1. CONTROLLER AND CONTACT DETAILS OF THE DATA PROTECTION OFFICER
The controller in terms of data processing on this online offering is
peiker Holding GmbH
DE-61325 Bad Homburg
(hereinafter also referred to as the "Company")
You can reach our external Data Protection Officer under
2. PROCESSING OF PERSONAL DATA IN CONNECTION WITH YOUR USE OF OUR WEBSITES, APPLICATIONS AND ONLINE PLATFORMS
a. Data categories, purpose of processing and legal basis
In the context of the use of our websites, applications or online tools (in the following summarised as “online offering"), we process the following personal data:
- Personal data that you yourself enter voluntarily in the context of an online offering (such as during registration, requests to contact you or in the context of participation in surveys, etc.), such as first and last name, E-mail address, telephone number, information provided in the context of a support request, comments or forum posts and
- Information that is automatically sent to us by your web browser or terminal device, such as your IP address, device type, browser type, previously visited web pages, sub-pages visited or the date and time of each visitor request.
We will process your personal data for the following purposes:
- Technical administration of the website (Prevention and detection of fraudulent or similar acts including attacks on our IT infrastructure, enabling user authentication)
The legal basis for the processing of personal data for these purposes is Article 6 paragraph 1 lit. f) GDPR, regardless of whether a contractual relationship exists with you.
- Online and other services (Enabling the use of the services and functions of our online offerings, processing of enquiries, sending marketing information upon request)
The legal basis for processing personal data for the purpose specified above is Article 6 paragraph 1 lit. b) and lit. f) GDPR. The visit to our online offering establishes a legal relationship similar to a contract in the sense of Article 6 paragraph 1 lit. b) GDPR. Without the processing of personal data, we cannot offer our online services as intended. In particular, the transmission of personal data such as the IP address is necessary for establishing the connection.
In some cases we will ask you expressly for your consent to the processing of your personal data. In such a case, the legal basis for processing your personal data is the consent you have given in accordance with Article 6 paragraph 1 lit. a) GDPR in conjunction with Article 7 GDPR.
Cookies are small text files that are stored by your browser on your terminal device when you visit our website.
Consent management with Usercentrics
We use the Consent Management Platform (CMP) of Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany. The tool allows you to conveniently manage your consent to the setting of cookies that are not technically necessary and to make changes in this regard - such as revoking consent that you have given.
The tool enables us to inform you about your consent and to obtain, manage and document it.
The purpose of the processing is to obtain consent, to give you the opportunity to revoke or modify your consent, and to provide evidence (accountability) with regard to consent given. The legal basis for this is Art. 6 (1) lit. f DS-GVO (legitimate interests in the aforementioned purposes).
c. Google Analytics
This website uses functions of the web analytics service "Google Analytics". The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, ("Google") (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics enables us to analyze the usage behavior of our online offering. The data obtained from this (hereinafter "usage data") is used to optimize our website and advertising measures.
During your website visit, the following usage data is recorded, among other things:
- Web pages called up
- Your behavior on the web pages
- Your approximate location (country and city)
- Your IP address (in anonymized form, see under (i) )
- technical information such as browser, internet service provider, terminal device and screen resolution
- Source of origin of your visit (i.e. via which website or advertising medium you came to us).
Google Analytics stores cookies in your web browser for its services. These cookies contain a randomly generated user ID that can be used to recognize you during future website visits. The recorded data is stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles.
The storage of Google Analytics cookies and the processing of data in connection with Google Analytics is based on Art. 6 para. 1 lit. a DS-GVO in conjunction with. Art. 7 DS-GVO as well as § 25 para. 1 TTDSG. We obtain the consent required for this from our users immediately after they call up our website for the use of Google Analytics or the use of statistics cookies through our cookie banner. The consent obtained from you in this respect also relates to the transfer of your data to the USA (Art. 49 para. 1 lit. a DS-GVO).
You can revoke your consent at any time without giving reasons. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
To do this, you can simply change your cookie settings in accordance with the above explanations in section 2b. This will result in us no longer transmitting any data to Google in this respect.
Google may transfer personal data to countries outside the EU and the EEA without an adequacy decision, in particular to Google's parent company, on the basis of EU standard contractual clauses.
Details on this can be found in Google's privacy notices at www.google.com/policies/privacy/.
User and event data are stored for 14 months. User and event data is data linked to cookies, user identifiers (e.g. User ID) and advertising IDs (e.g. DoubleClick cookies, Android advertising ID, IDFA [Apple identifier for advertisers]).
