Data protection

I. Name and address of the controller:

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the EU Member States as well as other data protection regulations is:

rehm Datenschutz GmbH
Eugen-Sänger-Ring 13
85649 Brunnthal
Deutschland

Phone.: +49 89 6080 7600
email: kontakt@rehm-datenschutz.de
Website: www.rehm-datenschutz.de

Data protection officer's contact details

The data protection officer responsible for compliance with the General Data Protection Regulation and supplementary data protection regulations can be reached at:  


E-Mail: datenschutzbeauftragter@rehm-datenschutz.de
Tel.: +49 89 6080 7600

III. Provision of information for customers and service providers of rehm Datenschutz GmbH

Information on the collection of your personal data in accordance with Art.13 General Data Protection Regulation (GDPR):

(1) General information

a) Purpose and legal basis of the data processing

Purposes:

1. project handling
2. invoicing
3. communication
4. advertising (e.g. references to future lectures, seminars and events)
5. archiving

corresponding legal basis:

Regarding 1. art. 6 para. 1 lit. b GDPR
Regarding 2. art. 6 para. 1 lit. b GDPR
Regarding 3. art. 6 para. 1 lit. b GDPR/ art. 6 para. 1 lit. f GDPR
Regarding 4. art. 6 para. 1 lit. f GDPR
Regarding 5. § 257 HGB, § 147 AO

 

b) If processing is based on legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR:

In this case, this concerns legitimate interests within the framework of the efficient handling of projects as well as information relevant to the persons concerned on further training opportunities or other specialist information in data protection.

c) Recipients or categories of recipients (including categories of order processors), have been or will be disclosed:

1. management (internal)
2. sales (internal)
3. consulting (internal)
4. accounting (internal)

d) Transfer of data to third countries:
The personal data will not be transferred to a third country:

(2) Further Information

The personal data are stored until the end of the project, or at the end of the legally prescribed retention periods.
We will inform you about your rights as a data subject here.

The provision of the personal data is required by law or for the conclusion of a contract.

(3) change of purpose

We do not intend to process personal data for any purpose other than that for which it was collected.

IV. Provision of information for interested parties of rehm Datenschutz GmbH

Information on the collection of your personal data pursuant to Art. 13 of the General Data (GDPR):

(1) General information

a) Purpose and legal basis of the data processing

Purposes:

1. offer preparation
2. communication by mail or telephone

corresponding legal bases:

Regarding 1. art. 6 para. 1 lit. b GDPR
Regarding 2. art. 6 para. 1 lit. b GDPR/ art. 6 para. 1 lit. f GDPR

b) If processing is based on legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR:

In this case, this concerns legitimate interests within the framework of the efficient handling of projects as well as information relevant to the persons concerned on further training opportunities or other specialist information in data protection.

c) Recipients or categories of recipients (including categories of order processors), have been or will be disclosed:

1. management (internal)
2. sales (internal)
3. consulting (internal)

d) Transfer of data to third countries:
The personal data will not be transferred to a third country:

(2) Further Information

The personal data are stored until the end of the project, or at the end of the legally prescribed retention periods.
We will inform you about your rights as a data subject here.

The provision of the personal data is required by law or for the conclusion of a contract.

There is no automated decision making including profiling.

(3) change of purpose

We do not intend to process personal data for any purpose other than that for which it was collected.

V. Provision of information duties for applicants of rehm Datenschutz GmbH

1. Extent to which personal data is processed

As a matter of principle, we only process personal data from our applicants to the extent that this is necessary for the decision to establish an employment relationship with us.

Access to your application data is only granted to employees who are entitled to make decisions. We ask you to send us your application documents as an encrypted, password-protected .zip file and to include a telephone number in your e-mail which we can call in order to obtain your password for the encrypted application documents.

2. Legal basis for the processing of personal data

The processing of your application data serves the purpose of deciding on the establishment of an employment relationship.
The legal basis for the processing of personal data within the framework of pre-contractual measures for an employment contract is Art. 6 para. 1 lit. b GDPR in conjunction with § 26 BDSG - german Data Protection act..

3. Data deletion and storage duration

Your personal application data will be deleted - regardless of the outcome of your application - six months after a decision has been made on the filling of the position.
After a possible rejection of your application, you have the possibility to agree to a storage period beyond the period of deletion mentioned below. The legal basis for processing beyond the above-mentioned deletion period is Art. 6 para. 1 lit. a GDPR. In this case, you may revoke your consent at any time. The data will then be deleted accordingly.

