents associated with it (hereinafter referred to jointly as “online offer” or “website”) are included. The Data Privacy Notice applies, irrespective of the domains, sys-tems, platforms and devices used (e.g. desktop or mobiles) on which the online offer is executed. The term “user” employed hereinafter encompasses both appli-cants and other website visitors. All terminology employed, such as “applicants” is to be understood as gender neutral.

B. Name and contact details of the controller

Süddeutsche Gelenkscheibenfabrik GmbH & Co. KG Graslitzer Str. 14, 84478 Waldkraiburg (hereinafter referred to as “we” or “us”) is the controller for pro-cessing your personal data and provider of the online offer. Please refer to the legal disclaimer https://www.sgf.de/de/sgf-sueddeutsche-gelenkscheibenfabrik/kontakt/impressum.html for details about the legal repre-sentative and further contact options
E-Mail: Kontakt@sgf.com

C. Contact details of the data protection officer

Our data protection officer will support you with all matters relating to data pro-tection. You can contact our data protection officer at any time. Please use the following email address: Datenschutz@sgf.de

D. Purpose of processing

We would like to provide information in the following about the purposes for which personal data is processed. We basically process personal data of users only as far as is necessary. Alongside processing for general purposes, i.e. for example, for processing contracts (see I. for details), special purposes when you make contact and as part of the application process are to be taken in account (see II. for details). We would like to inform you under III. about the particular purposes for which data is processed in connection with our online offers.

I. General processing purposes

We process users’ personal data, insofar as this is necessary, to be able to ensure comprehensive customer support. Furthermore, we process personal data to set up and handle special contractual relationships between us and the user. In these cases, the specific purpose for processing arises from the respective performance relationship between us and the user. Processing on the basis of justified interests is only considered in the cases, in which our interests worthy of protection predominate. In specific cases, pro-cessing users’ personal data may be required for reasons of administration or even to protect our publicly accessible spaces, for example, by means of video surveillance. In addition, we process users’ personal data in order to properly meet our statu-tory obligations. These may arise due to the statutory requirements for keeping books of accounts, for example. In particular, we process the following personal data in this connection:

» General contact information, such as the user’s master and contact data

» Information that is required for processing contracts

» Information that is required in connection with issuing invoices and the ul-timate payment process.

II. Particular processing purposes in connection with making contact and the application process

1. Processing for the purpose of making contact electronically

When you make contact with us (using the contact form or by email), the user’s details are processed for the purposes of processing the contact enquiry and handling the same. The users’ details can be saved in our Customer Relationship Management System (“CRM system”) or comparable enquiry organisation and must be retained for 6 years for business correspondence due to statutory re-quirements, and for 10 years if of statutory relevance under tax law.

2. Processing for application purposes

a) General details for processing application documentation

We only process applicants’ data for the purpose of and as part of the application process in accordance with the statutory requirements. Applicants’ data is pro-cessed to meet our contractual obligations and based on our legitimate interests and also the interests of applicants in the implementation of a fast and effective application process. The application process requires that applicants communi-cate the applicants’ data to us. The applicants’ details required are marked as such in our online form. These include details about the person, postal and con-tact addresses and the documents associated with the application, such as cover-ing letter, CV and certificates. Applicants are also free to provide us with addition-al information. When they transmit the application to us, the applicants declare that they agree to their data being processed for the purpose of the application process in accordance with the nature and scope set out in this Data Privacy No-tice.

b) No disclosure of applicants’ data to third parties

We never disclose applicants’ data to third parties. We may, however, be sup-ported by external service providers or other organisations as part of the appli-cation process. The service providers may also process data belonging to the ap-plicants during this process. The service providers process the applicants’ data only on our behalf and on the basis of contractual obligations, which stipulate adherence to the agreed organisational and technical measures, in particular. The applicants’ data may furthermore be disclosed, if a position has been explicitly advertised by several organisations within our group, i.e. there is more than one organisation involved in the application process. In all other cases, we will ask the applicants’ permission before we disclose their data.

c) Application terms

Applicants are able to send their applications to us using the contact form on our website. The data is sent to us encrypted using state-of-the-art technology. Alter-natively, applicants may send their applications by email. We would, however, urge you to consider that emails cannot be sent encrypted. We are therefore un-able to accept any responsibility for the transmission route for applications be-tween the sender and receipt on our server and therefore recommend that you use the online form. Instead of an application using the online form and email, the applicants continue to have the option of sending the application to us by post.