(i) IP anonymization
This website uses the function of a so-called "IP anonymization", which your IP address is then shortened by Google before a transmission of your data to the USA from the EU or the EEA takes place. Your complete IP address is only transmitted to Google's servers in exceptional cases; Google then shortens the IP addresses after transmission on its servers. Google uses this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data collected by Google.
(ii) Browser plug-in
(iii) Objection to data collection
You can prevent the collection of your data by Google Analytics by clicking on the following link. An opt-out cookie will then be set that prevents the collection of your data during future visits to this website: Disable Google Analytics
d. Contacting us
Contact forms which can be used for electronic contact are available on our website. If a user takes advantage of these options, the data entered in the input mask is transmitted to us and part of the data is stored.
In this context, no data will be passed on to third parties outside the Company. The data will be used exclusively for processing the correspondence.
The legal basis for processing data transmitted in connection with sending an E-mail is Article 6 paragraph 1 sentence 1 lit. f) GDPR. If the aim of the E-mail contact is conclusion of a contract, Article 6 paragraph 1 sentence 1 lit. f) GDPR is a further legal basis for processing.
Processing the personal data from the input mask serves us to make contact and to prevent improper use of the contact form.
The data will be erased as soon as it is no longer necessary for achieving the purpose of collection. For the personal data from the input mask of the contact form and that sent by E-mail, this will be the case when the respective correspondence ends.
Users have the possibility to object to the processing of their personal data at any time. In such a case, the correspondence cannot be continued. Please send us your deletion request via E-mail to firstname.lastname@example.org. In this case, all personal data stored in the course of the contact will be deleted.
3. PROCESSING OF PERSONAL DATA FOR CUSTOMER SATISFACTION SURVEYS AND DIRECT MAREKTING
If you have given us your consent or if we are entitled to do so within the framework of existing customer relations, your contact data will also be used for the purposes of direct marketing (e.g. trade fair invitations, newsletters) or for conducting customer satisfaction surveys. You have the right to object to the use of your contact details for these purposes at any time. If you wish to exercise your right of objection in this respect, please write us an E-mail to email@example.com or follow the relevant instructions which you have received from us in any advertising mail. The legal basis for processing your data for advertising purposes is Article 6 paragraph 1 lit. f) GDPR in the case of existing customer relationships or Article 6 paragraph 1 lit. a) GDPR if you have given us your consent.
4. PROCESSING OF PERSONAL DATA OF BUSINESS PARTNERS
a. Data categories, purpose of processing and legal basis
Within the scope of cooperation with Business Partners, the Company processes personal data of contact persons at customers, suppliers, interested parties, sales partners and cooperation partners (hereinafter referred to as “Business Partners"):
- contact details such as first and last name, business address, business telephone number, business mobile number, business fax number and business E-mail address,
- payment information such as details required for processing payment transactions or preventing fraud, including credit card details and card verification numbers,
- other information, the processing of which is necessary within the framework of a contractual relationship and which is voluntarily provided by Business Partners, such as orders, inquiries or details of projects,
- we will also store your IP address and the date of your registration when you register for a customer account,
- personal data collected from publicly available sources, information databases or credit agencies, and
- as far as legally required in the context of compliance screenings: date of birth, identity card and ID numbers, information on relevant legal proceedings or other legal disputes involving Business Partners.
Personal data is also processed for the following purposes:
- Communication with Business Partners on products, services and projects, for example to process inquiries from the Business Partner or to provide technical information on products,
- Performance of contracts,
- Planning, execution and management of the contractual business relationship, for example to process orders for products and services, collect payments, for accounting and billing purposes and to carry out deliveries, maintenance activities or repairs,
- Processing of registration for a customer account,
- Management of a customer account for pre-contractual services, for the fulfilment of the contract or for the purpose of customer cultivation (e.g. in order to provide you with an overview of your previous orders with us or in order to be able to offer you the so-called memo function),
- Conducting customer surveys, marketing campaigns, market analyses, competitions, etc.,
- Maintenance and protection of the safety of our products and our websites, prevention and discovery of safety risks, fraudulent activities or other criminal offences or acts carried out with the intent to cause damages;
- Comparison of personal data with US sanctions lists based on the European regulations 2580/2001 and 881/2002,
- Compliance with (i) legal requirements (e.g. tax and commercial retention requirements), (ii) existing obligations to conduct compliance screenings (to prevent white-collar crime or money laundering), and (iii) policies and industry standards; and
- Settling legal disputes, enforcing existing agreements as well as asserting, exercising and defence against legal claims.
