Privacy Policy - Information on the processing of personal data

This document informs you about how we process personal data.

Introduction and structure of the document

We, the company GEMOTEG GmbH + Co. KG (hereinafter "the company", "we" or "us"), thank you for visiting our website and your interest in our company and our services. Your personal data will only be processed in accordance with the provisions of German and European data protection law. Data protection law obliges us, as the body responsible for data processing, to ensure the protection of your personal data through a variety of measures. One of these obligations is to inform you transparently about the type, scope, purpose, duration and legal basis of data processing (cf. Art. 13 and 14 EU GDPR). As the person affected by the data processing, we will also address you below as "customer", "user", "you", "you" or "data subject". In this data protection declaration we inform you about the way in which your personal data is processed by us. Our privacy policy has a modular structure. It consists of a general part for any processing of personal data and processing situations that come into play and a special part, the content of which only relates to the processing situation specified there. It is possible that we use this online document to also inform you about processing operations that do not primarily take place on the website. You can find these in the special part of the document. If you want to navigate quickly in the document, many browsers offer a search function using the "CTRL key+f" key combination.

definitions

Based on the model of Art. 4 EU-DSGVO, this document is based on the following definitions:
"Personal data" (Art. 4 No. 1 EU-DSGVO) is all information that relates to an identified or identifiable natural person ("data subject"). A person can be identified if they can be identified directly or indirectly, in particular by means of assignment to an identifier such as a name, an identification number, an online identifier, location data or using information about their physical, physiological, genetic, psychological, economic, cultural or social identity characteristics can be identified. The identifiability can also be provided by linking such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photos, video or sound recordings can also contain personal data).

"Processing" (Art. 4 No. 2 EU-DSGVO) is any process in which personal data is handled, whether with or without the help of automated (i.e. technology-supported) processes. In particular, this includes collecting (ie acquiring), recording, organizing, arranging, storing, adapting or changing, reading out, querying, using, disclosing through transmission, distribution or other provision, comparison , the linking, the restriction, the deletion or the destruction of personal data, as well as the change of an aim or purpose, which was originally based on data processing.

"Responsible" (Art. 4 No. 7 EU-DSGVO) is the natural or legal person, authority, institution or other body that alone or together with others decides on the purposes and means of processing personal data. "Third party" (Art. 4 No. 10 EU-GDPR) is any natural or legal person, authority, institution or other body other than the data subject, the person responsible, the processor and the persons who are under the direct responsibility of the person responsible or the processor authorized are to process the personal data.

"Order processor" (Art. 4 No. 8 EU-DSGVO) is a natural or legal person, authority, institution or other body that processes personal data on behalf of the person responsible, in particular in accordance with his instructions (e.g. IT Service provider). In terms of data protection law, a processor is in particular not a third party.

"Consent" (Art. 4 No. 11 EU-DSGVO) of the data subject means any voluntary, informed and unequivocal expression of will in the form of a declaration or other clear confirmatory action with which the data subject understands indicates that she consents to the processing of her personal data.

Name and address of the person responsible for processing

The responsible body for the processing of your personal data within the meaning of Art. 4 No. 7 EU-DSGVO, as well as contact details and further information about our company can be found in the imprint information on our website.

Contact details of the data protection officer

Our data protection team, consisting of data protection coordinators and our data protection officer, is available to you at any time for all questions and as a contact person on the subject of data protection.

You can reach the data protection team:

- By post to our address given in the imprint with the addition "Data Protection Team"

- By e-mail at datenschutz@gemoteg.de

Your rights

You can assert your rights as a data subject with regard to your processed personal data at any time using the contact details given above. You make the request easier for us if you contact the data protection team directly. As a data subject, you have the right:

- to request information about your data processed by us in accordance with Art. 15 EU-DSGVO. In particular, you can obtain information about the processing purposes, the category of data, the categories of recipients to whom your data was or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or objection, the existence of a right of appeal , the origin of their data, if they were not collected from us, as well as the existence of automated decision-making including profiling and, if necessary, meaningful information about their details;

