Privacy statement

Your visit to our website www.gessmann.com and your interest in our company are very welcome.

We attach utmost importance to the protection of your personal data, e.g. date of birth, name, telephone number, address etc..

The purpose of this privacy statement is to inform you about the processing of your personal data we collect from you when you visit our website. Our data protection policy is in accordance with the statutory provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). The following data protection declaration is intended to meet the information obligations arising from the GDPR. For example, these can be found in Art 13 and Art 14 et seqq. GDPR.

Person responsible

The person responsible within the meaning of Art. 4 No. 7 GDPR is the person, who decides individually or jointly with others on the purposes and means of the processing of personal data.

Regarding our website the person responsible is:

1. Gessmann Gesellschaft mit beschränkter Haftung
   Eppinger Straße 221
   74211 Leingarten
   Germany
   e-mail: sales@gessmann.com
   tel.: +49 (0) 7131 / 4067 – 0
   Fax: +49 (0) 7131 / 4067 – 10

Contact details of the data protection officer

We have appointed a data protection officer in accordance with Art. 37 GDPR. Our data protection officer can be reached as follows:

Michael Wengert
Eppinger Straße 221
74211 Leingarten
Germany
e-mail: datenschutz@gessmann.com
tel.: 071314067317
website: https://www.gessmann.com/

Provision of the website and creation of log files

Whenever you access our website, our system automatically collects data and information about the device you are accessing the website with (e.g. computer, mobile phone, tablet, etc.).

Which personal data is collected and to what extent is it processed?

(1) Information about the browser type and the version used;
(2) the operating system of the retrieval device;
(3) host name of the computer used for access;
(4) the IP address of the retrieval device;
(5) date and time of access;
(6) websites and resources (images, files, other page content) accessed from our website;
(7) websites from which the user’s system accessed our website (referrer tracking);
(8) notification if the retrieval was successful;
(9) amount of data transmitted

This data is stored in the log files of our system. This data is not stored together with the personal data of a specific user, so that individual website visitors cannot be identified.

Legal basis for the processing of personal data

Art. 6 (1) lit. f GDPR (legitimate interest). It is our legitimate interest to ensure that the following purpose is achieved.

Purpose of data processing

The provisional (automated) storage of the data is required for the course of a website visit to enable the delivery of the website. The storage and processing of personal data is also done to keep our website interoperable for as many visitors as possible and to prevent misuse and troubleshooting. For this purpose, it is necessary to keep a log of the technical data of the computer accessing the website in order to be able to react as early as possible to display errors, attacks on our IT systems and/or errors affecting the functionality of our website. The data also serves to optimise the website and generally ensure the security of our information technology systems.

Duration of storage

The deletion of the above-mentioned technical data takes place once it is no longer needed to ensure the interoperability of the website for all visitors, but no later than 3 months after our website is accessed.

Right of objection and cancellation

At any time you may object to the processing in accordance with Art. 21 GDPR and request the deletion of data in accordance with Art. 17 GDPR. The rights to which you are entitled and how you assert them can be found at the bottom of this privacy statement.

Special functions of the website

Our website offers several functions, the use of which involves the collection, processing and storage of personal data. In the following it will be explained what will happen with this data:

Application form

·       Which personal data is collected and to what extent is it processed?

Data you enter in the application form and, if applicable, have uploaded will be processed to serve the purposes below.

·       Legal basis for the processing of personal data

Art. 6 para. 1 lit. b GDPR (implementation of (pre)contractual measures)

·       Purpose of data processing

Verifying and processing the application documents you uploaded via the form.

·       Duration of storage

The data will be deleted as soon as the application has been processed and there is no longer a legitimate interest in storing the application data. For this reason, your application documents will be deleted after a period of 6 months at the latest, if no employment relationship is established.

·       Right of objection and cancellation

At any time you may object to the processing in accordance with Art. 21 GDPR and request the deletion of data in accordance with Art. 17 GDPR. The rights to which you are entitled and how you assert them can be found at the bottom of this privacy statement.

·       Necessity of providing personal data

The information provided in the application form is neither contractually nor legally required, but it is necessary for sending and processing the application. If you do not or not fully fill out the required fields, the application you have requested cannot be sent or processed.

Contact form(s)

·       Which personal data is collected and to what extent is it processed?

The data entered in our contact forms, which you have entered in the input field of the contact form.

·       Legal basis for the processing of personal data

Art. 6 (1) lit. a GDPR (consent by explicit confirmatory act or conduct)

·       Purpose of data processing

The data collected through our contact form or through our contact forms will only be used for processing the specific contact request received through the contact form. In order to satisfy your contact request, please note that we may also send you e-mails to the address provided. The purpose of this is to enable you to receive confirmation from us that your request has been correctly forwarded to us. However, the sending of this confirmation e-mail is not binding for us and is for your information only.

