Privacy Policy

Legal notice: Only the German language version of this privacy policy is legally binding. Translations into other languages are provided for information purposes only.

Introduction

This privacy policy explains what categories of personal data we process, for what purposes and to what extent. It applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, mobile applications and external online presences (e.g. social media profiles).

Status: 7 October 2019

Table of contents

• Introduction
• Controller
• Overview of processing activities
• Contact data protection officer
• Legal bases
• Security measures
• Transfer and disclosure of personal data
• Data processing in third countries
• Use of cookies
• Commercial and business services
• Credit check
• Contact
• Communication via messenger
• Online conferences, meetings and webinars
• Provision of online services and web hosting
• Job applications
• Cloud services
• Marketing communication by post, fax or telephone
• Online marketing
• Social media presences
• Plugins and embedded functions/content
• Deletion of data
• Changes to this privacy policy
• Rights of data subjects
• Definitions

Controller

Otto H. Meyer GmbH & Co. KG
Steller Str. 34
27755 Delmenhorst

Authorized representatives: Axel Gieseke, Dr. Hanno Benhof, Sandra Benhof, Thorsten Sander

Email: info@ohm-rohre.de
Imprint: www.ohm-rohre.de/impressum

Contact data protection officer

datenschutz@ohm-rohre.de

Overview of processing activities

Categories of processed data

• Inventory data (e.g. names, addresses)
• Applicant data
• Content data (e.g. text, photos, videos)
• Contact data (e.g. email, phone)
• Meta/communication data (e.g. device information, IP addresses)
• Usage data (e.g. visited pages, interests, access times)
• Contract data
• Payment data

Categories of data subjects

• Employees and former employees
• Applicants
• Business and contractual partners
• Prospective customers
• Communication partners
• Customers
• Users

Processing purposes

• Creditworthiness assessment
• Provision of our online services and usability
• Conversion tracking and analytics
• Application procedures
• Office and organizational processes
• Direct marketing
• Interest-based and behavioral marketing
• Contact handling and communication
• Security measures
• Contractual services and support
• Administration and answering requests

Automated individual decisions

• Credit information and scoring decisions where applicable

Legal bases

Processing is based in particular on the following legal bases under the GDPR:

• Consent (Art. 6(1)(a) GDPR)
• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)
• Special categories of data in application procedures under Art. 9 GDPR where applicable

In addition, national German data protection laws may apply (especially the Federal Data Protection Act, BDSG).

Security measures

We implement appropriate technical and organizational measures considering the state of the art, implementation costs, the nature and scope of processing, and risks for data subjects.

These include, in particular, measures to ensure confidentiality, integrity and availability of data as well as procedures for exercising data subject rights and handling data protection incidents.

SSL encryption (https): Data transmitted via our online services is protected through SSL encryption.

Transfer and disclosure of personal data

As part of our processing activities, personal data may be transferred to or disclosed to other entities (e.g. payment service providers, IT service providers, providers of integrated content). In such cases, we comply with legal requirements and conclude appropriate contractual safeguards.

Data processing in third countries

If data is processed in third countries (outside the EU/EEA), this is done only in compliance with legal requirements, for example based on adequacy decisions, standard contractual clauses or other appropriate safeguards under Art. 44-49 GDPR.

Use of cookies

Cookies are small files stored on user devices. They can store settings and usage-related information.

We also use similar technologies that perform comparable functions. If cookies or tracking technologies are used, we provide corresponding information in this policy.

Legal basis for cookie processing

If consent is requested, processing is based on consent. Otherwise, processing is based on legitimate interests or contractual necessity.

Withdrawal and objection (opt-out)

You may withdraw consent at any time and object to cookie-based processing. This can be done through browser settings and, for marketing cookies, also via common opt-out services.

Commercial and business services

We process data of contractual and business partners to provide contractual services, communicate, manage processes and protect legal claims. Data is disclosed only when legally required, contractually necessary or based on consent.

Retention is generally based on statutory periods (e.g. tax and commercial law retention obligations).

Credit check

If we provide advance performance or assume comparable economic risks, we may obtain identity and credit information from credit agencies based on statistical procedures.

Automated decisions in individual cases may occur in accordance with Art. 22 GDPR.

Contact

When contacting us (e.g. contact form, email, phone, social media), the provided data is processed to handle the request and any follow-up actions.

Communication via messenger

We use messenger services for communication. Depending on the service, metadata (e.g. time, technical details) may be processed. If end-to-end encryption is available and activated, message content is encrypted.

You may revoke consent or object to communication via messenger at any time.

Online conferences, meetings and webinars

We use third-party platforms for video/audio conferences, webinars and online meetings. Participant data may be processed to enable communication and service operation.

Provision of online services and web hosting

To provide our online services securely and efficiently, we use web hosting providers.

Server log files may include requested pages/files, date and time, transferred volume, browser and operating system information, referrer URL, and IP address.

Job applications

Applicant data is processed for application management and candidate selection.

Special categories of personal data are processed only where legally permitted.

If no employment relationship is established, applicant data is generally deleted after completion of the process, subject to statutory retention obligations or legitimate interests.

Cloud services

We use cloud services (Software as a Service) for document management, communication, collaboration and related business processes.

In this context, personal data may be processed on providers’ servers.

Marketing communication by post, fax or telephone

We process personal data for marketing communication in accordance with legal requirements and, where required, based on consent.

Consents can be withdrawn at any time; objections are possible at any time.

Online marketing

We process personal data for online marketing purposes, including interest-based advertising, reach measurement and conversion tracking.

This may involve cookies, pseudonymous identifiers and similar technologies.

Social media presences

We maintain profiles on social media platforms to communicate and provide information.

Data processing by platform operators may also occur outside the EU/EEA. Please refer to the relevant providers’ privacy notices.

Plugins and embedded functions/content

We integrate third-party content and features (e.g. maps, videos, social sharing buttons). This may require processing of users’ IP addresses and other technical data.

Deletion of data

We delete personal data in accordance with legal requirements once the purpose no longer applies and no legal retention obligations or other legal grounds require further storage.

Changes to this privacy policy

We update this privacy policy whenever changes in processing activities make this necessary.

Rights of data subjects

Under the GDPR, data subjects have in particular the following rights:

• Right to object
• Right to withdraw consent
• Right of access
• Right to rectification
• Right to erasure and restriction
• Right to data portability
• Right to lodge a complaint with a supervisory authority

Supervisory authority responsible for us:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Barbara Thiel
Prinzenstraße 5
30159 Hannover

Phone: 05 11/120-45 00
Fax: 05 11/120-45 99
Email: poststelle@lfd.niedersachsen.de
Website: http://www.lfd.niedersachsen.de

Definitions

This section explains key terms used in this policy, including but not limited to:

• Conversion tracking
• Credit information
• IP masking
• Interest-based and behavioral marketing
• Personal data
• Profiling
• Reach measurement (web analytics)
• Remarketing/retargeting
• Tracking
• Controller
• Processing