- in accordance with Art. 16 EU-DSGVO, to immediately request the correction of incorrect data or the completion of your data stored by us;
- to request the deletion of your data stored by us in accordance with Art. 17 EU-DSGVO, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend required by legal claims;
- according to Art. 18 EU-DSGVO to demand the restriction of the processing of your data, insofar as the correctness of the data is disputed by you or the processing is unlawful;
- in accordance with Art. 20 EU GDPR, to receive your data that you have provided to us in a structured, common and machine-readable format or to request transmission to another person responsible ("data portability");
- to object to the processing in accordance with Art. 21 EU-DSGVO, if the processing is based on Art. 6 para. 1 lit. e or lit. f EU GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. Unless it is an objection to direct advertising, we ask that you explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and will either discontinue or adjust the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing. For many services on our websites that require personal data on the basis of Art. 6 para. 1 lit. f EU-DSGVO, the objection can be implemented technically via technologies that are available or to be installed in the browser, e.g. by blocking JavaScripts or cookies;
- according to Art. 7 para. 3 EU-DSGVO your once given consent (even before the EU-DSGVO came into force, i.e. before May 25th, 2018) - i.e. your voluntary, informed manner and unequivocally made clear by a declaration or other clear confirmatory action that you agree to the processing of the personal data concerned for one or more specific purposes - to revoke this at any time to us if you have given such consent. As a result, we are no longer allowed to continue the data processing based on this consent for the future and
- according to Art. 77 EU-DSGVO to complain to the data protection supervisory authority responsible for us about the processing of your personal data in our company.

Legal bases of data processing

In principle, any processing of personal data is only permitted by law if the data processing falls under one of the following justifications:

Art. 6 para. 1 lit. a EU-DSGVO ("consent"): If the data subject has given it voluntarily, in an informed manner and unequivocally by means of a declaration or other clear confirmatory action that he/she will process the personal data concerning him/her for one or more specific purposes agrees;
Art. 6 para. 1 lit. b EU-DSGVO ("contract"): If the processing is necessary to fulfill a contract to which the data subject is a party or to carry out pre-contractual measures that are carried out at the request of the data subject;
Art. 6 para. 1 lit. c EU-DSGVO ("legal obligation"): If the processing is necessary to fulfill a legal obligation to which the person responsible is subject (e.g. a statutory retention obligation);
Art. 6 para. 1 lit. d EU-DSGVO: If the processing is necessary to protect the vital interests of the data subject or another natural person;
Art. 6 para. 1 lit. e EU-DSGVO: If the processing is necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been assigned to the person responsible or
Art. 6 para. 1 lit. f EU-DSGVO ("legitimate interests"): If the processing is necessary to protect legitimate (in particular legal or economic) interests of the person responsible or a third party, provided that the conflicting interests or rights of the person concerned do not prevail (especially if this is is a minor). Insofar as the processing of personal data is based on Art. 6 para. 1 lit. f EU-DSGVO, the stated purposes also represent our legitimate interests. In the following, we specify the applicable legal basis for the processing operations we carry out. Processing can also be based on several legal bases.

Data Erasure and Storage Duration

For the processing procedures we carry out, we state below how long the data will be stored by us and when it will be deleted or blocked. In the case of consent, the data deletion and storage period specified in the consent query is decisive. Unless an express storage period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. In principle, your data will only be stored in the territory of the Federal Republic of Germany, in a member state of the European Union (EU) or in another contracting state of the Agreement on the European Economic Area (EEA). Possible exceptions to this are set out in the following sections and processing procedures. However, storage may take place beyond the specified time in the event of an (impending) legal dispute with you or other legal proceedings or if storage is required by law to which we are subject as the controller ( e.g. Section 257 HGB, Section 147 AO). If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted, unless further storage by us is necessary and there is a legal basis for this.

Data security: website, email, fax

We use technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties (e.g. TLS encryption for our website), taking into account the state of the art, the implementation costs and the scope, context and purpose of the processing, as well as the existing risks (including their likelihood and impact) for the data subject. Our security measures are continuously improved in line with technological developments.