·       Duration of storage

After your request has been processed, the collected data will be deleted without delay, unless there are legal retention periods.

·       Right of revocation and deletion

The revocation and deletion rights are based on the general provisions on the right of revocation and deletion under data protection law as set out in the following privacy statement.

·       Necessity of providing personal data

The use of the contact forms occurs on a voluntary basis and is neither contractually nor legally prescribed. There is no obligation to contact us via the contact form, but you may also use the other contact options provided on our website. If you want to use our contact form, you must fill in the mandatory fields. In case you do not provide information for the necessary fields on the contact form, you can either not send the request or we cannot process your request.

Statistical analysis of visits to this website – Webtracker

We collect, process and store the following data when this website or individual files of the website are accessed: IP address, website from where the file was accessed, name of the file, date and time of access, data volume transferred and message about the success of the access (so-called web log). This data is used exclusively in a non-personalised form to continuously improve our Internet offer and for statistical purposes. We use the following web trackers to evaluate visits to this website:

·       Google-Analytics

o   Scope of personal data processing

We use the web-tracking service of the company Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as Google-Analytics). Google Analytics uses cookies for web-tracking purposes. These cookies are saved on your computer and allow an analysis of the website usage and your surfing behaviour (so-called tracking). We do this analysis by using the tracking service of Google-Analytics, in order to optimise our Internet offer continuously and to make it better available. When using our website, data such as your IP address and your user activities are sent to Google Ireland Limited’s servers. We do this analysis by using the tracking service of Google in order to optimise our Internet offer continuously and to improve the availability. We also rely on web-tracking for security reasons. Web-tracking helps us to track whether third parties are targeting our website. The information allows us to take effective action and protect the personal data, which we process, from such cyber-attacks. Your IP address will be made anonymous by Google Analytics before sending the data by activating IP anonymisation as part of the Google Analytics tracking code for this website. This website uses Google Analytics tracking code, which has been extended by the operator gat._anonymizeIp() in order to allow only anonymous collection of IP addresses (so-called IP masking).

o   Legal basis for the processing of personal data

In accordance with Art. 6 (1) lit. a GDPR, the legal basis for data processing is your consent given in our information banner about the use of cookies and web-tracking (consent through unambiguous confirming action or behaviour).

o   Purpose of data processing

Google will use this information on our behalf to analyse your visit to this website, to compile reports on website traffic and to provide us with further services related to website and internet usage. We also rely on web-tracking for security reasons. Web-tracking helps us to track whether third parties are targeting our website. The information allows us to take effective action and protect the personal data, which we process, from such cyber-attacks.

o   Duration of storage

Google stores the data required for the provision of web-tracking for as long as it is necessary to provide the requested web service. The data collection and storage is anonymous. Insofar as there is a reference to a specific person, the data will be immediately deleted, if no legal storage obligations apply. Deletion will occur in any case after expiry of the obligation to retain data.

o   Right of objection and deletion possibilities

To prevent the collection and forwarding of personal data to Google (in particular your IP address) and the processing of this data by Google, it is possible to deactivate the script code execution in your browser or activate the “Do Not Track” setting of your browser. In addition, you can also prevent the collection of data generated by the Google cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link http://tools.google.com/dlpage/gaoptout?hl=de. You can find Google’s security and privacy policy at https://policies.google.com/privacy?hl=de.

 

Integration of external web services and data processing outside the EU

We use active contents from external providers (‘web services’) on our website. When you access our website, these external providers may receive personal information about your visit to our website. Data may be processed outside the EU in this regard. You can prevent this from happening by installing an appropriate browser plugin or by disabling the execution of scripts in your browser. This can lead to functional restrictions on websites you visit.

We use the following external web services:

• Amazon

A web service provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, United States of America (hereinafter referred to as ‘Amazon’) is downloaded on our website. We use this data to guarantee the full functionality of our website. Your browser may transfer personal data to Amazon in this regard. The legal basis for data processing is Art. 6 (1) f of the GDPR. The legitimate interest lies in the error-free operation of our website. The standard contractual clauses concluded between us and Amazon Web Services, Inc., form the legal basis for transfer to a third country where an adequacy decision has not been adopted. According to Art. 46 of the GDPR, this constitutes a suitable guarantee under the GDPR. The data is deleted as soon as the purpose of its collection has been fulfilled. You will find further information about how the transferred data is handled in Amazon’s privacy policy: https://www.amazon.de/-/en/gp/help/customer/display.html?ie=UTF8&nodeId=201909010&ref_=footer_privacy

You can prevent Amazon from collecting and processing your data by disabling the execution of script codes in your browser or by installing a script blocker.

