Data protection declaration

Security and protection of your personal data
We consider it to be an extremely important duty to ensure the confidentiality of the personal data provided by you and to protect this against unauthorised access. Therefore we apply the highest degree of care and the most modern security standards in order to ensure the maximum protection of your personal data.

As a company under private law, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the provisions of the German Federal Data Protection Act (BDSG). We have taken technical and organisational measures which ensure that the regulations relating to data protection are complied with both by ourselves and by our external service providers.

Definitions
The legislator requires that personal data be processed in a lawful manner, in good faith and in a way that can be understood by the affected person ("lawfulness, processing in good faith, transparency"). In order to guarantee this, we are informing you of the individual legal terms which are also used in this data protection declaration:

1. Personal data
"Personal data" is all information which relates to an identified or identifiable legal person (hereinafter referred to as "affected person"); a natural person is considered identifiable if he or she can be identified directly or indirectly, in particular by means of allocation to a characteristic such as name, reference number, location data, online profile or one or more special characteristics which express the physical, physiological, genetic, psychiatric, economic, cultural or social identity of this natural person.
2. Processing
"Processing" is any procedure or any sequence of procedures carried out in connection with personal data, with or without the assistance of automated processes, such as the gathering, recording, organisation, filing, saving, adjustment or alteration, reading, retrieval, use, disclosure by transfer, distribution or other form of provision, comparison or combination, restriction, deletion or destruction.
3. Restriction of the processing
"Restriction of the processing" is the marking of saved personal data with the intention of restricting its processing in the future.
4. Profiling
"Profiling" is any type of automated processing of personal data which means that this personal data is used in order to evaluate certain personal aspects which relate to a natural person, in particular in order to analyse or forecast aspects relating to work performance, economic position, health, personal preferences, interests, reliability, behaviour, place of residence or changes to whereabouts of this natural person.
5. Pseudonymisation
"Pseudonymisation" is the processing of personal data in such a way that the personal data can no longer be assigned to a specific affected person without consulting additional information, provided that this additional information is stored separately and is subject to technical and organisational measures which ensure that the personal data cannot be assigned to an identified or identifiable natural person.
6. File system
A "file system" is any structured collection of personal data which is accessible according to certain criteria, regardless of whether this collection is managed centrally, in a decentralised manner or in accordance with functional or geographical characteristics.
7. Responsible body
A "responsible body" is a natural or legal person, authority, institution or other body which takes decisions alone or with others concerning the purposes and methods of the processing of personal data; should the purposes and methods of this processing be prescribed under EU laws or the laws of the Member States, the responsible body and/or the specific criteria of its appointment can be determined under EU law or the laws of the Member States.
8. Order processor
An "order processor" is a natural or legal person, authority, institution or other body which processes personal data on behalf of the responsible body.
9. Recipient
A "recipient" is a natural or legal person, authority, institution or other body to whom personal data is disclosed, regardless of whether this is a third party or not. Authorities which may receive personal data within the framework of a specific investigation order under EU law or the law of the Member States are not however considered to be recipients; the processing of this data by the named authorities takes place in compliance with the applicable data protection regulations in accordance with the purposes of the processing.
10. Third party
A "third party" is a natural or legal person, authority, institution or other body other than the affected person, the responsible body, the order processor and persons who are authorised to process the personal data under the direct responsibility of the responsible body or order processor.
11. Consent
"Consent" of the affected person is any declaration of will in the form of a declaration or other clear confirming action issued voluntary in the specific case in an informed manner and without misunderstanding, by means of which the affected person is making clear that he or she agrees to the processing of the personal data relating to him or her.

Lawfulness of the processing
The processing of the personal data is only lawful if a legal basis applies to this. In accordance with Article 6 Paragraph 1 Letters a) to f) GDPR, a legal basis can be the following in particular:

1. The affected person has issued his or her consent to the processing of the personal data relating to him or her for one or more specific purposes;
2. The processing is necessary to fulfil a contract where the contracting party is the affected person or in order to carry out pre-contractual measures which take place at the request of the affected person;
3. The processing is necessary in order to fulfil a legal obligation to which the responsible body is subject;
4. The processing is necessary in order to protect vital interests of the affected person or of another natural person;
5. The processing is necessary to carry out a task which is in the public interest or which takes place in the course of the exercising of public powers which have been assigned to the responsible body;
6. The processing is necessary to safeguard the legitimate interests of the responsible body or of a third party, unless the interests or basic rights and freedoms of the affected person which require the protection of personal data outweigh this, in particular if the affected person is a child.