For secure data transmission on the Internet, we use the hybrid encryption protocol Transport Layer Security (TLS, German Transport Layer Security), more widely known under the previous name Secure Sockets Layer Software (SSL). This software encrypts the information that you transmit. All information relevant to data protection is stored in encrypted form in a protected database.

We would like to point out that the confidentiality of e-mail cannot be proven. Although we offer transport encryption (TLS) via our mail server, confidentiality may depend on various mail relay servers over which we have no control: Whether they also use TLS and whether they evaluate the e-mails is beyond our control Effect.

If you send us a fax, the transmission takes place via the Internet Protocol (FoIP). The transmission is technically identical to sending an email or website data. We do not know whether an IP-based service encrypts data, so the confidentiality of the data sent cannot be guaranteed. We recommend that you do not send any sensitive data by fax.

We will be happy to provide you with further information on this upon request. To do this, please contact our data protection team.

Cooperation with processors

As with any larger company, we also use external service providers to process our business transactions, e.g. for the areas of IT, logistics, telecommunications: parcel delivery, sending letters or e-mails, analyzing our databases, advertising measures, processing payments, sales and marketing. These service providers have access to personal data that is required to perform their tasks. However, you may not use this data for any other purpose. Contract processors only act according to our instructions and are contractually obliged to comply with the data protection regulations in accordance with Art. 28 EU-DSGVO. Processors are not third parties.

Prerequisite for the transfer of personal data to third countries

As part of our business relationships, your personal information may be shared or disclosed with third party companies. These may also be located outside the European Economic Area (EEA), i.e. in third countries. Such processing is carried out solely to fulfill contractual and business obligations and to maintain your business relationship with us. We will inform you about the respective details of the transfer below at the relevant points.

In some third countries, the European Commission certifies data protection that is comparable to the EEA standard by means of so-called adequacy decisions. In other third countries, to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we make sure that data protection is adequately guaranteed. This is possible via binding corporate regulations, standard contractual clauses of the European Commission for the protection of personal data, certificates or recognized codes of conduct. Please contact our data protection team if you would like more information on this.

Automated Decision Making

We do not intend to use any personal information collected from you for any automated decision-making process (including profiling).

Obligation to provide personal data

We do not make the conclusion of contracts with us conditional on you providing us with personal data beforehand. In principle, there is no legal or contractual obligation for you as a customer to provide us with your personal data; however, it may be that we can only provide certain offers to a limited extent or not at all if you do not provide the data required for this. If this should be the case in the context of the products or processing methods presented below, you will be informed of this separately.

Legal obligation to transmit certain data

Under certain circumstances, we may be subject to a special statutory or legal obligation to make lawfully processed personal data available to third parties, in particular public authorities (Article 6 (1) (c) EU GDPR).

Change to the privacy policy

As part of the further development of data protection law, as well as technological or organizational changes, this document is regularly checked for any need for adjustment or supplementation. We reserve the right to change this data protection declaration at any time with effect for the future in compliance with the applicable data protection regulations. The changes will be published here. Current status: 01.03.2022

Information on the processing of personal data in special processing processes

The following sections describe processing procedures grouped according to different categories of persons whose data are processed ("data subjects").

Website visitors

Information about our company and the services we offer can be found in particular at www.gemoteg.de including the associated sub-pages (hereinafter collectively: "websites"). When you visit our website, your personal data will be processed.

Your data will only be processed for as long as is necessary to achieve the processing purposes set out above; the legal bases specified in the context of the processing purposes apply accordingly. Third parties used by us will store your data on their system for as long as is necessary in connection with the provision of services for us in accordance with the respective order.

The following categories of recipients, which are usually processors, may have access to your personal data:

Service providers for the operation of our website and the processing of the data stored or transmitted by the systems (e.g. for data center services, payment processing, IT security). The legal basis for the transfer is then Art. 6 para. 1 lit. b or lit. f EU-DSGVO, insofar as it is not a processor;

State bodies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the transfer is then Art. 6 para. 1 lit. c EU GDPR;

Persons used to carry out our business operations (e.g. auditors, banks, insurance companies, legal advisors, supervisory authorities, those involved in company acquisitions or the establishment of joint ventures). The legal basis for the transfer is then Art. 6 para. 1 lit. b or lit. f EU GDPR.