VI. General information about data processing

1. Extent to which personal data is processed

We process the personal data of our users only to the extent necessary to provide a functioning website as well as our content and services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies in those cases in which it is not possible to obtain prior consent for actual reasons and the processing of the data is permitted by legal regulations.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the person concerned for the processing of personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis.
Art. 6 para. 1 lit. b GDPR serves as a legal basis for the processing of personal data required for the fulfilment of a contract to which you as the data subject are a party. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
Art. 6 para. 1 lit. d GDPR serves as a legal basis in the event that vital interests of the data subject or another natural person necessitate the processing of personal data.
If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.

3. data deletion and storage duration

Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies. We may also store your personal data if the European or national legislator has provided for this in EU ordinances, laws or other regulations to which we are subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless it is necessary for further storage of the data for the conclusion of a contract or fulfilment of a contract.

VII. Provision of the website and creation of log files

1. Description and scope of the data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected in this regard:
(1) Browser type and browser version
(2) Operating system used
(3) Internet service provider of the user
(4) IP adress
(5) Time of the server request
(6) Websites from which the user´s system accesses our website
(7) Websites accessed by the user´s system through our website

This data is also stored in our system´s log files. This data is not stored together with the user´s other personal data.

2. Legal basis for data processing

If IP addresses are stored in log files:
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

3. Purpose of the data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. To achieve this, the user's IP address must be stored for the duration of the session.  

Data is stored in log files to ensure the functionality of the website. In addition, the data is used to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.  

These purposes also include our legitimate interest in data processing pursuant to Art. 6 para. 1 lit f GDPR.

4. Duration of storage

The data will be erased as soon as it is no longer necessary for the purpose of its collection. In the case of collecting the data for providing the website, this is the case when the respective session is completed.  

If the data is stored in log files, this is the case after seven days at most.

5. Means of objection and termination

The collection of data for providing the website and the storage of data in log files is absolutely imperative for operating the website. Users therefore do not have any possibility to object.  

VIII. Cookies

Within the framework of rehm's data protection website, only technically absolutely necessary cookies ("strictly necessary" cookies) are used. These cookies guarantee functions without which this website cannot be used as intended. Specifically, this is the cookie csrf_contao-crsf-token Cookie. It is a so-called functional cookie. The cookie is the exclusive responsibility of rehm Datenschutz GmbH (= First Party Cookie).
The purpose of the cookie is to identify the user during his visit to the website (session duration), among other things for the transmission of form contents (contact, event) and remains active until the end of the session.

Background:
There are scripts circulating on the net, which are used to send spam messages to the website operator (in this case rehm Datenschutz GmbH). The easiest way to do this is via the contact form. Such scripts automatically fill out all input fields, including any links to shop pages etc. and send the form. The cookie mentioned earlier should prevent exactly that.

Because the visitor was previously on the page with the form, he now received this cookie. And in this cookie there is a text created by a random generator. The random text also lands "hidden" in the form and is sent to the server on which the rehm privacy page is located when the form is sent.

In the last step, the cookie is read by a script of the Content Management System and the random text set there is compared with the transmitted text. Only if both match, an email will be sent, because it is very likely to be a "real" website visitor.

IX. Contact form and email contact

1. Description and scope of the data processing

A contact form is available on our website, which can be used for electronic contact. If a user makes use of this possibility, the data entered in the input mask will be transmitted to us and stored. These data are:

Salutation *, first name, surname *, function, company/authority, street, house number, postcode, city, e-mail *, telephone, your message
In order to be able to transfer the data, it must also be confirmed that the privacy policy has been acknowledged (checkbox *).

The fields marked with * are mandatory.

The entered data will be sent by e-mail. This e-mail also contains the date and time.

Alternatively, you can contact us via the e-mail address provided. In this case, the personal data of the user transmitted with the e-mail will be stored.

The data will not be passed on to third parties in this context. The data will only be used for the processing of the conversation.

2. Legal basis for the data processing

Art. 6 para. 1 lit. f GDPR is the legal basis for the processing of data transmitted in the course of sending an e-mail or using the contact form. If the purpose of the e-mail contact is to conclude a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

3. Purpose of the data processing

The processing of the personal data from the input mask serves us exclusively for the processing of the establishment of contact. If you contact us by e-mail, this is also the necessary legitimate interest in the processing of the data.

4. Duration of storage

The data will be erased as soon as it is no longer necessary for the purpose of its collection. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.

5. Means of objection and termination

Users can terminate the contractual or pre-contractual relationships at any time. If users contact us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued and your personal data will be deleted by us.

You can send your revocation by stating your full name and e-mail address to the above postal or e-mail address.

X. Registration/Reservation for Events

1. Description and scope of the data processing

For some events there is the possibility of registration or reservation via a form. The following data will be processed there:

First name, last name, e-mail*, company name, other participants (fields marked with * are mandatory)

In order to be able to transfer the data, it must also be confirmed that the privacy policy has been acknowledged (checkbox *).