• Amazon AWS

A web service provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, United States of America (hereinafter referred to as ‘Amazon AWS’) is downloaded on our website. We use this data to guarantee the full functionality of our website. Your browser may transfer personal data to Amazon AWS in this regard. The legal basis for data processing is Art. 6 (1) f of the GDPR. The legitimate interest lies in the error-free operation of our website. The standard contractual clauses concluded between us and Amazon Web Services, Inc., form the legal basis for transfer to a third country where an adequacy decision has not been adopted. According to Art. 46 of the GDPR, this constitutes a suitable guarantee under the GDPR. The data is deleted as soon as the purpose of its collection has been fulfilled. You will find further information about how the transferred data is handled in Amazon AWS’s privacy policy: https://aws.amazon.com/privacy/?nc1=h_ls

You can prevent Amazon AWS from collecting and processing your data by disabling the execution of script codes in your browser or by installing a script blocker.

• website-check.de

A web service provided by Website-Check GmbH, Beethovenstrasse 24, 66111 Saarbrücken, Germany (hereinafter referred to as ‘website-check.de’) is downloaded on our website. We use this data to guarantee the full functionality of our website. Your browser may transfer personal data to website-check.de in this regard. The legal basis for data processing is Art. 6 (1) f of the GDPR. The legitimate interest lies in the error-free operation of our website. The data is deleted as soon as the purpose of its collection has been fulfilled. You will find further information about how the transferred data is handled in the website-check.de privacy policy: https://www.website-check.de/datenschutzerklaerung/

You can prevent website-check.de from collecting and processing your data by disabling the execution of script codes in your browser or by installing a script blocker in your browser.

• EasyHR

A web service provided by Fravis GmbH, Sonnenhalde 10, 73489 Jagstzell, Germany (hereinafter referred to as ‘EasyHR’) is downloaded on our website. We use this data to guarantee the full functionality of our website. Your browser may transfer personal data to EasyHR in this regard. The legal basis for data processing is Art. 6 (1) f of the GDPR. The legitimate interest lies in the error-free operation of our website. The data is deleted as soon as the purpose of its collection has been fulfilled. You will find further information about how the transferred data is handled in EasyHR’s privacy policy: https://www.easyhr.de/

You can prevent EasyHR from collecting and processing your data by disabling the execution of script codes in your browser or by installing a script blocker in your browser.

Information about the use of cookies

Extent of personal data processing

We integrate and use cookies on various pages to enable certain website functions and to integrate external web services. The ‘cookies’ are small text files that your browser can save on your access device. These text files contain a characteristic character string that uniquely identifies the browser when you return to our website. The process of saving a cookie file is also referred to as ‘setting a cookie’. Cookies can be set both by the website itself and by external web services.

Legal basis for personal data processing

Art. 6 (1) f of the GDPR (legitimate interest) or Art. 6 (1) a or Art. 9 (2) a of the GDPR (consent).

The legal basis for this can be found in the cookie table listed further on in this section.

Generally speaking, in the case of cookies that are set based on a legitimate interest, our legitimate interest is to ensure the functionality of our website and the integrated services (technically necessary cookies). The cookies may also increase our website’s user-friendliness and permit further customisation. In this respect, we have weighed up your interests against ours.

With the help of cookie technology, we can only identify, analyse and track individual website visitors if the website visitor has consented to the use of cookies according to Art. 6 (1) a of the GDPR.

Purpose of data processing

The cookies are set by our website or external web services to maintain the full functionality of our website, to improve user-friendliness or to pursue the purpose stated with your consent. Cookie technology also allows us to recognise individual visitors by using pseudonyms, such as an individual or random ID, so that we can offer more personalised services. Details are provided in the table below.

Duration of storage

The cookies listed below are stored in your browser until they are deleted or, in the case of a session cookie, until the session has expired. Details are provided in the table below:

Cookie name	Server	Provider	Purpose	Legal basis	Duration of storage	Type
_gid	gessmann.com	Google Analytics	This cookie assigns an ID to a user so that the web tracker can summarise the user’s actions under this ID.	Consent	Approx. 24 hours	Analytics
_ga	gessmann.com	Google Analytics	This cookie assigns an ID to a user so that the web tracker can summarise the user’s actions under this ID.	Consent	Approx. 24 months	Analytics
_gat	gessmann.com	Google Analytics	This cookie is used to throttle the web tracker’s request rate.	Consent	Approx. 90 seconds	Configuration
borlabs-cookie	www.gessmann.com	Website operator	Cookie that stores the user’s decision about the cookie banner.	Technically necessary	Approx. 12 months	Cookie banner

Opportunity for objection, revocation of consent and erasure

If you so desire, you can adjust your browser settings to categorically prevent the setting of cookies. You can then decide whether to accept cookies on a case-by-case basis or to categorically accept cookies. Cookies can be used for different purposes, e.g. to identify that your access device has already connected to our website (permanent cookies) or to save your most recently viewed websites (session cookies). If you have expressly given us permission to process your personal data, you can revoke this consent at any time. Please note that this does not affect the lawfulness of processing carried out based on such consent up until the same is revoked.

