Privacy policy and mandatory data protection information

The entity responsible for processing personal data is:

DATAflor AG
August-Spindler-Strasse 20
37079 Göttingen

Telephone: + 49 (551) 50665-0
Fax: +49 (551) 50665-59
Email: info@dataflor.de

Represented by the board of directors:
Christoph Honig and Matthias Gehrke

With this privacy information, we inform you in accordance with Articles 12 to 14 of the GDPR about how we process personal data and what rights you have.

If you have any questions about data protection, please contact our data protection officer:

Mr. Thomas Werning
werning.com GmbH
Dieselstraße 12
32791 Lage

Phone: +49 5232 980-4700
Email: teamdatenschutz@werning.com

Personal data is any information that can directly or indirectly identify a natural person. This includes, for example, names, contact details, contract and payment data, communication content, and usage and connection data.

We process personal data in particular on the following legal bases:

• Article 6 paragraph 1 letter a GDPR in the case of consent,
• Article 6(1)(b) GDPR for the performance of a contract or pre-contractual measures,
• Article 6(1)(c) GDPR for the fulfillment of legal obligations,
• Article 6 paragraph 1 letter f GDPR for the purposes of legitimate interests.

Our legitimate interests lie in particular in the secure operation of our website, the processing of inquiries, the organization of business relationships, direct marketing to the extent permitted by law, and the safeguarding and enforcement of legal claims.

Insofar as information is stored on or read from your device, the provisions of Section 25 TDDDG also apply.

We usually receive personal data directly from you, for example when you make an inquiry, place an order, register, apply for a job or in the context of a business relationship.

Where permitted, we may also obtain data from your employer, business partners, affiliated companies, public registers or other publicly available sources.

Within the DATAflor AG only grants access to your data to those departments that need it to fulfill their tasks.

Furthermore, the following recipients in particular may receive data:

• Hosting and IT service providers,
• Providers of software, cloud and communication services,
• Tax advisors, auditors and lawyers,
• Banks and payment service providers
• Logistics, shipping and printing service providers,
• Event and training service provider,
• Authorities and public bodies when there is a legal obligation.

Data processors are contractually obligated in accordance with Art. 28 GDPR and process data only according to our instructions.

For some service providers, processing in countries outside the European Union or the European Economic Area cannot be ruled out.

Data will only be transferred if the conditions of Articles 44 et seq. GDPR are met, for example, due to:

• an adequacy decision by the European Commission,
• a valid certification under the EU-US Data Privacy Framework,
• standard contractual clauses of the European Commission,
• other suitable guarantees.

Further information on the guarantees used can be requested from our data protection officer.

We only store personal data for as long as is necessary for the respective purpose.

Furthermore, statutory retention periods apply. These are, in particular, six, eight, or ten years, depending on the type of document. Data may also be stored until the expiry of statutory limitation periods if this is necessary for the establishment, exercise, or defense of legal claims.

Once the purpose for processing the data has ceased to exist and the relevant deadlines have expired, the data will be deleted or anonymized.

Our website is hosted by:

Mittwald CM Service GmbH & Co. KG
Königsberger Straße 4–6
32339 Espelkamp

When you visit our website, technically necessary information is processed. This includes, in particular:

• IP address,
• Date and time of access,
• accessed page or file,
• Referrer URL,
• browser and operating system,
• Hostname of the accessing device,
• HTTP status code.

The processing serves to provide, ensure the stability and security of the website, as well as to detect technical errors and abusive access.

The legal basis is Article 6(1)(f) GDPR. A data processing agreement exists with Mittwald.

Server log data is deleted after the technically and security-related retention period has expired. In the event of a specific security incident, it may be stored until the matter is fully resolved.

Server log file retention period: 60 days

Our website is based on the content management system TYPO3.

TYPO3 may use technically necessary cookies or similar technologies, for example to manage sessions, security features or page settings.

The use of technically necessary technologies is based on Section 25 Paragraph 2 of the German Telemedia Act (TDDDG). The associated data processing is based on Article 6 Paragraph 1 Letter f of the GDPR.

We use technically necessary cookies and similar technologies that require consent.

Technically necessary technologies are used to provide the website and its functions. They are used on the basis of Section 25 Paragraph 2 of the German Telemedia Act (TDDDG).

Analytics and third-party services are only activated if you have given your prior consent. The legal basis for this is Section 25 Paragraph 1 of the German Telemedia Act (TDDDG) and Article 6 Paragraph 1 Letter a of the GDPR.

In particular, we store the following data via our consent management system:

• Your consent decision,
• Date and time of the decision,
• a pseudonymous identifier,
• the version of the displayed settings.

This data is stored to record and document your decision. You can change or withdraw your selection at any time via the cookie settings.

Designated Consent Manager: Stefan Galinski Internet Services

When you contact us via a form, email or telephone, we process your information to handle your request.

Depending on the form, the following data may be collected in particular:

• Companies,
• Name,
• Address,
• telephone number,
• E-mail address,
• industry,
• Customer number,
• selected product or theme,
• Content of the request.

Required fields are marked accordingly. Without this information, we may not be able to process your request.

For contractual or pre-contractual inquiries, processing is based on Article 6(1)(b) GDPR. General inquiries are processed on the basis of Article 6(1)(f) GDPR.

The data will be deleted once the request is completed and there are no legal obligations to retain it or legitimate interests in further storage.

The information from contact forms is not automatically used for sending newsletters.

We use YouTube to display videos and Google Maps to display locations and directions.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The content will only be loaded if you have consented to it or have explicitly activated the respective content.

