• DRO STA MA

Privacy Policy

We appreciate your interest in our company. Data protection is particularly important to the management of Drolshagener Stahl- und Maschinenbau GmbH. Use of the Drolshagener Stahl- und Maschinenbau GmbH website is basically possible without providing personal data. However, if a data subject wishes to use special services of our company via our website, the processing of personal data may become necessary. If processing personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.
The processing of personal data such as the name, address, email address or telephone number of a data subject is always in accordance with the General Data Protection Regulation and in accordance with the country-specific data protection provisions applicable to Drolshagener Stahl- und Maschinenbau GmbH. Making use of this data protection declaration, our company would like to inform the public about the type, scope and purpose of the personal data that we collect, use and process. In addition, data subjects are informed about their rights via this data privacy statement.
As the responsible person, Drolshagener Stahl- und Maschinenbau GmbH has implemented numerous technical and organisational measures to ensure the most seamless protection possible for personal data processed via this website. Nevertheless, internet-based data transfers can generally have security gaps, and absolute protection thus cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us in alternative ways, such as by telephone.

1. Definitions
The data privacy statement of Drolshagener Stahl- und Maschinenbau GmbH is based on the terms used by the European body issuing directives and ordinances for the enactment of the General Data Protection Regulation (GDPR). Our data privacy statement should be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we would like to explain the terms used in advance.
Among other things, we use the following terms in this privacy statement:
a) personal data
Personal data is any information relating to an identified or identifiable natural person (in the following “data subject”). An identifiable person is considered to be a natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more special characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
b) data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the responsible person.
c) processing
Processing is any operation or set of operations carried out with or without the help of automated procedures relating to personal data, such as collection, recording, organisation, structuring, storage, adaptation or modification, reading, querying, use, disclosure by transmission, dissemination or another form of provision, matching or linking, restriction, deletion or destruction.
d) restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting their future processing.
e) profiling
Profiling is any kind of automated processing of personal data that consists of using these personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects of that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or relocation.
f) pseudonymisation
Pseudonymisation is the processing of personal data in a manner in which the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is stored separately and is subject to technical and organisational measures that ensure that the personal data is not assigned to an identified or identifiable natural person.
g) responsible person or person responsible for the processing
The responsible person or person responsible for the processing is the natural or legal person, public authority, agency or other body that alone or jointly with others decides on the purposes and means of processing personal data. If the purposes and means of this processing are prescribed by Union law or the law of the Member States, then the responsible person or the specific designating criteria can thereby be provided for under Union law or Member State law.
h) processors
The processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the responsible person.
i) recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, regardless of whether it is a third party or not. However, authorities that may receive personal data under EU law or Member State law as part of a specific investigation are not deemed recipients.
J) third parties
A third party is a natural or legal person, public authority, agency or other body other than the data subject, the responsible person, the processor or the persons authorised under the direct responsibility of the responsible person or the processor to process the personal data.
k) consent
Consent is any freely given expression of will by the data subject in an informed and unequivocal manner for the particular case, in the form of a declaration or other unambiguous affirming action by which the data subject indicates that he or she agrees to the processing of the personal data concerning him or her.

2. Name and address of the responsible person
The responsible person within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is the:
Drolshagener Stahl- und Maschinenbau GmbH
Industriestr. 1
57489 Drolshagen
Tel.: 0 27 63 / 64 00
E-Mail: info@drostama.de
Website: www.drostama.de

3. Data protection officer
Due to the small number of employees who have contact with personal data, a data protection officer is not required according to the current legal situation. However, every data subject is welcome to ask questions or make suggestions about data protection via the above indicated contact details directly to us.