Information concerning the gathering of personal data
1. Below, we will inform you of the gathering of personal data when you use our website. As an example, personal data is name, address, email address or user behaviour.
2. Should you get in touch with us by email or via a contact form, we gather your personal data (name, email address, message text) to the extent which is provided by you. The purpose of the data processing is the initiation of contact. By means of the sending of your message, you are declaring your consent to the processing of the data which has been transferred. The processing takes place on the basis of Article 6 (1) Letter a) GDPR with your consent.
3. You can revoke your consent at any time by means of a notification to us, without the lawfulness of the processing which took place in line with the consent prior to the revocation being affected. We only use your email in order to process your query. Your data is then deleted, unless you have agreed to its further processing and use.

Gathering of personal data when visiting our website
Should the website be used solely for information purposes, i.e. should you not register or otherwise provide us with information, we only gather the personal data which your browser transfers to our server.

Should you wish to view our website, we gather the following data which is technically necessary for us to display the website to you and in order to ensure stability and security (legal basis is Article 6 Paragraph 1 Sentence 1 Letter f) GDPR): IP address, date and time of access, time zone difference to GMT, content of the request (concrete page), access status / HTTP status code, respective data quantity transferred, website from which the request originates, browser, operating system and interface, language and version of the browser software.

Use of cookies
1. In addition to the data referred to above, cookies are saved on your computer when you use our website. Cookies are small text files which are assigned and saved on your hard drive by the browser used by you and by means of which the body which sets the cookie is provided with certain information. Cookies cannot start any programs or transfer viruses onto your computer. The purpose of cookies is to make the Internet more user friendly and more effective as a whole.
2. In addition, we also use cookies on our website for the purpose of enabling an analysis of the surfing behaviour of our website visitors. The processing takes place on the basis of § 15 (3) of the German Telemedia Act (TMG) and Article 6 (1) Letter f) GDPR in accordance with the legitimate interest represented by the named purposes.
3. The data relating to you which is gathered in this way is pseudonymised by means of technical precautions. Therefore, it is no longer possible to assign this data to your person. The data is not saved together with other personal data relating to you.
4. You can configure the browser settings in accordance with your wishes and, for example, reject the acceptance of third party cookies or all cookies. So-called "third party cookies" are cookies which were set by a third party, and as a result not by the actual website you are currently visiting. Therefore we have full control over the use of cookies. By means of the selection of corresponding technical settings in your Internet browser, you can prevent the saving of the cookies and the transfer of the contained data.

Cookies which have already been saved can be deleted at any time. However, we wish to point out that in such a case, you may not be able to fully use all functions of this website.

Additional functions and services of our website
1. Alongside use of our website solely for information purpose, we offer various services which you may use if of interest. For this purpose, you generally need to provide additional personal data, which we use for the provision of the respective service and for the principles of data processing referred to above.
2. In part, we use external service providers in order to process your data. These have been carefully selected and engaged by us, are subject to our instructions and are regularly inspected.
3. In addition, we may pass your personal data on to third parties if campaign participations, competitions or similar services, as well as the conclusion of contracts are offered by ourselves together with partners. More detailed information will be received when you submit your personal data or at the bottom of the description of the offer.
4. Should our service providers or partners have their place of business in a country outside of the European Economic Area (EEA), we will inform you of the consequences of this in the description of the offer.

Use of our webshop
1. Should you wish to place an order in our webshop, it is necessary in order for the contract to be concluded that you provide the personal data which we require in order to process your order. The required information for the processing of the contracts are marked accordingly. Additional information is voluntary. We process the data provided by you in order to process your order. For the use of the webshop, we offer various payment methods and use a number of different payment service providers. Depending on which payment method you choose, various data will be transferred to the various payment service provider.