In addition, we only pass on your personal data to third parties if, according to Art. 6 Para. 1 lit. a EU-DSGVO have given their express consent to this.

Processed personal data on the website/log data

When using the website for informational purposes, we collect, store and process the following categories of personal data. When you visit our website, a so-called log data record (so-called server log files) is stored temporarily and anonymously on our web server. This consists in particular of:

- the page from which the page was requested (so-called referrer URL)
- the name and URL of the requested page
- the date and time of the call
- the description of the type, language and version of the web browser used
- the IP address of the requesting computer
- the amount of data transferred
- the operating system
- the message whether the call was successful (access status/HTTP status code)
- the GMT time zone difference

The processing of the log data serves statistical purposes and to improve the quality of our website, in particular the stability and security of the connection (legal basis is Art. 6 Para. 1 lit. f EU-DSGVO).

It is possible that we process additional information that your operating system, your browser and/or other of your technologies provide to our web servers at short notice in order to provide the websites. The legal basis for this is also Art. 6 para. 1 lit. f EU GDPR.

Services for storing information on your device or for accessing information already stored on your device (cookies, plugins, JavaScript...)

On our websites we use services and technologies to store information on your device and/or technologies to access information that is already stored on your device. These technologies can be cookies, for example. Cookies are text files and/or entries in the browser's own database, which assigns a characteristic character string to the browser you are using. Certain information flows between the place that sets the cookie and your end device.

Cookies and other services can contain data that make it possible to recognize the device used. In some cases, cookies and other technologies only contain information about certain settings that cannot be related to individuals.

You can reject or technically prevent some services, provided your browser allows this. However, we would like to point out that in this case you will not be able to use all the functions of our website to their full extent.

The help function in the menu bar of most web browsers explains, for example, how to prevent your browser from accepting new cookies, how to let your browser know when you receive a new cookie or how to delete all cookies received. You can also change your browser in such a way that special technologies (e.g. JavaScript) which the services require are not executed in your browser. As far as the services on our websites, the personal data on the basis of Art. 6 para. 1 lit. f EU-DSGVO, the objection can thus be technically implemented via these browser functions and technologies. With regard to their function, a distinction is made between services:

Technical services: These are mandatory to move around the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes, nor do they remember which websites you have visited;

Performance services: These collect information about how you use our website, which pages you visit and e.g. whether errors occur when using the website; they do not collect any information that could identify you - all information collected is anonymous and is only used to improve our website and find out what interests our users;

Advertising, targeting & sharing services, social media plugins: These are used to offer the website user needs-based advertising on the website or offers from third parties and to measure the effectiveness of these offers. These services can also be used to improve the interactivity of our website with other services (e.g. social networks).

What all services have in common is that they store information on your device and/or access information that is already stored on your device.

In contrast to the functional distinction of services, the legislator only distinguishes between two purposes of services:

1. Services that are necessary to carry out the transmission of a message via a public telecommunications network and/or are absolutely necessary so that the provider of a telemedia service can provide a telemedia service expressly requested by the user. The necessity can be technically, legally, economically, operationally and/or contractually agreed.

2. Services for All Other Purposes.

Any use of services that are absolutely necessary from a technical, legal, economic, operational and/or contractual point of view in order to provide an expressly requested service can have a legal basis other than consent in accordance with Art. 6 para. 1 lit. a EU GDPR.

General services on the website

We currently use the following services described above. Insofar as the processing is based on consent in accordance with Art. 6 para. 1 lit. a EU-DSGVO, we also state the way in which the consent is requested.

Service: contact form

When using contact forms, the data you transmit will be processed (e.g. gender, surname and first name, address, company, e-mail address and the time of transmission). The processing of contact form data takes place to process inquiries and the legal basis for this is based on Art. 6 Para. 1 lit. b or lit. f EU GDPR.

Google (and Alphabet, where applicable) services, products and technologies

In this section we have grouped services provided by Alphabet Inc. (a US publicly traded holding company) and in particular by Google, which is part of the holding company.

