Privacy Policy

We appreciate your interest in our company. The management team of the EXAPT Systemtechnik GmbH places great value on data privacy. For using the website of the EXAPT Systemtechnik GmbH the provision of personal data is generally not necessary. However, if a data subject wants to make use of special services of our company on our website, processing of personal data might become necessary. In the case processing of personal data is necessary and there is no legal basis for such processing we always get consent from the data subject.

Personal data of a data subject like name, address, email address or phone number are always processed in accordance with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection laws applying to the EXAPT Systemtechnik GmbH. The purpose of this privacy policy is to educate the public about the nature, extent and purpose of the personal data that our company collects, uses and processes. Furthermore this privacy policy will inform data subjects about their rights.

The EXAPT Systemtechnik GmbH as data controller has implemented several technical and organisational measures to ensure that the personal data processed through this website are protected as best as possible. Nevertheless data transfer via the internet is always prone to security gaps, thus absolute protection cannot be guaranteed. Therefore anyone is free to provide personal data via alternative methods, for example over the phone.

1. Definitions

The EXAPT Systemtechnik GmbH's privacy policy uses terminology from the General Data Protection Regulation (GDPR) of the European Union. We want our privacy policy to be easily readable and understandable by both the public and our clients and business partners. To this aim we would like to define the terminology used herein.

Among others the following terms are used within this privacy policy:

a) Personal Data
Personal data include all information relating to an identified or identifiable natural person (the "data subject"). A natural person is deemed identifiable if they can be directly or indirectly identified, especially via an identifier like name, identification number, location data, online identification data or one or more special features corresponding to their physical, physiological, genetic, mental, economic, cultural or social identity.

b) Data Subject
Data subject refers to an identified or identifiable natural person whose personal data is being process by the data controller.

c) Processing
Processing refers to any process or processes, with or without automated procedures, in connection with personal data like gathering, collecting, organising, arranging, storing, adapting or changing, reading, retrieving, using, disclosing via transfer, distributing or any other form of provisioning, reconciliation or linking, restricting, deleting or destruction.

d) Restriction of processing
Restriction of processing is the process of marking stored personal data for the purpose of restricting future processing thereof.

e) Profiling
Profiling means any automated processing of personal data with the purpose of using these personal data to assess personal aspects of a natural person, particularly for the analysis or prediction of aspects like work performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or change of location of that natural person.

f) Pseudonymisation
Pseudonymisation means the processing of personal data in a way that they cannot be attributed to a specific data subject anymore without the use of additional information, provided this additional information is stored separately and subject to technical and organisational measures that guarantee the personal data cannot be attributed to an identified or identifiable natural person.

g) Controller or data controller
The controller or data controller is a natural or legal person, authority, institution or other entity with sole or joined power of decision-making in regard to the purpose and method of the processing of personal data. If the purpose and method of the processing is governed by EU legislation or the legislation of a member state, the data controller or the criteria for their designation can be subject to EU legislation or the legislation of the member states.

h) Data processor
Data processor refers to a natural or legal person, authority, institution or other entity that processes personal data on behalf of the data controller.

i) Recipient
Recipient refers to a natural or legal person, authority, institution or other entity to whom personal data are disclosed, regardless whether it is a third party or not. Authorities receiving personal data in connection with an investigation under EU law or the law of a member state are not considered recipients.

j) Third party
A third party is a natural or legal person, authority, institution or other entity besides the data subject, the data controller, the data processor and persons directly authorised by the data controller or data processor to process personal data.

k) Consent
Consent means any voluntary informally and unequivocally conveyed declaration of will by the data subject in the form of a statement or other clearly affirmative action in which the data subject indicates that they agree to the processing of the relevant personal data.

2. Name and address of the data controller

The data controller as defined in the General Data Protection Regulation, in the data privacy legislation of the member states of the European Union and other data protection regulations is:

EXAPT Systemtechnik GmbH
Theaterstraße 12
52062 Aachen
Germany

Phone: +49 241 477 940
Email: info@exapt.de
Website: www.exapt.de

Management
Chief Executive Officer Michael Servos

Board of Directors
Chairman of the board of directors Prof. Dr. Arndt Richter

3. Name and address of the data protection officer

Volker Beiss

EXAPT Systemtechnik GmbH
Theaterstraße 12
52062 Aachen
Germany

Phone: +49 241 47794187
Email: datenschutz@exapt.de
Website: www.exapt.de

Each data subject has the right to contact our data protection officer at any time with questions or suggestions concerning data privacy.