4. Cookies
The Drolshagener Stahl- und Maschinenbau GmbH website uses cookies. Cookies are text files that are stored on a computer system via an internet browser.
Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string by which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables the visited websites and servers to differentiate the data subject’s individual browser from other browsers that contain other cookies. A specific internet browser can be recognised and identified via the unique cookie ID.
By using cookies, Drolshagener Stahl- und Maschinenbau GmbH can provide users of this website with more user-friendly services that would not be possible without the cookie settings.
The information and offers on our website can be optimised for the benefit of the user by means of a cookie. As already mentioned, cookies allow us to recognise the users of our website. The purpose of this recognition is to make it easier for users to use our website. For example, the user of a website that uses cookies does not have to enter their access data each time the website is visited, because this is done by the website and the cookie stored on the user’s computer system. Another example is the shopping cart cookie in the online shop. The online shop remembers the items that a customer has placed in the virtual shopping cart via a cookie.
The data subject can prevent the setting of cookies by our website at any time by accordingly adjusting the settings of the internet browser being used and thus permanently object to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an internet browser or other software programs. This is possible on all common internet browsers. If the data subject deactivates the setting of cookies in the browser used, under certain circumstances not all functions of our website may be fully usable.

5. Collecting general data and information
The website of Drolshagener Stahl- und Maschinenbau GmbH collects a range of general data and information each time the website is accessed by a data subject or an automated system. These general data and information are stored in the log files of the server. Potentially recorded are (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the internet site from which an accessing system accesses our website (so-called referrers)), (4) the sub-web pages that are accessed on our website via an accessing system, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address)), (7) the internet service provider of the accessing system and (8) other similar data and information that serve to prevent hazards in the event of attacks on our information technology systems.
Drolshagener Stahl- und Maschinenbau GmbH draws no conclusions about the data subject when using these general data and information. This information is instead needed (1) to deliver the contents of our website correctly, (2) to optimise the content of our website and the advertising for it, (3) ensure the long-term functionality of our information technology systems and the technology of our website and (4) to provide law enforcement authorities with the information they need to prosecute in the event of a cyber attack. This anonymously collected data and information is therefore statistically evaluated by Drolshagener Stahl- und Maschinenbau GmbH with the aim of increasing data protection and data security in our company in order to ultimately ensure an optimal level of protection for the personal data that we process. The anonymous data of the server log files is stored separately from all personal data provided by a data subject.

6. Contact option via the internet site
As a result of legal regulations, the Drolshagener Stahl- und Maschinenbau GmbH website contains information that enables quick electronic contact with our company and immediate communication with us, which also includes a general address of so-called electronic mail (e-mail address). If a data subject contacts the responsible person via email or a contact form, the personal data transmitted by the data subject will be stored automatically. Such personal data voluntarily provided by a data subject to the responsible person will be stored for the purpose of processing or contacting the data subject. This personal data will not be passed on to third parties.

7. Comment function on the website blog
Drolshagener Stahl- und Maschinenbau GmbH offers users the opportunity to leave individual comments on individual blog entries on a blog on a website of the person responsible for the processing. A blog is a portal that is kept on a website, usually open to public scrutiny, in which one or more people who are called bloggers or web bloggers can post articles or write ideas in so-called blog posts. Blog posts can usually be commented on by third parties.
If a data subject submits a comment on the blog published on this website, information about the time of the comment input and the user name (pseudonym) chosen by the data subject will be stored and published, in addition to the comments left by the data subject. The IP address provided by the data subject’s Internet Service Provider (ISP) is also recorded. This storage of the IP address takes place for security reasons and in the event that the data subject breaches the rights of third parties or posts illegal content by submitting a comment. The storage of these personal data is therefore in the responsible person’s own interest, so that in the event of a legal violation, the responsible person can potentially exculpate itself. This collected personal data will not be passed on to third parties unless this is prescribed by law or serves the legal defence of the responsible person.

8. Routine deletion and blocking of personal data
The responsible person processes and stores the data subject’s personal data only for the period required to attain the purpose of the storage, or if this was provided for by the European body issuing directives and ordinances or another legislature in laws or regulations to which the responsible person is subject.
If the purpose of the storage expires, or if a storage period prescribed by the European body issuing directives and ordinances or another competent legislature expires, the personal data will be routinely blocked or deleted in accordance with statutory provisions.