Processing personal data is necessary to achieve the aforementioned purposes. Unless expressly stated otherwise at the time of collection of personal data, the legal basis for data processing is
- the execution and performance of a contract with you or for carrying out pre-contractual measures under Article 6 paragraph 1 lit. b) GDPR,
- the fulfilment of legal obligations to which the undertaking is subject under Article 6 paragraph 1 lit. c) of the GDPR, or
- safeguarding legitimate interests under Article 6 paragraph 1 lit. f) GDPR. The legitimate interest lies in the initiation, implementation and handling of the business relationship in commercial transactions.
If you have expressly given your consent to processing your personal data in individual cases, this consent is the legal basis for processing in accordance with Article 6 paragraph 1 lit. a) GDPR.
5. PROCESSING OF PERSONAL DATA OF APPLICANTS
a. Categories of data and purpose of data processing
Within the framework of the application procedure, we process the following categories of personal data:
- personal data (first and last name, date of birth, address, school-leaving certificate)
- communication data (telephone number, mobile number, fax number, E-mail address)
- data on assessment and evaluation in the application procedure
- data on education (school, vocational training, civilian / military service, university education, doctorate)
- data on the previous professional career, training and work certificates
- information on other qualifications (e.g. language skills, PC skills, voluntary work)
- application photo
- details of the desired salary
- application history
- Social media links (link to Xing or LinkedIn profile, if data transfer from these profiles was selected)
Personal data that you provide us with in the context of your application will be stored and used exclusively for the purpose of processing your application and, if applicable, for the purpose of the subsequent employment.
b. Legal basis of data processing
The processing of your personal data in the context of the application procedure is based on Article 6 paragraph 1 lit. b) GDPR (establishment and execution of a contract) as well as Sec. 26 (1) sentence 1 German Data Protection Act (BDSG).
Any further processing of applicant data will take place only on the basis of an explicit declaration of consent. This is particularly the case if we are unable to offer you a current vacancy in the Company, but consider your application suitable for future positions. The storage and processing of your data in this respect will then be based on your consent in accordance with Article 6 paragraph 1 lit. a) GDPR).
The storage and processing of your data for forwarding to other companies of the group is also based on your consent in accordance Article 6 paragraph 1 lit. a) GDPR.
c. Transfer of data
Your data will be made available to the relevant members of the Human Resources Department and to the employees or managers of the department(s) responsible for the position for which you have applied.
In the case of an unsolicited application, your documents will be made available to the relevant members of the Human Resources Department and to the responsible employees or superiors of the relevant departments for whom your application might be of interest.
We will not forward your application data to affiliated subsidiaries or parent companies unless your application also relates to these companies or is kept open for this purpose. We also use contract processors (e.g. IT service providers). Your data will be passed on to them in strict compliance with the obligation of secrecy and the requirements of the GDPR. The processors commissioned by us may process the data only for us and not for their own purposes. Responsibility for data processing in these cases remains with us.
Data will also be passed on if we are obliged to do so by law and/or official or court orders.
d. Transfer of personal data to third countries
Our Company is part of a group of companies in which personnel responsibilities may extend beyond national borders. For this reason, responsible superiors in other countries may also have access to your application data. These data processing operations are necessary for the decision on the establishment of an employment relationship. In addition, data transfer to third countries also takes place when your data is included in the Talent Pool. This means that our affiliated foreign units also have access to your application data.
When data are transferred to a body in a third country, relevant guarantees for the protection of your personal data ensure that the data protection level of the European Union is observed.
e. Erasure periods for application data
If no employment is established, the application documents will be erased six months after a candidate has been turned down. The legal basis for storage in this respect is Article 6 paragraph 1 lit. f) GDPR. Our legal interest in this respect is the defence against any claims arising from the German General Equal Treatment Act (“AGG”). In all other respects, the general erasure periods and notes under Clause 8 apply.
6. SOCIAL MEDIA
We set references ("links") on our website to the social networks LinkedIn and xing in order to draw attention to our services and products and to contact you as a visitor and user of these social media sites as well as our website.
You can recognize the links by the logo of the respective social network. When you click on the logo, a direct connection is established between your browser and the server of the respective service and you are redirected to the website from the service provider.
In the following, you will learn how your data is processed on the respective social media presences.