In this process, your IP address, browser and device information, the page you visited, and information about your interaction with the content may be transmitted to Google. If you are logged into a Google account, Google can associate this usage with your account.

The processing is based on Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TDDDG.

Processing in the USA cannot be ruled out. The guarantees mentioned in the section on Google Analytics apply.

You can withdraw your consent at any time via the cookie settings.

Our website uses an encrypted HTTPS connection. This protects data from unauthorized access by third parties during transmission.

Our newsletter keeps you informed about Dataflor, our products and services, events, training courses and specialist topics.

We use the following for shipping:

CleverReach GmbH & Co. KG
Schafjückenweg 2
26180 Rastede
Germany

Registration uses a double opt-in process. After registering, you will receive an email in which you must confirm your registration.

To verify registration, we store in particular:

• Your email address,
• Registration and confirmation time,
• the IP address used,
• Content and version of the consent.

The legal basis for sending you this information is your consent pursuant to Art. 6 para. 1 letter a GDPR in conjunction with Section 7 para. 2 of the German Unfair Competition Act (UWG). If the requirements of Section 7 para. 3 UWG are met, we may inform existing customers about our own similar products and services.

The registration process is logged on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in documenting consent and protecting against the misuse of third-party email addresses.

We have a data processing agreement with CleverReach.

measuring success

Our newsletters may contain technologies that track opens and clicked links.

Personalized performance measurement is only carried out with your explicit consent. The legal basis for this is Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Consent to performance tracking is voluntary and not a requirement for receiving the newsletter. Without this consent, you will receive the newsletter without personalized open and click tracking.

You can withdraw your consent at any time via the unsubscribe link in the newsletter. After unsubscribing, we may store your email address on a suppression list to prevent further mailings and to be able to prove your previous consent.

We process data from customers and prospective customers, in particular for the purpose of:

• Processing of requests,
• Preparation of offers,
• Execution of contracts,
• Provision of our products and services,
• Billing and payment processing,
• Customer care and support,
• Conducting events and training courses,
• Legally permissible direct marketing.

We process data from suppliers and service providers, in particular for the initiation, execution and management of the respective business relationship.

The legal basis is in particular Article 6 paragraph 1 letters b, c and f GDPR.

Postal direct marketing and the maintenance of existing business contacts can be carried out on the basis of Article 6(1)(f) GDPR. Advertising by email is generally only carried out with consent or under the conditions of Section 7(3) of the German Unfair Competition Act (UWG).

You can object to the processing of your data for direct marketing at any time:

Email: info@dataflor.de
Telephone: + 49 (551) 50665-0

When processing an application, we particularly process the following:

• Contact details,
• Cover letter and CV,
• Qualifications and professional career,
• Certificates and evidence,
• further information voluntarily submitted.

The processing is carried out for the purpose of carrying out the application and selection procedure on the basis of Section 26 Paragraph 1 BDSG in conjunction with Article 6 Paragraph 1 Letter b GDPR.

Access is restricted to individuals involved in the selection process. Information will only be shared with other companies with your consent or on another legal basis.

After a rejection, the data is generally deleted six months after the conclusion of the application process, unless longer storage is required for defense against legal claims.

We obtain separate consent for inclusion in an applicant pool.

Please send unsolicited applications to:

bewerbung@dataflor.de

Separate data protection information applies to employees.

We process personal data of shareholders and shareholder representatives in order to prepare and conduct the Annual General Meeting and to enable the exercise of shareholder rights.

The legal basis is Article 6 paragraph 1 letter c GDPR in conjunction with the provisions of company law.

Where provided for by law, data in the list of participants may be made available to other shareholders and shareholder representatives.

The data will be stored in accordance with the statutory retention periods and then deleted.

We maintain company profiles on Instagram, Facebook and LinkedIn.

These online presences serve to communicate with customers, prospects, applicants and other users, as well as to provide information about Dataflor, our products, events and job offers.

When you access a website, the respective platform provider processes personal data. These providers can create user profiles and use data for analysis, market research, and advertising purposes. This processing may take place outside the European Union or the European Economic Area.

When you communicate with us via a platform, we process your message based on Art. 6 para. 1 letter b or f GDPR, depending on its content.

Further information on data processing and your settings and objection options can be found in the privacy policies of the respective platform providers.

The social media links on our website are embedded as external links. A connection to the respective provider is only established when you click on the link.

Provided the legal requirements are met, you have the right to:

• Information pursuant to Article 15 GDPR,
• Correction pursuant to Article 16 GDPR,
• Erasure pursuant to Article 17 GDPR,
• Restriction of processing pursuant to Article 18 GDPR,
• Data portability pursuant to Art. 20 GDPR,
• Objection pursuant to Article 21 GDPR,
• Revocation of consent with effect for the future.

To exercise your rights, please contact:

info@dataflor.de

Insofar as we process data on the basis of legitimate interests, you may object for reasons arising from your particular situation.

You can object to the processing of your data for direct marketing purposes at any time without giving reasons.

You have the right to lodge a complaint with a data protection supervisory authority.

The authority responsible for us is:

The State Commissioner for Data Protection of Lower Saxony

You can also contact the data protection supervisory authority in your place of residence, your workplace or the place of the alleged violation.

The provision of personal data may be required by law or contract, or may be necessary for the conclusion or performance of a contract.

Without the necessary information, we may not be able to process a request, create an offer, or execute a contract.

Purely automated decision-making, including profiling as defined in Article 22 GDPR, does not generally take place.

We will update this privacy information if our processing activities, the services we use, or legal requirements change.