Service: Google Analytics

This website uses the Google Analytics service, a web analysis service operated by Google Ireland Limited, registration number: 368047, Gordon House, Barrow Street, Dublin 4, Ireland.

Processing will only take place if you have given your consent in accordance with Art. 6 para. 1 lit. a EU GDPR. Additional information on this possible processing can be found in the consent query in the consent management tool.
If you have given your consent, it will be possible to analyze your use of our websites and online services. Information about your use of this website and online offers is transmitted to and stored by Google on servers in the USA. Google will use this information to evaluate your visit to the website, to compile reports on website activity for us and to provide other services related to website activity and internet usage. Google may also transfer this information to third parties if required to do so by law or if third parties process this data on Google's behalf.

Service: YouTube

We use services from YouTube, YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (YouTube) on our website. The provider belongs to the group of companies of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.
Processing will only take place if you have given your consent in accordance with Art. 6 para. 1 lit. a EU GDPR. Additional information on this possible processing can be found in the consent query in the consent management tool.
If you have given your consent and you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers will be established. The YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile.

Service: Google Web Fonts/ External Fonts

We use the Google Web Fonts service on our website, operated by Google Ireland Limited, registration number: 368047, Gordon House, Barrow Street, Dublin 4, Ireland. Processing will only take place if you have given your consent in accordance with Art. 6 para. 1 lit. a EU GDPR. Additional information on this possible processing can be found in the consent query in the consent management tool.

If consent has been given, Google Web Fonts can be used to provide a uniform representation of fonts. When you call up a page, your browser loads the required web fonts into your browser cache in order to display text and fonts correctly. For this purpose, the browser you are using must connect to the Google servers. This gives Google knowledge that our website was accessed via your IP address.

applicant

You can apply to us in various ways. Regardless of how you apply to us, your applicant data will only be processed to process your application and will be stored for a maximum of six months after the end of the selection process and then deleted unless you give us your consent for further processing in a talent pool. As part of an application, we process the following personal data from you:

- all data that you have transmitted to us in the course of the application process (e.g. in your application documents or job interviews)
- possibly additional data that we have collected in the course of the application process (e.g. from public sources such as professional networks)
- This can also include special categories of personal data (e.g. severely disabled status, racial and ethnic origin, religious or ideological beliefs or trade union membership), provided these have been transmitted to us in one of the two ways mentioned.
The legal basis is the decision on the establishment of an employment relationship or, after the establishment of the employment relationship, for its implementation in accordance with Section 26 (1). BDSG-new and Art. 6 para. 1 lit. b EU GDPR.

Service: Application by email

You have the option of applying to us by email. Please send your application documents to bewerbung@gemoteg.de. We would like to point out that we cannot guarantee the confidentiality of your data for applications by e-mail. Although we offer transport encryption (TLS) on our mail server, confidentiality may depend on various mail relay servers over which we have no control. Whether they also use TLS and whether they evaluate the e-mails is beyond our knowledge and influence. If you have concerns about this, please use the postal service for your application.

business partners and information seekers

You have the option of contacting us by telephone, fax or e-mail. Please also note the section "Data security: website, e-mail, fax".

If you contact us by telephone, we collect information for caller identification (caller ID). So if your phone number isn't withheld or withheld, we see the phone number you're calling us from. The telephone number, call date and call time are automatically saved by our telephone system and are only used to call you back if you have asked us to do so or if your call was interrupted due to technical problems. This data will be deleted after 4 weeks at the latest. We do not record calls.

If you contact us by e-mail, this will be saved and used for the purpose that you have given us in the e-mail (e.g. product order). The same applies to contacting us by fax.

If you order products from us or request information material, we will create a customer account for you. The customer account contains the following data:

- The name and contact details of the company for which you are placing the order
- Your first and last name as a contact person
- For each order processed via this customer account, we store:
- Date of order and delivery
- Ordered products
- Current order status
This data is required to process your order and/or inquiry and will only be processed for this purpose (Art. 6 Para. 1 lit. b or lit. f EU-DSGVO). Unless otherwise stated, the deletion periods for this data are based on the statutory retention requirements to which we are subject.