We operate the following presences:
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
New Work SE, Am Strandkai 1, 20457 Hamburg, Deutschland
a. Data processing by us
We operate the social media presences to draw attention to our products, services and career opportunities and to communicate with users for this purpose and to achieve improvements.
The processing of personal data in this regard is generally based on Art. 6 (1) lit. f DS-GVO due to our legitimate interests in public relations, communication and product improvement unless otherwise stated.
It is possible for us to view your posts and similar interactions on our social media presences as well as - depending on your privacy settings - your public profile. We may use this data to improve our information and products, especially on our social media presences.
In the event that you contact us via our social media presences, we process the personal data you provide in this context in order to process your request, in particular to respond to inquiries. We may then answer your inquiry via the respective social media presence. The legal basis for the processing of personal data is in many cases Art. 6 (1) lit. b DS-GVO (contract performance or pre-contractual measures) or, if this legal basis is not relevant, Art. 6 (1) lit. f DS-GVO based on the legitimate interests resulting from the aforementioned purposes. If you contact us regarding career opportunities, we may process the data in accordance with Section 26 (1) BDSG (decision on the establishment of an employment relationship).
In addition, we may also process personal data in connection with the social media presences in accordance with the information in the other sections of the privacy notices.
As a precaution, we would like to point out that communication via the social media platforms may be insecure. You can always contact us via other communication channels and will receive a response via these other channels as well.
Furthermore, we receive aggregated usage statistics from the platforms, which we use to evaluate usage behavior and to improve our information offering. The usage statistics may also be created by the platforms on the basis of personal usage data. Further information on this can be found in the privacy notices of the respective providers linked above. Specific information on Facebook and Instagram can be found below.
b. Processing by the platform operators
c. Notes on the deletion of posts
If you publish personal data on our social media presences in the form of posts, such as images, texts, video, or interact in other ways, e.g. by clicking on a "thumbs up" button, your data will be processed and in many cases published. If this is inappropriate content, we may delete it in accordance with the usual procedures and policies of the respective platforms.
7. OTHER TOOLS
a. Google Maps
This website uses Google Maps to display interactive maps and to provide directions. Google Maps is a mapping service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, ("Google") (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)Google Inc, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. By using the Google Maps services, information about the use of this website, including your IP address and the (start) address entered as part of the route planner function, may be transmitted to Google in the USA. When you access our website, your browser establishes a direct connection with Google's servers. The map content is then transmitted directly to your browser and integrated by it into our website.
The integration of Google Maps is based on your consent (Art. 6 para. 1 lit. a DS-GVO in conjunction with Art. 7 DS-GVO). We obtain the necessary consent from our users immediately after they call up our website for the use of functional cookies through our cookie banner. If no consent is given in this way, we will ask again for consent on pages where Google Maps is integrated, which you can give there in each case. The consent obtained from you in this respect also relates to the transfer of your data to the USA (Art. 49 para. 1 lit. a DS-GVO).
Google may transfer personal data to countries outside the EU and the EEA without an adequacy decision, in particular to Google's parent company, on the basis of EU standard contractual clauses.
We have no influence on the further processing and use of the data by Google.
b. Adobe Typekit Web Fonts
Our online offer uses so-called web fonts from Adobe Typekit for the uniform display of certain fonts. The provider is Adobe Ireland ("Adobe") (parent company: Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA) (Adobe).
When you call up our pages, your browser loads the required fonts directly from Adobe in order to be able to display them correctly on your terminal device. In doing so, your browser establishes a connection to Adobe's servers in the USA. This enables Adobe to know that your IP address has been used to access our website. According to Adobe, no cookies are stored when the fonts are provided.
The use of Adobe Typekit Web Fonts is necessary to ensure a consistent typeface on our website. This constitutes a legitimate interest within the meaning of Art. 6 (1) lit. f DSGVO.
Adobe may transfer personal data to countries outside the EU and EEA without an adequacy decision, in particular to Adobe's parent company, based on EU standard contractual clauses or consent.
8. RECIPIENTS AND CATEGORIES OF RECIPIENTS
Within our Company, access to your data is granted to those bodies that need it to fulfil their contractual and legal obligations. Service providers and agents appointed by us may also receive the data for these purposes if they commit to protecting confidentiality and integrity. These are companies in the IT services, telecommunications and sales and marketing categories.