4. Regulatory authority for the control of and compliance with data protection law

The state representative for data protection North Rhine-Westphalia
Kavalleriestraße 2-4
40213 Düsseldorf
Germany

5. Cookies

The EXAPT Systemtechnik GmbH uses cookies on their website. Cookies are text files that are stored on a computer system via a web browser.

Cookies are used by numerous websites and servers. Many cookies contain a so-called cookie ID. A cookie ID is the unique identifier of a cookie. It consists of a string enabling the mapping of websites and servers to the specific web browser that stored the cookie. This enables the visited websites and servers to distinguish the specific web browser of a data subject from other web browsers containing different cookies. A specific web browser can be recognised and identified via the unique cookie ID.

By using cookies the EXAPT Systemtechnik GmbH can provide users of this website with user-friendly services which would not be possible without them.

Cookies help us optimise the information and offers on our website for our users. Cookies make it possible to recognise the users on our website, as mentioned earlier. The purpose of this recognition is facilitating the use of our website. For example a user of a website that uses cookies does not have to enter their login data each time they visit the website because they can be retrieved by the website from the cookie stored on the user's computer system. Another example is the cookie of a shopping cart in an online store. The online store uses a cookie to save the articles that the customer already put into the virtual shopping cart.

The data subject can prevent the storing of cookies by our website in the settings of their web browser at any time und can thus object to the use of cookies permanently. Furthermore, cookies already stored can be deleted via the web browser or another software programme at any time. This can be done in every common web browser. If the data subject deactivates the storing of cookies in the web browser used, they might not be able to make full use of all the functions on our website.

6. Collection of general data and information

The website of the EXAPT Systemtechnik GmbH collects a series of general data and information every time a data subject or an automated system opens the website. This general data and information are stored in log files on the server. The following data may be collected: (1) the type and version of the web browser used; (2) the operating system of the system accessing the website; (3) the website from which the accessing system has reached our website (the "referrer"); (4) the sub-webpages on our website that are called by the accessing system; (5) date and time of the website access; (6) the internet protocol address (IP address); (7) the accessing system's internet provider; and (8) other similar data and information for repelling attacks on our information technology systems.

The EXAPT Systemtechnik GmbH does not draw conclusions about the data subject through the use of these general data and information. The information is needed for (1) correctly provisioning the contents of our website; (2) optimising the contents and advertisement on our website; (3) guaranteeing the continued functionality of our information technology systems and the technology of our website; and (4) in case of a cyber attack providing law enforcement agencies with the information necessary for prosecution. This anonymously collected data and information are thus analysed by the EXAPT Systemtechnik GmbH statistically and furthermore with the purpose of enhancing the privacy and data security of our business to ultimately ensure an ideal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by the data subject.

7. Newsletter subscription

Users of the EXAPT Systemtechnik GmbH's website have the option to subscribe to the newsletter of our company. The nature of the personal data transmitted to the data controller through the newsletter subscription can be deducted from the subscription input screen.

The EXAPT Systemtechnik GmbH uses the newsletter to regularly inform clients and business partners about offers of our business. Data subjects can only receive our business's newsletter if (1) the data subject has a valid email address; and (2) the data subject has subscribed to the newsletter. For legal reasons, to satisfy the double opt-in procedure, data subjects receive a confirmation email after first subscribing to the newsletter. This confirmation email serves to verify if the owner of the email address as the data subject has authorised the receipt of the newsletter.

During the newsletter subscription process we also store the IP address of the internet service provider (ISP) used by the data subject's computer system at the time of the subscription as well as date and time of the subscription. The collection of this data is necessary to be able to retrace a (potential) misuse of the data subject's email address at a later time and also serves as legal protection for the data controller.

The personal data collected during newsletter subscription are solely used for sending the newsletter. Furthermore newsletter subscribers can receive notifications necessary for the operation of the newsletter service or the registration therefore as can be the case with changes to the newsletter offer or changes to the technical circumstances.