d) Retention and erasure of applicants’ data

We may process the data the applicants provide further for the purpose of the employment contract in the event that the application is successful. Otherwise, the applicants’ data will be erased if the application for the position is unsuccessful. The applicants’ data is also erased if an application is withdrawn, to which the applicants are entitled at any time. Erasure is takes place, subject to a legitimate withdrawal by the applicants, at the end of a period of six months, so that we may respond to any subsequent questions about the application and we are able to satisfy our obligations to provide supporting documentation based on the Gen-eral Equality of Treatment Act (AGG).

III. Particular processing purposes in connection with our online services

In the following, we would like to inform you about processing our personal data in connection with our online offer. The use of our online offer is generally linked to processing your personal data, such as your IP address or details about the duration and date of your access. We would like to inform you in detail about the following online-specific processing operations:

1. Processing for service purposes (HubSpot)

Our registration service enables users of our website to learn more about our company, download content and provide their contact information and further demographic information. This information is stored on our software partner’s servers. We are able to use it, to contact visitors to our website and to determine which services of our company are of interest to them. All of the information we record is subject to this data privacy requirement. You will find further information about this on the following HubSpot page: https://legal.hubspot.com/privacy-policy. We use all the information recorded solely to optimise our marketing. HubSpot is a software company in the US with a subsidiary in Ireland. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Tel.: +353 1 5187500, https://www.hubspot.de. HubSpot is subject to the TRUSTe ’s Privacy Seal.

2. Processing for security purposes

We collect data about any access to our server on which this service is located (‘server logfiles’) based on our legitimate interests. About access data:

» Name of the website accessed

» File, date and time of the access

» Data volume transmitted

» Report about successful access

» Browser type alongside version, the user’s operating system, referrer URL (the previously visited website)

» IP address and the enquiring provider

Logfile information is stored for security reasons (e.g. to clarify misuse or fraudulent acts) for a maximum period of seven days and then erased. Data, the retention of which is required for the purpose of evidence, is excluded from erasure until the particular matter is finally clarified.

3. Processing for purpose of measuring scope (Cookies)

a) What are cookies?

Cookies are information and are transferred by our webserver or webserver’s third parties to the users’ web browser and saved there to be accessed later. Cookies can be tiny files or other forms of information storage.

b) How can I prevent the use of cookies?

If users do not want cookies to be stored on their computer, they are asked to disable the corresponding option in their browsers’ system settings. Cached cook-ies may be erased in the browser’s system settings. Preventing cookies can result in restricting the functions of this online offer. You can object to the use of cookies that serve to measure reach and advertising purposes using the deactivation page of the network advertising initiative (http://optout.networkadvertising.org/) and also the US website (http://www.aboutads.info/choices) of the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

4. Processing for analysis purposes (Google Analytics)

We use Google Analytics, a web analysis service of Google Inc. (“Google”) on the basis of our legitimate interests. Google uses cookies. Information generated by the cookie about your use of the online offer is generally transmitted to a Google server in the United States and stored there. Google is certified under the Privacy Shield Agreement and therefore offers a guarantee of compliance with European data privacy legislation. You can view further information at the following address: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

a) What is the purpose of using Google Analytics?

Google will process the information generated about the user on our behalf to analyse use of our online offer by the users, in order to compile reports about the activities within our online offer and to provide further services associated with use of this online offer and Internet usage for us. In so doing, pseudonymised us-er profiles of the users can be generated from the processed data. We only use Google Analytics with activated IP anonymisation. This means the IP address of the users is truncated by Google within member states of the European Union or in other states which are party to the Agreement on the European Economic Area. Only in exceptional cases is a full IP address transmitted to a Google server in the United States and truncated there. The IP address transmitted by the user’s browser is not combined with any other Google data.

b) How can I prevent the use of Google Analytics?

