Privacy Statement

We are pleased that you have visited our website and are interested in our company. We take the protection and security of the personal data you have entrusted to us seriously and want you to feel safe and comfortable while visiting our Internet sites and taking advantage of our offers.

It is important to us for you to know which personal data are collected when you take advantage of our offers and services and how we then use such data.

Reason for processing data

To the extent we process personal data, we do so for the purposes indicated in this privacy statement.

Processing of personal data

Visiting our website
We record and store the IP address assigned to your computer in order to transmit to your computer the contents that you have requested from our website (e.g., text, images and downloadable files, etc.) (see article 6(1)(b) of the General Data Protection Regulation/GDPR). In addition, we process such data to identify and prosecute improper use of our website pursuant to article 6(1)(f) GDPR. Our legitimate interest in data processing lies in ensuring the proper functioning of our website as well as transactions processed via the website.

To the extent we, as described above, process your data for the purpose of providing our website’s features, you have a contractual obligation to provide such data to us.

When you access our website, the following data are stored in a log file:

The log file is automatically deleted after 30 days.

Other purposes
Further, personal data are processed if you provide such data to us yourself, for example as part of an enquiry or a booking or when ordering informational material or a newsletter. The legal basis for this is article 6(1)(b) GDPR. Data processed by us include customer data, employee data and data from suppliers, provided such data are required for the purposes indicated in this privacy statement.

To the extent we, as described above, process your data for the purpose of receiving and processing your enquiry, booking or newsletter order, you have a contractual obligation to provide such data to us. Without such data, we will not be able to process your enquiry, booking or order.

If you have provided your consent for the processing of personal data (see article 6(1)(a) GDPR), you make revoke your consent at any time; this will not affect the legality of the processing carried out on the basis of such consent until it was revoked.

Disclosure to third parties
Where applicable, information may also be processed by other companies, but only to the extent required for the purposes indicated in this privacy statement or if the other company is operating in the capacity of a service provider/contract data processor that is bound by our instructions.

In some cases, we may use service providers (based in Germany) to process data on our behalf (e.g., support in handling customer enquiries). In the cases described here, the data are disclosed to these third-party companies to facilitate further processing. We carefully select and regularly review external service providers to ensure that your privacy is safeguarded.

The service providers/contract data processors are bound by our instructions and accordingly are obliged by us, among other things, to treat your data exclusively in accordance with our instructions and the applicable data protection laws, as updated from time to time. In particular, they are obliged to treat your data with strict confidentiality; they are also prohibited from processing your data for purposes other than those agreed.

The legal basis for disclosing data to contract data processors is article 28(1) GDPR.

We neither sell your data to third parties nor otherwise market your data.

In addition, your personal data will be disclosed to law enforcement authorities without your express consent and, if applicable, to injured third parties, if this is necessary to investigate any illegal use of our services or for prosecution. However, this shall occur only if there is concrete evidence of illegal and/or abusive conduct. Disclosure may also occur if it will help to enforce the terms of use or other agreements. Moreover, we are legally obliged to provide information to certain public authorities upon request. These include law enforcement authorities, agencies that prosecute administrative offences subject to fines and the tax authorities.

Such data are disclosed on the basis of our legitimate interest in fighting abuse, prosecuting criminal activities and securing, asserting and enforcing claims, unless your rights and interests in protecting your personal data prevail (article 6(1)(f) GDPR).

Planned transmission of data to third countries
There currently are no plans to transmit data to third countries; otherwise, the relevant legal preconditions will be satisfied. In particular, you will be notified of the respective recipients or categories of recipients, in accordance with legal requirements.

We employ technical and organisational measures to protect the data you provided from accidental or deliberate tampering, loss, destruction or access by unauthorised persons. This also applies if external services are used. Our security measures are audited for effectiveness and continually improved to reflect technological developments. When personal data are entered, they are always transmitted in encrypted form.

Website tracking
We do not use any tracking tools on our website.

Links to other providers’ websites

Our website may contain links to other providers’ websites. Please note that this privacy statement applies only to this website. We have no influence over and do not monitor whether other providers comply with the applicable data protection provisions.