The EXAPT Systemtechnik GmbH uses the newsletter tool CleverReach for newsletter creation and management. The required data of the newsletter recipient are hosted web-based on a password-protected part of a CleverReach server that can only be accessed by the EXAPT Systemtechnik GmbH. The contractual framework between the EXAPT Systemtechnik GmbH and CleverReach consists of the terms and conditions as well as the privacy policy of CleverReach, which can be found here: CleverReach Terms and Conditions / Privacy Policy. According to §11 of the CleverReach terms and conditions CleverReach guarantees that they will neither access data of the newsletter recipients nor use them in any other way.

The newsletter tool analyses the reach of the individual newsletters to make sure they actually reach the recipient. The opening and click behaviour of each newsletter recipient gets analysed and saved. The individual behavioural patterns emerging through this analysis are merely used for a statistical evaluation of the newsletter's success and will not be transmitted to third parties or used for any other purposes.

By submitting your data in our newsletter form you agree to your data being processed by CleverReach to the extend described.

The personal data collected through the newsletter service will not be transmitted to third parties. The data subject can cancel the newsletter subscription at any time. The consent for the storing of personal data that the data subject gave for sending the newsletter can be revoked at any time. For this purpose you will find a corresponding link in each newsletter. Furthermore you can always contact the data controller directly on our website or by other means to unsubscribe from the newsletter.

8. Newsletter tracking

The EXAPT Systemtechnik GmbH's newsletter contains so-called tracking pixels. A tracking pixel is a miniature graphic embedded in emails that are sent in HTML format for enabling the recording and analysing of log files. This allows for a statistical evaluation of the success or failure of online marketing campaigns. The EXAPT Systemtechnik GmbH uses the embedded tracking pixels to check if and when an email was opened by the data subject and which links in the email the data subject clicked on.

The personal data collected via the tracking pixel contained in the newsletter are stored and analysed by the data controller for the purpose of optimising the newsletter dispatch and better tailoring the contents of future newsletters to the interests of the data subject. These personal data will not be transmitted to third parties. Data subjects are entitled at any time to revoke their consent regarding this matter that they gave via the double opt-in procedure. After that revocation their personal data will be erased by the data controller. The EXAPT Systemtechnik GmbH will automatically interpret an unsubscription from the newsletter as a revocation.

9. Registration for training

You can register for trainings on our website. For the processing of such registrations we collect and process the following data:

Mandatory fields:

  • Title
  • First name
  • Surname
  • Company
  • Date of the training
  • Email address
  • Postal address
  • Phone number

Optional fields:

  • Fax
  • PO box
  • Department
  • Comment

To be able to register you need to accept our data protection notice. The addresses of the participants will be stored electronically and processed automatically after registration. All participants receive a list of participants with their names and corresponding businesses. Beyond that we do not pass on or disclose any contact details like addresses or phone numbers.

  • We use your data for organising the event, i.a.: We print part of the data (name, business, email address) onto participant lists / programmes.
  • We may use contact data (name, postal address, email address) for sending material relevant for the event (e.g. seminar schedule).
  • We pass on some of the data (name, business) to the moderators of trainings / seminars.
  • Optional: Evaluation of the quality of trainings via surveys with or without name.
  • Furthermore we use some of the data (name, business, email address and potentially postal address) for sending out information (event information, invitations to surveys, information about new seminars).

For exercising the right to object the data subject can directly contact an employee of the EXAPT Systemtechnik GmbH.

10. Registration for work groups

At times you can register for work groups of the EXAPT Systemtechnik GmbH on our website. For the processing of such registrations we collect and process the following data:

Mandatory fields:

  • Title
  • First name
  • Surname
  • Company
  • Postal code
  • City
  • Email address

Optional fields:

  • Department
  • PO box

To be able to register you need to accept our data protection notice and answer a security question. The addresses of the participants will be stored electronically and processed automatically after registration. All participants receive a list of participants with their names and corresponding businesses. Beyond that we do not pass on or disclose any contact details like addresses or phone numbers. We would like to expressly point out that photos will be taken during the event. By participating in the event you agree and acknowledge that photos of the event depicting you might get published.