The users are able to prevent the storage of cookies by means of a corresponding setting in their browser software; the users are also able to prevent the recording of the data relating to their usage of the online offer generated by the cookie and processing of this data by Google by downloading and installing the browser plugin available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de. You will find further information about Google’s data usage, possibilities for stopping or objecting to processing on Google’s website: https://www.google.com/intl/de/policies/privacy/partners (“Data usage by Google during your usage of our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Data usage for advertising purposes"), http://www.google.de/settings/ads (“Manage information that Google uses to display advertising to you").

5. Processing for the purposes of personalised advertising (Google-Re/Marketing Services)

We use the marketing and remarketing services (“Google Marketing Services” for short) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”) on the basis of our legitimate interests.

a) What is the purpose of using Google Marketing Services?

Google Marketing Services enable us to display advertisements for and on our website more effectively in order only to present advertisements to users that potentially meet their interests. For example, if a user is shown advertisements for products for which they have shown an interest on other websites, we talk here about “remarketing”. For these purposes, a Google code is exported directly by Google when our or other websites are accessed on which Google Marketing Services is enabled and (re)marketing tags (invisible graphics or code, also re-ferred to as “web beacons”) are integrated into the website. An individual cookie, i.e. a tiny file, is cached on the users’ device with their help. (Other comparable technologies can also be used instead of cookies). The cookies can be set from a variety of domains, including google.com, doubleclick.net, invitemedia.com, ad-meld.com, googlesyndication.com or googleadservices.com. A note is made in this file which of the users’ websites have been searched, in what content they have shown an interest and what offers they have clicked, further technical information about the browser and operating system, linked websites, length of the visit, and other details about use of the online offer. The users’ IP address is also recorded, although we do give notice within the scope of Google Analytics that the IP ad-dress is truncated within member states of the European Union or in other states party to the Agreement on the European Economic Area and only transmitted in full to a server at Google in the USA and truncated there in exceptional circum-stances. The IP address shall not be combined with the user’s data within other Google offers. Google may combine the aforesaid information also with such in-formation from other sources. If the user subsequently visits other websites, they may be displayed advertisements tailored to them based on their interests. The users’ data is processed pseudonymised with the scope of Google Marketing Ser-vices. This means that Googles does not save and process the name or email ad-dress of the users but processes the relevant data cookie-related within pseudon-ymised user profiles. This means that from Google’s perspective, the advertise-ments are not administered and displayed for a specifically identified person but for the owner of the cookie, regardless of who this cookie owner is. This does not apply if a user has explicitly permitted Google to process the data without this pseudonymisation. The information gathered by Google Marketing Services about the users is transmitted to Google and stored on Google’s servers in the USA. The Google Marketing Services used by us include the online advertising program “Google AdWords”. In the case of Google AdWords, each AdWord customer re-ceives a different “conversion cookie”. Cookies can therefore not be tracked using the websites AdWords customers. The information collected with the help of cookies serves to generate conversion statistics for AdWords customers who have opted for conversion tracking. The AdWords customers learn about the to-tal number of users who have clicked their advertisement and who were for-warded to a page provided with a conversion tracking tag. However, they are not given any information that can be used to identify users personally. We are able to integrate third parties’ advertisements because of the Google Marketing Ser-vice “DoubleClick”. DoubleClick uses cookies, with which Google and its partner websites enable the placement of advertisements based on visits by users on this website and other websites on the Internet. Furthermore, we are able to use “Google Tag Manager” in order to integrate and manage the Google analysis and marketing services into our website. You will find further information about data usage on marketing purposes by Google on the overview screen: https://www.google.com/policies/technologies/ads, Google’s Data Privacy Notice can be accessed at https://www.google.com/policies/privacy.

b) How can I prevent the use of Google re/marketing services?

If you would like to object to the interest-related advertising by Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences.

6. Processing for the purpose of various social media applications

The links/buttons to social media networks and platforms used within our online offer (hereinafter referred to as “social media”) only create a contact between social networks and the users when users click the links/buttons and the respec-tive networks or their websites are accessed. This function equates to the mecha-nism of a standard online link. The following presentation offers an overview of the linked social media provid-ers, alongside links to their data privacy notices which contain further infor-mation about processing of data and, already mentioned here in part, options for raising an objection (‘opt-out’):

» facebook.com Facebook Ireland Ltd. 4 Grand Canal Square Grand Canal Harbour Dublin 2, Ireland Data Privacy Notice: de-de.facebook.com/policy.php, Opt-Out: www.facebook.com/settings.