For some events, we ask for necessary data on participation in catering or additional events to be booked.

2. Legal basis for the data processing

The legal basis for the processing of data transmitted in the course of an order / reservation is Art. 6 Para. 1 lit. b GDPR.

3. Purpose of the data processing

This collection of personal data is carried out exclusively for the purpose of planning and carrying out the respective event.

4. Duration of storage

These data will be deleted at the end of the respective event! If the event is subject to a fee, the required data will be stored in the accounting area within the limits of the legally required archiving.

5. Means of objection and termination

As a user, you have the possibility to revoke your consent to the processing of personal data at any time. If you have contacted us by e-mail, you can object to the storage of your personal data at any time. In such a case the registration / reservation cannot be continued and your personal data will be deleted by us.

You can send your revocation by stating your full name and e-mail address to the above postal or e-mail address.

 

XI. Rights of the data subject

If personal data is processed by you, you are the data subject within the meaning of the GDPR and you have the following rights in relation to us:

1. Right to be informed

You may request confirmation from us as to whether personal data relating to you will be processed by us.
In the event of such processing, you may request the following information from us:
(1) the purposes for which the personal data will be processed;
(2) the categories of personal data processed;
(3) the recipients or categories of recipients to whom the personal data relating to you has been or will be disclosed;
(4) the planned duration of the storage of the personal data relating to you or, if it is not possible to provide specific information in this regard, criteria for determining the duration of the storage;
(5) the existence of a right to have your personal data corrected or deleted, a right to limit our processing or a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) all available information about the origin of the data, if the personal data are not collected from the data subject;
(8) the existence of automated decision-making including profiling in accordance with Art. 22 Para. 1 and 4 GDPR and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.
You have the right to request information as to whether the personal data concerning you will be transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 DG in connection with the transfer.

2. Right of rectification

You have a right of rectification and/or integration with us if the personal data processed concerning you is inaccurate or incomplete. We will have to carry out the rectification immediately.

3. Right to restriction of processing

You may request the restriction of the processing of your personal data relating to you under the following conditions:

(1)You contest the accuracy of the personal data relating to you, for a period enabling the controller to verify the accuracy of the personal data;
(2)The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3)The controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
(4)You have objected to processing pursuant to Article 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your reasons.

If the processing of personal data relating to you has been restricted, this data – with the exception of storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

If the processing restriction has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction will be removed.

4. Right to erasure

a) Erasure obligation

You can demand that the controller deletes your personal data relating to you without undue delay, and the controller shall have the obligation to erase this data without undue delay where one of the following grounds applies: 

(1)The personal data relating to you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2)You withdraw consent on which the processing is based according to point (a) of Article 6 (1), or point (a) of Article 9 (2) GDPR, and there is no other legal ground for the processing.
(3)You object to the processing pursuant to Article 21 (1) GDPR, and there are no overriding legitimate grounds for processing, or you object to the processing pursuant to Article 21 (2) GDPR.
(4)The personal data relating to you have been processed unlawfully.
(5)The erasure of the personal data relating to you is required to fulfil a legal obligation under Union or Member State law, to which the controller is subject.
(6)The personal data relating to you have been collected in relation to the offer of information society services referred to in Article 8 (1) GDPR.

b) Information to third parties

Where the controller has made the personal data public and is obligated to erase the personal data pursuant to Article 17 (1) GDPR, the controller, taking available technology and the cost of implementation into account, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.  

c) Exceptions

The right to erasure does not apply to the extent that the processing is necessary.

(1)for exercising the right of freedom of expression and information;
(2)for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in exercising official authority vested in the controller;
(3)for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9 (2) as well as Article 9 (3) GDPR;
(4)for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) of the GDPR, in so far as the law referred to in subparagraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
(5)for the establishment, exercise or defence of legal claims.

5. Right to be informed

If you have exercised your right to obtain from the controller the rectification, erasure or restriction of processing, it is obliged to notify all recipients to whom your personal data have been disclosed about the rectification or erasure of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort. 

You have the right to be informed by the controller about these recipients. 

6. Right to object

You have the right at any time, for reasons that arise from your particular situation, to object to the processing of personal data concerning you which is based on point (e) or (f) of Article 6 (1) GDPR, including profiling based on those provisions. The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. 

7. Right to revoke your declaration of consent concerning data privacy

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of your consent does not affect the legality of the processing carried out on the basis of your consent until you revoke it.

8. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority, in particular in the Member State of your residence, place of work or place of alleged infringement, if you believe that the processing of the personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy in accordance with Article 78 of the GDPR.

The responsible supervisory authority is the Bavarian State Office for Data Protection Supervision.