We use your data for organising the event, i.a.:

  • We print part of the data (name, business, email address) onto participant lists / programmes.
  • We may use contact data (name, postal address, email address) for sending material relevant for the event (e.g. schedule and other event information).
  • Optional: Evaluation of the quality of the general meeting via surveys with or without name.

For exercising the right to object the data subject can directly contact an employee of the EXAPT Systemtechnik GmbH.

11. Registration for the general meeting of the association for the promotion of the EXAPT-System e.V.

At times you can register for the general meeting of the association for the promotion of the EXAPT-System e.V. on our website. For the processing of such registrations we collect and process the following data:

Mandatory fields:

  • Title
  • First name
  • Surname
  • Company
  • Postal code
  • City
  • Email address

Optional fields:

  • Department
  • PO box

To be able to register you need to accept our data protection notice and answer a security question. The addresses of the participants will be stored electronically and processed automatically after registration. All participants receive a list of participants with their names and corresponding businesses. Beyond that we do not pass on or disclose any contact details like addresses or phone numbers. We would like to expressly point out that photos will be taken during the event. By participating in the event you agree and acknowledge that photos of the event depicting you might get published.

We use your data for organising the event, i.a.:

  • We print part of the data (name, business, email address) onto participant lists / programmes.
  • We may use contact data (name, postal address, email address) for sending material relevant for the event (e.g. schedule and other event information). Optional: Evaluation of the quality of the general meeting via surveys with or without name.

For exercising the right to object the data subject can directly contact an employee of the EXAPT Systemtechnik GmbH.

12. Contact opportunity via the website

Due to statutory provisions the website of the EXAPT Systemtechnik GmbH contains information allowing to contact our business quickly and directly by electronic means. This also includes a general address of the so-called electronic mail (email address). If a data subject contacts the data controller via email or a contact form, the personal data submitted by the data subject will be stored automatically. Such personal data that are voluntarily sent to the data controller by the data subject are stored for the purpose of processing or contacting the data subject. These personal data will not be transmitted to third parties.

13. Routine deletion and locking of personal data

The data controller processes and stores the personal data of the data subject only for the duration necessary for the particular purpose or for the duration required by the laws and regulations of the European Union relevant for the data controller.

As soon as the purpose for storing the data is no longer relevant or the mandatory retention period required by EU or other relevant law has expired, the personal data will be locked or deleted routinely and applicable to the relevant statutory provisions.

14. Rights of the data subject

a) Right to obtain confirmation

Each data subject has the right under EU law to obtain information from the data controller concerning if their personal data are being processed. If the data subject would like to exercise their right to obtain confirmation they can contact an employee of the data controller at any time.

b) Right of access

Each data subject whose personal data are being processed has the right under EU law to obtain from the data controller confirmation as to whether their personal data is being processed anytime and free of charge as well as receive a copy of that information. Furthermore EU law requires that a data subject can get information about the following:

  • the purpose of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data is not collected from the data subject: any available information as to their source;
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Furthermore the data subject has a right of information about whether personal data was transmitted into a third country or to an international organisation. If this is the case the data subject furthermore has the right to receive information about relevant guarantees in relation to that transmission.

If the data subject would like to exercise their right of information they can contact an employee of the data controller at any time.

c) Right to rectification

Each data subject whose data is being processed has the right under EU law to demand the prompt rectification of their incorrect personal data. Furthermore, taking the purpose of the processing into account, the data subject has the right to demand the completion of incomplete personal data – also via a supplementary statement.

If the data subject would like to exercise their right to rectification, they can contact an employee of the data controller at any time.

d) Right to erasure (right to be forgotten)

Each data subject whose personal data are being processed has the right under EU law to demand that the data controller erases their personal data immediately, provided one of the following reasons applies and the processing is not necessary:

  • The personal data were gathered for a purpose or processed in a way that is not relevant anymore.
  • The data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing.
  • The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
  • The personal data have been unlawfully processed.
  • The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
  • The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If one of the above-mentioned reasons applies and the data subject requests the erasure of personal data stored by the EXAPT Systemtechnik GmbH, the data subject can contact an employee of the data controller concerning this matter at any time. The employee of the EXAPT Systemtechnik GmbH will promptly see to the erasure of the data.