» YouTube/ Google Inc. 1600 Amphitheatre Parkway Mountain View CA 94043, USA Data Privacy Notice: https://www.google.com/policies/privacy/, Opt-Out: https://www.google.com/settings/ads/.

» Twitter Inc. 795 Folsom St., Suite 600 San Francisco CA 94107, USA Data Privacy Notice: http://twitter.com/privacy.

» kununu GmbH Neutorgasse 4-8, Top 3.02 1010 Vienna Austria Operator of the kununu website and controller as defined by data protection legislation: https://www.xing.com/privacy.

» XING AG Dammtorstrasse 29-32 20354 Kraiburg Germany Data Privacy Notice: https://www.xing.com/privacy.

» LinkedIN Ireland 70 Sir John Rogerson’s Quay, Dublin 2, Ireland Data Privacy Notice: https://www.linkedin.com/legal/privacy-policy.

7. Further services and third-party content

Within our online offer we employ content or service offers from third-party providers based on our legitimate interests (i.e. interest in the analysis, optimisa-tion and economic operation of our online offer, as defined by Art. 6 (1) f) GDPR, in order to integrate their content and services, such as videos and fonts (herein-after referred to collectively as “contents”). That always depends on third-party providers of this content using the users’ IP address, as they could not send the content to their browsers without the IP address. The IP address is therefore re-quired in order to display this content. We make every effort only to use such content whose respective providers use the IP address to deliver content. Third-party providers are able to use ‘pixel tags’ (invisible graphics, also referred to as “web beacons”) for statistical and marketing purposes. The visitor traffic on the pages of this website can be analysed with the help of “pixel tags”. Furthermore, the pseudonymised information can be saved in cookies on the users’ device and include technical information about the browser and operating system, linked websites, length of the visit and further details on how to use our online offer and also combined with such information from other sources. The following presentation offers an overview of third-party providers, along-side links to their data privacy notices, which contain further information about the processing of data and, already mentioned in part here, options for raising an objection (‘opt-out’):

» Maps of the “Google Maps” service Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA Data Privacy Notice: https://www.google.com/policies/privacy/, Opt-Out: https://www.google.com/settings/ads/.

» Videos on the platform “YouTube” Google Inc. 1600 Amphitheatre Parkway Mountain View, CA 94043, USA Data Privacy Notice: https://www.google.com/policies/privacy/ Opt-Out: https://www.google.com/settings/ads/.

Information about Google Inc.: Google is certified under the Privacy Shield Agreement and therefore offers a guarantee of compliance with European data privacy legislation. You can view further information at the following address: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

E. Legal basis for processing

We only process users’ personal data in compliance with the relevant data priva-cy requirements. That means the users’ data is only processed if there is legal consent. That means, in particular, if data processing is necessary to provide our contractual services (e.g. process orders) and online services or required under the law, the users have given their consent, and because of our legitimate inter-ests. With respect to processing personal data based on the General Data Protection Regulation (GDPR), we point out that the legal basis of consent is Art. 6 (1) a and Art. 7 GDPR, the legal basis for processing to provide our services and implement contractual measures is Art. 6 (1) b GDPR, the legal basis for processing to meet our legal obligations Art. (1) c GDPR, and the legal basis for processing to assume our legitimate interests is Art. 6 (1) f GDPR. We would additionally also like to refer to the legal basis of Art. 26 (1) of the German Federal Data Protection Act (BDSG) for the purposes of processing appli-cants’ data.

F. Legitimate interests

We process users’ personal data, in part, on the basis of legitimate interests. Data is only processed on the basis of legitimate interests, if this is necessary and our interests predominate in the individual case. If we support processing on this le-gal basis, our interest in processing relates particularly to the guarantee of securi-ty of the places of work, the functionality of the internal administration and, espe-cially, on the analysis and optimisation and on the economic operation and securi-ty of our online offer, as defined by Art. 6 (1) f GDPR. To do this, processing the user’s personal data is necessary to measure reach, generate profiles for adver-tising and marketing purposes and to collect access data and use of the services of third-party providers.