As far as passing on data to recipients outside our company is concerned, it must first be kept in mind that we will pass on only necessary personal data, observing all regulations on data protection. As a matter of principle, we may pass on information about you only if this is required by law, you have given your consent or we have otherwise been granted authority. Under these circumstances, recipients of personal data may, for example, be:
- public authorities and institutions (such as authorities prosecuting criminal acts) if based on a statutory or regulatory obligation,
- other group-affiliated companies for risk management purposes due to legal or regulatory obligations,
- service providers whom we involve in connection with contract data processing relationships.
In all other respects, the data transfers listed in the other sections apply.
9. TRANSFER TO THIRD COUNTRIES
Data transfer to bodies in states outside the European Union (so-called third countries) will take place to the extent
- this is required for performance of the contractual relationship (such as shipment orders),
- it is required by law (such as obligatory reporting under tax law), or
- you have given us your consent.
Furthermore, the transmission of data to third countries for the purpose of maintaining and ensuring the IT operation and IT security of the Company cannot be ruled out.
The use of our range of social media and map services may result in data transmissions and subsequent processing of usage data by the respective services in the U.S. The basis for any processing activities is your explicit declaration of consent which you have given via the cookie banner. Your declaration of consent justifies such data processing by way of exception and on a case-by-case basis pursuant to Article 49 paragraph 1 lit. a) GDPR. Please note that data protection which would be comparable to the level in the EU and EEA does not exist in the United States. In particular, it is possible that state authorities may access your personal data on the basis of legal authorisations without us or you being informed. There are no comparable opportunities for enforcing the law of another country in the U.S. so that this does not appear promising.
Possible data transmissions exclusively take place in automated form in connection with the use of our social media offerings and Google's map services and with the help of cookies.
In addition, in accordance with the statements in the other sections, personal data may be transferred to third countries by the companies to which we transfer personal data.
10. RETENTION PERIOD
We process and store your personal data as long as is necessary for the fulfilment of our contractual obligations and the exercise of our rights.
The revocation of any consent given previously will be stored for three years (accountability). The administrative cookie will be deleted 6 months after the last visit. Server log data is deleted or anonymised after seven days at the latest, unless further storage is required for evidentiary purposes. Data on newsletters and invitations will be deleted as soon as you unsubscribe.
In individual cases, longer storage of data for the purpose of providing evidence may be justified in legitimate individual cases. According to Secs. 195 et seqq. German Civil Code (BGB), this statute of limitations may be up to 30 years, the regular statute of limitations being 3 years.
11. DATA SECURITY
For reasons of security and to protect the transmission of confidential contents such as orders or inquiries that you send to us as the site operator, this website with our online offering has implemented SSL or TLS encryption. You will recognise an encoded connection by the change in the address line of the browser from “http://” to “https://” and the lock symbol in your browser line.
Our staff and the providers we have hired are committed to confidentiality and compliance with the provisions of the applicable data protection laws. The Company takes adequate technical and organisational security measures to protect your personal data against loss, modification, destruction, access by unauthorised persons or unlawful transfer. Our security measures are being improved on an ongoing basis in accordance with technological development.
12. RIGHTS OF DATA SUBJECTS
Every data subject has the right to information pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to limitation of processing pursuant to Article 18 GDPR, and the right to data portability pursuant to Article 20 GDPR.
As far as the right to obtain information and the right to erasure are concerned, the restrictions pursuant to Secs. 34 and 35 BDSG are applicable. Moreover, there is a right to appeal to a competent data protection supervisory authority (Article 77 GDPR in conjunction with Sec. 19 BDSG).
You can revoke your consent to the processing of personal data at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
You also have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you, in particular on the basis of Article 6 paragraph 1 lit. f) of the GDPR. If you do object, we will no longer process your personal data unless we have compelling justified reasons for such processing which override your interests, rights and freedoms. This will especially be the case where processing is required for asserting, exercising or defending legal rights.
In accordance with Article 22 GDPR, you also have the right not to be subject to fully automated decision-making. As a matter of principle, we do not use fully automated decision-making processes to establish, perform or terminate a business relationship. In the event that we should use such processes in individual cases (for example to improve our products and services), we will inform you of this and of your rights in this respect separately if prescribed by law.
For more information and explanations regarding the above rights, please visit the website "Rights for citizens“ of the European Commission.
13. OBLIGATION TO PROVIDE DATA
Within the scope of our online service, we rely on the processing of such usage data that is necessary for the implementation and termination of the service and for the fulfilment of the associated obligations. Without the collection of usage data, we and our service providers are not able to provide you with our online offering. However, the provision of personal data is neither legally nor contractually required.
We do not automatically process your personal data in such a way that it has a legal effect on you or significantly affects you in a similar manner.