If the EXAPT Systemtechnik GmbH disclosed the personal data and the company as data controller is required to erase the personal data accord to Article 17(1) GDPR, the EXAPT Systemtechnik GmbH will take appropriate (technical) measures in consideration of the available technology and the cost of implementation to make other data controllers processing the disclosed personal data aware that the data subject requested from these other data controllers the erasure of all links to these personal data or copies or replications thereof, provided a processing is not necessary. The employee of the EXAPT Systemtechnik GmbH will arrange all necessary steps on a case-by-case basis.

e) Right to restriction of processing

Each data subject whose data are being processed has the right under EU law to request from the data controller that the processing be restricted, provided one of the following conditions is met:

  • The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
  • The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
  • The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
  • The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the above-mentioned conditions applies and a data subject requests the restriction of personal data stored by the EXAPT Systemtechnik GmbH, the data subject can contact an employee of the data controller concerning this matter at any time. The employee of the EXAPT Systemtechnik GmbH will arrange the restriction of the processing.

f) Right to data portability

Each data subject whose personal data are being processed has the right under EU law to receive the personal data concerning them and that they provided to a data controller, in a structured, commonly used and machine-readable format. They also have the right to transfer those data to another data controller without hindrance from the data controller they provided the personal data with, provided the processing is based on consent according to point (a) of Article 6(a) GDPR or point (a) of Article 9(2) GDPR or on a contract according to point (b) of Article 6(1) GDPR and the processing is done automatically, provided the processing is not necessary for a task carried out in the public interest or in the exercise of official authority vested in the data controller.

Furthermore the data subject has the right according to the right to data portability Article 20(1) GDPR to have the personal data transmitted directly from one data controller to another, provided it is technically feasible und does not impair the rights and freedoms of others.

For exercising the right to data portability the data subject can contact an employee of the EXAPT Systemtechnik GmbH at any time.

g) Right to object

Each data subject whose personal data are being processed has the right under EU law to object the processing of their personal data according to point (e) or (f) of Article 6(1) GDPR on grounds relating to their particular situation. This also applies to profiling based on those provisions.

The EXAPT Systemtechnik GmbH does not continue processing personal data in case of an objection unless we can provide compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

If the EXAPT Systemtechnik GmbH processes personal data for direct marketing purposes, the data subject has the right to object the processing of the personal data for the purpose of such marketing at any time. This also applies to profiling in connection with such direct marketing. If the data subject informs the EXAPT Systemtechnik GmbH about their objection against the processing for direct marketing purposes, the EXAPT Systemtechnik GmbH will no longer process the personal data for this purpose.

In addition the data subject has the right to object the processing of their personal data by the EXAPT Systemtechnik GmbH for scientific or historical research purposes or for statistic purposes according Article 89(1) GDPR on grounds relating to their particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

For exercising the right to object the data subject can directly contact an employee of the EXAPT Systemtechnik GmbH or any other employee. Furthermore in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling

Each data subject whose data are being processed has the right under EU law not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except if the decision (1) is necessary for entering into, or performance of, a contract between the data subject and a data controller; or (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or (3) is based on the data subject’s explicit consent.

If the decision (1) is necessary for entering into, or performance of, a contract between the data subject and a data controller; or (2) is based on the data subject’s explicit consent, the EXAPT Systemtechnik GmbH will implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

If the data subject would like to exercise their right in connection with automated decision-making they can contact an employee of the data controller at any time.

i) Right to withdraw data privacy-related consent

Each data subject whose data are being processed has the right under EU law to withdraw their consent for the processing of personal data at any time.

If the data subject would like to exercise their right to withdraw their consent, they can contact an employee of the data controller at any time.

15. Data protection in connection with applications and during the application process

The data controller collects and processes the personal data of applicants for the purposes of the application procedure. The data may be processed electronically. In particular, that is the case if an applicant submits relevant application documents to the data controller electronically, e.g. via email or via a web form on the website. If the data controller enters into an employment contract with the applicant the submitted data will be stored for the purposes of the employment subject to the statutory provisions. If the data controller does not enter into an employment contract with the applicant, the application documents will be erased automatically two months after notification of the rejection, unless barred by other legitimate interests of the data controller. Other legitimate interests to that effect would be e.g. a burden of proof in the context of a lawsuit under the General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz, AGG).