G. Recipients of personal data and transmission in a third country or an international organisation

Data is only disclosed to third parties as part of the statutory requirements. We only disclose users’ data to third parties if this is required, for example, for invoic-ing purposes or for other purposes, if these are required in order to meet our contractual obligations to users. If we employ subcontractors to provide our ser-vices, we take suitable legal precautions and appropriate technical and organisa-tional measures to guarantee the protection of personal data in accordance with the relevant statutory regulations. If content, tools or other means are used by other providers within the scope of this Data Privacy Notice (hereinafter referred to collectively as “third-party providers”) and their given registered office is in a third country, it is to be assumed that data will be transferred to the countries in which the third-party provider is located. By third countries, we mean countries, in which the GDPR is not directly enforceable under the law, i.e. principally coun-tries outside the EU or the European Economic Area. Data is transferred to third countries, either when there is a reasonable level of data protection, consent from users or other statutory permission.

H. Retention period

The data saved at our company is erased if it is no longer required for its intend-ed purpose and there are no statutory retention obligations that stand in the way of the erasure. If the users’ data is not erased because it is required for other le-gally permitted purposes, its processing will be restricted. This means that data will be blocked and not processed for other purposes. This applies, for example, to users’ data which has to be retained for commercial or tax reasons. Based on statutory requirements, the retention is for 6 years pursuant to Art. 257 (1) Ger-man Commercial Code [HGB] (books of account, inventories, opening balances, annual statements, commercial letters, accounting records etc.) and for 10 years pursuant to section 147 (1) German Fiscal Code (AO) (books, records, manage-ment reports, accounting records, commercial letters, documents relevant to taxa-tion etc.).

I. Your rights based on processing

When personal data is processed, you have the following aforesaid rights pursu-ant to Art. 15 ff GDPR:

I. Right of access

You are able to demand information if we process personal data concerning you. If this is the case, you have the right to information about this personal data and to further information associated with processing (Art. 15 GDPR). Please bear in mind that this right of access may be restricted or excluded in certain cases.

II. Right to rectification

In the event that personal data concerning you is (no longer) accurate or com-plete, you can demand rectification and, if necessary, completion of this data (Art. 16 GDPR).

III. The right of erasure and restriction of processing

Provided the legal conditions are met, you may demand the erasure of your per-sonal data (Art. 17 GDPR) or the restriction of processing of this data (Art. 18 GDPR). However, there is no right of erasure pursuant to Art. 17 (1) and (2) GDPR, if processing of personal data is necessary to carry out a task that is in the public interest or to exercise official authority (Art. 17 (3) b GDPR).

IV. Right to object

For reasons connected with your particular situation, you can object to our pro-cessing personal data concerning you at any time (Art. 21 GDPR). Provided the legal conditions are met, we will no longer process your personal data as a result.

J. Right to object where there is consent

You have the right to withdraw your consent at any time. The objection only has an effect for the future. This means that the lawfulness of the processing that took place on grounds of consent until the objection will not be affected.

K. Right of complaint with a supervisory authority

Sie haben das Recht, sich bei einer Aufsichtsbehörde im Sinn des Art. 51 DS-GVO über die Verarbeitung Ihrer personenbezogenen Daten zu beschweren. Die zuständige Aufsichtsbehörde können Sie wie folgt kontaktieren: SGF Waldkraiburg Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 27 91522 Ansbach Telefon: +49 (0) 981 53 1300 Telefax: +49 (0) 981 53 98 1300 E-Mail: poststelle@lda.bayern.de Zudem stellt das Landesamt ein elektronisches Beschwerdeformular zur Verfügung, welches Sie unter der nachfolgenden Adresse abrufen können: https://www.lda.bayern.de/de/beschwerde.html SGF Waltershausen Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit Postfach 900455 99107 Erfurt Telefon: +49 (361) 57-3112900 Telefax: +49 (361) 57-3112904 E-Mail: poststelle@datenschutz.thueringen.de

L. Changes to the Data Privacy Notice

We reserve the right to make changes to the Data Privacy Notice to take account of changes in the legal environment or changes to the services and to data pro-cessing. This only applies to declarations about data processing, however. If con-sents are required from the users or elements of the Data Privacy Notice contain regulations of the contractual relationship with the users, the changes will only be made with the users’ consent. The users are urged to familiarise themselves with the contents of the Data Privacy Notice.