9. Rights of the data subject
a) the right to confirmation
Each data subject has the right, granted by the European body issuing directives and ordinances, to demand from the responsible person confirmation as to whether personal data concerning him or her is being processed. If a data subject wishes to exercise this right to confirmation, they can contact an employee of the responsible person at any time.
b) the right to information
Every data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances to receive at any time from the responsible person free of charge information about the personal data stored about him/her and a copy of that information. Furthermore, the European body issuing directives and ordinances has granted the data subject the following information:

the purposes of the processing
the categories of personal data that are processed
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
if possible, the planned duration for which the personal data are stored or, if this is not possible, the criteria for determining this duration
the existence of a right to rectification or erasure of the personal data concerning them or to restriction of processing by the responsible person or a right to object to such processing
the existence of a right of appeal to a supervisory authority if the personal data are not collected from the data subject:
all available information about the origin of the data
the existence of automated decision-making, including profiling pursuant to Art. 22 para. 1 and 4 GDPR and — at least in those cases — meaningful information about the logic involved as
well as the scope and the envisaged effects of such processing for the data subject
Furthermore, the data subject has a right of access concerning whether personal data has been transmitted to a third country or to an international organisation. If this is the case, the data subject has the right to obtain information about the appropriate guarantees in connection with the transmission.
If a data subject wishes to exercise this right of access, they can contact an employee of the responsible person at any time.
c) the right to correction
Any data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances to demand the immediate correction of inaccurate personal data concerning them. Furthermore, the data subject has the right, taking into account the purposes of the processing, to demand the completion of incomplete personal data, including by means of a supplementary statement.
If a data subject wishes to exercise this right to correction, they can contact an employee of the responsible person at any time.
d) the right to deletion (right to be forgotten))
Any data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances to demand that the responsible person delete the personal data concerning him or her immediately, provided that one of the following reasons applies and the processing is not necessary:
The personal data has been collected or otherwise processed for purposes for which they are no longer necessary.
The data subject revokes their consent, which was based on the processing pursuant to Art. 6 para. 1) (a) of the GDPR or Art. 9 para. 2 (a) of the GDPR, and there is no other legal basis for the processing.
According to Art. 21 para. 1 of the GDPR, the data subject lodges an objection against processing, and there are no overriding legitimate grounds for processing, or the data subject lodges an objection against processing in accordance with Art. 21 para. 2 of the GDPR.
The personal data was unlawfully processed.
The deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the responsible person is subject.
The personal data were collected with regard to the services offered by the information society according to Art. 8 para. 1 of the GDPR.
If one of the above reasons applies and a data subject wishes to initiate the deletion of personal data stored at Drolshagener Stahl- und Maschinenbau GmbH, he or she may contact an employee of the responsible person at any time. The employee of Drolshagener Stahl- und Maschinenbau GmbH will ensure that the deletion request is complied with immediately.
If the personal data have been made public by Drolshagener Stahl- und Maschinenbau GmbH and if our company, as the responsible person, is obligated to delete the personal data according to Art. 17 para. 1 GDPR, Drolshagener Stahl- und Maschinenbau GmbH (under consideration of the available technology and implementation costs) will take appropriate measures, including technical measures, to inform other persons responsible for data that process the published personal data that the data subject has requested the deletion of all links to these personal data or copies or replications of these personal data, insofar as the processing is not necessary. The employee of Drolshagener Stahl- und Maschinenbau GmbH will do what is necessary in individual cases.
e) right to restriction of processing
Every data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances to demand that the responsible person restrict the processing if one of the following conditions is met:
The accuracy of the personal data is disputed by the data subject for a duration that enables the responsible person to verify the correctness of the personal data.
The processing is unlawful, the data subject refuses to delete the personal data and instead requests the restriction of the use of the personal data.
The responsible person no longer needs the personal data for the purposes of the processing, but the data subject requires them to assert, exercise or defend legal claims.
The data subject has lodged an objection against the processing in accordance with Art. 21 para. 1 of the GDPR and it is not yet clear whether the justified reasons of the responsible person outweigh those of the data subject.
If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored at Drolshagener Stahl- und Maschinenbau GmbH, they may contact an employee of the responsible person at any time. The employee of Drolshagener Stahl- und Maschinenbau GmbH will initiate the restriction of processing.
f) the right to data portability
Every data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances to receive the personal data concerning them, which were provided to a responsible person by the data subject, in a structured, commonly used and machine-readable format. They also have the right to transmit these data to another responsible person without hindrance from the responsible person to whom the personal data have been provided, provided that the processing is based on the consent given in Art. 6 para. 1 (a) of the GDPR or Art. 9 para. 2 (a) of the GDPR or on a contract pursuant to Art. 6. para. 1 (b) of the GDPR and that the processing takes place using automated procedures, provided that the processing is not necessary for the performance of a task that is in the public interest or in the exercise of public authority vested in the responsible person.
Furthermore, when exercising their right to data portability in accordance with Art. 20 para. 1 of the GDPR, the data subject has the right to have the personal data transmitted directly from one responsible person to another, insofar as this is technically feasible and insofar as this does not affect the rights and freedoms of other persons.
To assert the right to data portability, the data subject may contact an employee of Drolshagener Stahl- und Maschinenbau GmbH at any time.
g) the right to object
Any data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances to object at any time to the processing of personal data concerning him or her, for reasons resulting from his or her particular situation, which results from Art. 6 para. 1 (e) or (f) of the GDPR. This also applies to profiling based on these provisions.
Drolshagener Stahl- und Maschinenbau GmbH no longer processes the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.
If Drolshagener Stahl- und Maschinenbau GmbH processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of the personal data for such advertising. This also applies to profiling insofar as it is related to such direct marketing. If the data subject objects to Drolshagener Stahl- und Maschinenbau GmbH regarding the processing for direct marketing purposes, Drolshagener Stahl- und Maschinenbau GmbH will no longer process the personal data for these purposes.
In addition, the data subject has the right to lodge an appeal for reasons resulting from their particular situation against the processing of personal data concerning them, which is performed by Drolshagener Stahl- und Maschinenbau GmbH for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 para. 1 of the GDPR, unless such processing is necessary to fulfil a task in the public interest.
To exercise the right to object, the data subject may directly contact any employee of Drolshagener Stahl- und Maschinenbau GmbH or another employee. The data subject is also free to use information society services, regardless of directive 2002/58/EC, to exercise its right of objection through automated procedures using technical specifications.
h) automated decisions in individual cases, including profiling
Any data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances, not to be subject to a decision based solely on automated processing — including profiling — that has legal effect on them or similarly significantly impairs them, if the decision taken (1) is not necessary for the conclusion or performance of a contract between the data subject and the responsible person, or (2) is permitted by Union or Member State laws to which the responsible person is subject and which contain appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject or (3) takes place with the express consent of the data subject.
If the decision (1) is necessary for the conclusion or performance of a contract between the data subject and the responsible person or (2) if it is carried out with the express consent of the data subject, Drolshagener Stahl- und Maschinenbau GmbH will take appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, which at least includes the right to obtain the intervention of a person on the part of the responsible person, to present their own point of view and to challenge the decision.
If the data subject wishes to assert rights with regard to automated decisions, he or she can contact an employee of the responsible person at any time.
i) the right to revoke consent under data protection laws
Any data subject affected by the processing of personal data has the right granted by the European body issuing directives and ordinances to revoke consent to the processing of personal data at any time.
If the data subject wishes to exercise their right to withdraw consent, they may contact an employee of the responsible person at any time.