16. Legal basis of the processing

Legal basis for our company's data processing procedures for which we seek consent for a specific purpose, is point (a) of Article 6 GDPR. If the data processing is necessary to fulfil a contract where the data subject is a contracting party, e.g. in processing activities in connection with delivery of goods or (return) services, the processing is based on point (b) of Article 6 GDPR. The same applies for processing activities in connection with precontractual measures, e.g. in the case of requests in connection with our products and services. If our company is subject to a legal obligation that makes the processing of personal data necessary, e.g. the fulfilment of tax obligations, our processing is based on point (c) of Article 6 GDPR. Rarely the processing of personal data can be necessary for the protection of the vital interests of the data subject or another natural person. This could be the case if e.g. a visitor gets hurt on our premises and we would need to relay their name, age, health insurance data or other vital information to a physician, a hospital or other third parties. In that case the processing would be based on point (d) of Article 6 GDPR. Finally processing can be based on point (f) of Article 6 GDPR. This article is the legal basis for processing activities not covered by any of the forementioned legal bases, if the processing is necessary to protect the legitimate interests of our company or a third party and provided the data subject's interests, fundamental rights and fundamental freedoms do not take precedence. In particular such processing is permitted because European legislation explicitly stated so. European law states that a legitimate interest can be assumed if the data subject is a client of the data controller (Recital 47, Clause 2 GDPR).

17. Legitimate interests of the data controller and third parties for the processing

If the processing of personal data is based on point (f) of Article 6 GDPR, our legitimate interest is based on the conduct of our business for the welfare of all our employees and shareholders.

18. Duration of storage of personal data

The applicable legal retention period is our basis for the duration of storage of personal data. Once this period has expired we routinely delete the corresponding data, provided it is not needed anymore for the fulfilment of a contract or for precontractual measures.

19. Legal or contractual regulations for the provisioning of personal data; necessity for the conclusion of a contract; obligation of the data subject to provide personal data; potential consequences for failure to provide information

We hereby inform you that providing personal data might be mandatory by law (e.g. in connection with tax regulations) or might result from contractual provisions (e.g. information about the contracting party). Sometimes it is necessary for the conclusion of a contract that the data subject provides us with personal data that we then need to process. For example the data subject is obligated to provide us with personal data if they enter into a contract with our business. If the personal data is not provided, the conclusion of the contract is not possible. The data subject needs to contact one of our employees before providing personal data. Our employee will explain to the data subject on a case-by-case basis if the provision of personal data is mandatory by law or contract or necessary for the conclusion of the contract, if the provision of personal data is mandatory and the consequences of not providing the personal data.

20. Automated decision-making

As a responsible company we forgo automated decision-making as well as profiling.

This privacy policy was generated with the privacy policy generator of the DGD Deutsche Gesellschaft für Datenschutz GmbH, which acts as external data protection officer for Upper Palatinate, in cooperation with the solicitor for data protection Christian Solmecke.

Server log files

The website provider gathers and stores information automatically in so-called server log files which are automatically transmitted to us by your web browser. This includes:

  • browser type and browser version
  • used operating system
  • referrer URL
  • hostname of the accessing computer
  • time of a server inquiry

This data will not be merged with other data sources; the data is being evaluated with the locally installed software "AWstats/ReportMagic".

Legal basis for the data processing is point (f) of Article 6(1) GDPR which permits the processing of data for the purpose of fulfilling a contract or precontractual measures.

Google reCaptcha

We use the Google service reCaptcha to determine if our contact or newsletter form is being filled out by a human or a computer. Google uses the following data to determine if you are a human or a computer: IP address of the used device; visited webpage with the Captcha embedded; date and duration of the visit; identification data of the used browser and operating system type; Google account, if you are logged into Google; mouse movement on the reCaptcha area as well as picture identification tasks. Point (f) of Article 6(1) GDPR is the legal basis for the above-mentioned data processing. We have a legitimate interest for this processing to protect the security of our website and protect ourselves from automated input (attacks).