The legal basis of the transfer is Article 6 Paragraph 1 Sentence 1 Letter a) GDPR.
2. You can voluntarily set up a customer account, by means of which we can save your data for future purchases. When setting up an account under "my account", the data provided you will be saved in a revocable manner. You can always delete all further data, including your user account, in the customer area.
3. Due to regulations under commercial law and tax laws, we are obliged to save your address, payment and order data for a period of ten years. However, after two years, we restrict the processing, i.e. your data is only used in order to comply with the statutory obligations.
4. In order to prevent unauthorised third party access to your personal data, in particular financial data, the order process is encrypted by means of TLS technology.

Use of Google Analytics
1. This website uses Google Analytics, a web analysis service of Google Inc ("Google"). Google Analytics uses so-called "cookies", text files which are saved on your computer and which enable an analysis of the use of the website by you. The information concerning your use of this website which is generated by the cookie is generally transferred to a server of Google in the USA and saved there. In case of activation of the IP anonymisation on this website, your IP address will however be shortened first by Google within Member States of the European Union or in other Member States of the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
2. For data transfers to the USA, a reasonableness resolution has been issued by the European Commission. The processing takes place on the basis of Article 6 (1) Letter f) GDPR in accordance with the legitimate interest in designing the website in a manner which responds to demands and is targeted. For reasons connected to your specific situation, you have the right to object at any time to this processing of the personal data relating to you under Article 6 (1) Letter f) GDPR.
On behalf of the operator of this website, Google will use this information in order to evaluate your use of the website, to compile reports concerning the website activities and to provide other services to the website operator connected with the use of the website and the use of the Internet.
3. The IP address transferred by your browser within the framework of Google Analytics will not be combined with other data by Google.
4. You can prevent the saving of the cookies by setting your browser software accordingly; however, we wish to point out that in such a case, you may not be able to fully use all of the functions of this website. In addition you can prevent the recording of the data generated by the cookie and which relates to your use of the website (including your IP address) by Google, as well as the processing of this data by Google by downloading and installing the browser plugin which can be obtained via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
5. This website uses Google Analytics with the "_anonymizeIp()“ extension. By means of this, IP addresses are further processing in shortened for, which means that it is not possible to trace a person. Should the data gathered in relation to you allow you to be traced, this is therefore excluded immediately and the personal data is also immediately deleted.
6. We use Google Analytics in order to be able to analyse the use of our website and to improve it. By means of the statistics which are obtained, we can improve our service and make it more interesting to you as a user. In the exceptional cases where personal data is transferred to the USA, Google has agreed to abide by the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Article 6 Paragraph 1 Sentence 1 Letter f) GDPR.
7. Information concerning the third party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User conditions: http://www.google.com/analytics/terms/de.html, Overview of data protection:
http://www.google.com/intl/de/analytics/learn/privacy.html, and the data protection declaration: http://www.google.de/intl/de/policies/privacy.
8. This website also uses Google Analytics in order to analyse visitor traffic over a range of devices, which takes place via a user ID. You can de-activate the multi-device analysis of your use in your customer account under "my data", "personal data".