Data security and data protection, communication by email

When it is collected, saved and processed, your personal data is protected by means of technical and organisational measures to ensure that it is inaccessible to third parties. Since we cannot guarantee complete data security on the transmission path to our IT systems during unencrypted communication by email, we advise sending highly confidential information using encrypted communication or by post.

Right of access and rectification requests – Erasure and restriction of data – Revocation of consent – Right to object

Right of access

You have the right to request confirmation as to whether we process your personal data. If we do, you have a right of access to the information specified in Art. 15 (1) of the GDPR, provided that the rights and freedoms of others are not adversely affected (cf. Art. 15 (4) of the GDPR). We are also happy to provide you with a copy of the data.

Right to rectification

According to Art. 16 of the GDPR, you have the right to have incorrectly stored personal data (such as your address, name, etc.) corrected by us at any time. You can also request that the data we store be completed at any time. Adjustment to this effect shall be performed without delay.

Right to erasure

According to Art. 17 (1) of the GDPR, you have the right to request that we delete the personal data collected about you if

• the data is either no longer needed;
• the legal basis of processing is no longer applicable due to you revoking your consent;
• you have objected to processing and there are no legitimate grounds for processing;
• your data is being processed unlawfully;
• a legal obligation requires this or collection according to Art. 8 (1) of the GDPR has taken place.

According to Art. 17 (3) of the GDPR, the right does not exist if

• processing is necessary to exercise the right to freedom of expression and information;
• your data was collected based on a legal obligation;
• processing is necessary for reasons of public interest;
• the data is necessary to establish, exercise or defend legal claims.

Right to restriction of processing

According to Art. 18 (1) of the GDPR, you have the right to request on a case-by-case basis that processing of your personal data be restricted.

This applies if

• you dispute the correctness of the personal data;
• processing is unlawful and you do not consent to erasure of the data;
• the data is no longer required for the purpose for which it is being processed, but the data collected is being used to assert, exercise or defend legal claims;
• an objection has been made against processing according to Art. 21 (1) of the GDPR and it is still unclear which interests take precedence.

Right of revocation

If you have given us express permission to process your personal data (Art. 6 (1) a of the GDPR or Art. 9 (2) a of the GDPR), you can revoke this consent at any time. Please note that revocation of consent does not affect the lawfulness of processing carried out based on such consent up until the same is revoked.

Right to objection

According to Art. 21 of the GDPR, you have the right to object at any time to the processing of personal data concerning you that has been collected based on Art. 6 (1) f (in the context of a legitimate interest). You are only entitled to this right if special circumstances preclude storage and processing.

How do I exercise my rights?

You can exercise your rights at any time by using the contact details provided below:

1. Gessmann GmbH
   Eppinger Strasse 221
   74211 Leingarten
   Germany
   Email: sales@gessmann.com
   Tel.: +49 7131 4067 722
   Fax: +49 7131 4067 10

Right to data portability

According to Art. 20 of the GDPR, you are entitled to have personal data concerning you transferred. We provide the data in a structured, commonly used and machine-readable format. The data can be sent either to yourself or to a controller named by you.

We shall provide you with the following data on request according to Art. 20 (1) of the GDPR:

• Data collected based on express consent according to Art. 6 (1) a of the GDPR or Art. 9 (2) a of the GDPR;
• Data that we have received from you according to Art. 6 (1) b of the GDPR in the context of existing contracts;
• Data processed in the context of an automated procedure.

We shall transfer the personal data directly to a controller of your choosing insofar as doing so is technically feasible. Please note that we are not allowed to transfer data that interferes with the rights and freedoms of others according to Art. 20 (4) of the GDPR.

Right to lodge a complaint with the supervisory authority according to Art. 77 (1) of the GDPR

If you suspect that your data is being processed unlawfully on our website, you can naturally obtain judicial clarification of the issue at any time. Every other legal option is open to you too. Regardless of this, you have the option of contacting a supervisory authority according to Art. 77 (1) of the GDPR. You have a right to lodge a complaint according to Art. 77 of the GDPR in the EU member state of your place of residence, your workplace and/or the place of the suspected violation, i.e. you can choose the supervisory authority you wish to contact from the aforementioned locations. The supervisory authority with whom the complaint was lodged then informs you of the status and results of your petition, including the possibility of a judicial remedy according to Art. 78 of the GDPR.

Created by:

© IT law firm DURY – www.dury.de

© Website-Check GmbH – www.website-check.de