Protection of minors

Children and persons under the age of 18 should not transmit any personal data to us without the consent of their parents or legal guardians. We do not request personal data from children, do not collect such data and do not disclose such data to third parties.

Standard periods for data deletion

Lawmakers have enacted various retention periods and obligations. When such periods expire, the relevant data are routinely deleted. To the extent these do not apply to the data, they are deleted or anonymised when the purposes specified in this privacy statement no longer apply. If this privacy statement contains no other data retention provisions to the contrary, we will retain the data collected by us for as long as they are needed for the aforementioned purposes for which such data were collected.

Other data uses and data deletion

Further processing or use of your personal data generally occur only if permitted by a legal provision or if you have given your consent for the processing or use of the data. If the data will be further processed for purposes other than those for which the data were originally collected, we will notify you of these other purposes before further processing your data and will provide additional relevant information to you.

Identifying and prosecuting improper use

We retain information for identifying and prosecuting improper use, in particular your IP address, for a maximum of 7 days. The legal basis for doing so is article 6(1)(f) GDPR. We have a legitimate interest in retaining data for 7 days to ensure the proper functioning of our website and the transactions processed via the website and to be able to protect against cyber-attacks and the like. Where applicable, we use anonymous information on usage to adapt the design of our website to meet users’ needs.

Rights relating to the processing of personal data

Right of access
You have the right, upon request, to receive information from us at any time about personal data processed by us relating to you within the scope specified in article 15 GDPR. To do so, you can submit an application by mail or via email to the addresses indicated below.

Right to correct inaccurate data
You have the right to request that we immediately correct any inaccurate personal data on you (article 16 GDPR). To do so, please contact the address listed below.

Right to deletion
You have a right to the immediate deletion of personal data concerning you (“Right to be forgotten”) if the legal grounds specified in article 17 GDPR apply. Such grounds exist, for example, if the personal data are no longer required for the purposes for which they were originally processed, or if you have revoked your consent and if there is no other legal basis for such processing, i.e., the data subject files an objection against processing (and there are no overriding grounds for processing – this does not apply to objections against direct marketing). In order to assert the aforementioned right, please contact the address indicated below.

Right to restriction of processing
You have a right to restrict processing if the preconditions stipulated in article 18 GDPR have been met. According to article 18 GDPR, the restriction of processing may be advisable if the processing is unlawful and the data subject rejects the deletion of personal data and instead requests that the use of the personal data be restricted or the data subject has filed an objection against processing pursuant to article 21(1) GDPR, as long as it is not yet clear whether our legitimate grounds will prevail over yours. In order to assert the aforementioned right, please contact the address indicated below.

Right to data portability
You have the right to data portability in accordance with article 20 GDPR, which stipulates that you are entitled to receive personal data relating to you, which you provided to us, in a standard, structured and machine-readable format and to transfer such data to another data controller, such as another service provider. The precondition for this is that the processing is based on consent or on an agreement and is done using automated processes. In order to assert the aforementioned right, please contact the address indicated below.

Right to object
Pursuant to article 21 GDPR, you have the right on grounds relating to your particular situation to file an objection at any time to processing of personal data relating to you carried out pursuant to article 6(1)(e) or (f) GDPR. We will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or that the processing is necessary to assert, exercise or defend legal claims. In order to assert the aforementioned right, please contact the address indicated below.

Right to complain to a regulatory authority
If you believe that our processing of your personal data is impermissible, you have the right to complain to the regulatory authority with jurisdiction over us, which you can contact at:

Der Hessische Datenschutzbeauftragte
Postfach 31 63
65021 Wiesbaden
Phone: +49 611 1408-0

Contact data for the data controller:
GfBB prüftechnik GmbH & Co. KG
Liebigstraße 16
65439 Flörsheim am Main
Phone: +49 (0)2171 / 3427 – 71
Telefax: +49 (0)2171 / 3427 – 87

Amendments to this privacy statement

Further development of the Internet and our website may also affect our privacy statement. We reserve the right to modify this privacy statement in future. If we use your personal information in a manner other than that indicated at the time of collection, as stated here, we will attempt to notify you via email using the most recent information available to us. If we are not able to notify you, we will not use your personal information in a new way. In any case, a message to that effect will be made available on the websites in the form of a highlighted announcement.

August 2018