Use of social media plugins
1. We currently use the following social media plugins: [Facebook, Google+, Xing]. We use the so-called two click solution. This means that when you visit our site, no personal data is generally provided to the provider of the plugins at first. You can recognise the provider of the plugins via the marking in the box above its first letters or the logo. We provide the option for you to communicate directly with the provider of the plugin via the button. Only if you click on the marked field and carry out the activation, is the plugin provider informed that you have accessed the corresponding website of our online service. In addition, the data named in § 3 of this declaration is transferred. In the case of Facebook and Xing, the IP address is immediately anonymised after being gathered, according to information provided by the respective providers in Germany. By means of the activation of the plugin, personal data is therefore transferred by you to the respective plugin provider and saved there (in the USA in the case of American providers). As the plugin provider carries out the data gathering via cookies in particular, we would recommend that prior to clicking on the greyed out box, you delete all cookies via the security settings of your browser.
2. We have no influence over the gathered data and data processing procedures and we are not aware of the full scope of the data gathering, the purposes of the processing and how long the data is saved for. We also do not have any information concerning the deletion by the plugin provider of the data which is gathered.
3. The plugin provider saves the data gathered in relation to you as usage profiles and uses these for the purposes of advertising, market research and/or tailoring its website to customer needs. Such an evaluation takes place in particular (also for users who are not logged in) in order to display targeted advertising and to inform other users of the social network of your activities on our website. You have the right to object to the formation of these user profiles, whereby you need to get in touch with the respective plugin provider to claim this right. Via the plugins, we provide you with the option of interacting with the social networks and other users, so that we can improve our service and make it more interesting for you as a user. The legal basis for the use of the plugins is Article 6 Paragraph 1 Sentence 1 Letter f) GDPR.
4. The passing on of the data takes place regardless of whether to hold an account with the plugin provider and are logged into it. Should you be logged in with the plugin provider, your data which is gathered from us will be assigned directly to your account which exists with the plugin provider. Should you click the activated button and, for example, link the page, the plugin provider also saves this information in your user account and publicly notifies your contacts of this. We would recommend regularly logging out after using a social network, however in particular before activating the button, as by doing this you can prevent an assignment to your profile with the plugin provider.
5. Further information concerning the purpose and scope of the data gathering and its processing by the plugin provider can be found in the following data protection declarations of these providers which have been issued to us. Here, you can also find additional information concerning your rights in this respect and settings options in order to protect your private sphere.
6. Addresses of the respective plugin providers and URL with their data protection notices:
Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php;further information concerning data gathering:
http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications
and http://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook has agreed to abide by the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de.
Google has agreed to abide by the EU-US Privacy Shield,
https://www.privacyshield.gov/EU-US-Framework.
Xing AG, Gänsemarkt 43, 20354 Hamburg, DE;
http://www.xing.com/privacy.

Integration of Google Maps
1. We use the service of Google Maps on this website. By means of this, we can display interactive maps to you directly in the website and enable you to use the map function comfortably.
2. When you visit the website, Google is informed that you have accessed the corresponding sub-page of our website. In addition, the data named in § 3 of this declaration is transferred. This takes place regardless of whether Google provides a user account which you are logged into or whether there is no user account. Should you be logged into Google, your data is assigned directly to your account. Should you not wish the assignment to your account with Google to take place, you need to you out before activating the button. Google saves your data as usage profiles and uses these for the purposes of advertising, market research and/or tailoring its website to customer needs. Such an evaluation takes place in particular (also for users who are not logged in) in order to display targeted advertising and to inform other users of the social network of your activities on our website. You have the right to object to the formation of these user profiles, whereby you need to get in touch with Google to claim this right.
3. Further information concerning the purpose and scope of the data gathering and its processing by the plugin provider can be found in the data protection declarations of the provider. Here, you can also find additional information concerning your rights in this respect and settings options in order to protect your private sphere.
http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has agreed to abode by the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US- Framework.

Order processor
We use external service providers (order data processors), for example in order to send goods. A separate order data processing contract has been concluded with the service provider, in order to ensure the protection of your personal data. The processing takes place on the basis of Article 6 (1) Letter a) GDPR with your consent. You can revoke your consent at any time by means of a notification to us or the transportation company, without the lawfulness of the processing which took place in line with the consent prior to the revocation being affected.

Children
Our services are generally intended for adults. Persons under the age of 18 should not send personal data to us without the agreement of their parents or guardians.

Rights of the affected person
Should the statutory requirements be met, you have the following rights under Articles 15 - 20 GDPR: Right of information, of correction, confirmation, deletion, to have the processing restricted, data portability and right to effective legal remedy before a court. Also, under Article 21 (1) GDPR, you have the right to raise an objection to the processing which is based on Article 6 (1) GDPR, as well to the processing for the purpose of direct advertising.
Please get in touch if you wish. You can find the contact details in our legal notice.

You can contact our data protection officer directly at:
WOLFF & MÜLLER Holding GmbH & Co. KG
Schwieberdinger Straße 107
70435 Stuttgart

Telefon +49 711 8204-327
Telefax +49 711 8204-86 327

dsb@wolff-mueller.de
www.wolff-mueller.de

Right to complain to the supervisory authority
In accordance with Article 77 GDPR, you have the right to complain to the supervisory authority, should you be of the opinion that the processing of your personal data is taking place unlawfully.

Most recent update: 25.05.2018