10. Data protection in applications and in the application process
The responsible person collects and processes the personal data of applicants for the purpose of handling the application procedure. Processing can also take place electronically. This is particularly the case if an applicant sends corresponding application documents to the responsible person for the processing by electronic means, for example by email or via a web form on the website. If the responsible person concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with statutory provisions. If the responsible person does not enter into an employment contract with the applicant, the application documents will be automatically deleted two months after the notification of the rejection decision has been made, unless deletion contradicts any other legitimate interests of the responsible person. Another legitimate interest in this regard is, for example, a duty of proof in a procedure under the General Equal Treatment Act (AGG)).

11. Data protection regulations for the service and use of Facebook
The person responsible for processing has integrated components of the Facebook company into this website. Facebook is a social network.
A social network is a social meeting place on the internet, an online community that generally enables users to communicate with each other and interact in virtual space. A social network can serve as a platform for the exchange of opinions and experiences or enable the internet community to provide personal or company-related information. Facebook allows social network users to create private profiles, upload photos, and network through friend requests.
Facebook’s operating company is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The person responsible for processing personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, if a data subject lives outside the USA or Canada.
Whenever one of the individual pages of this website, which is operated by the person responsible for the processing and on which a Facebook component (Facebook plug-in) has been integrated, is called-up, the internet browser on the data subject’s information technology system is automatically prompted by the respective Facebook component to download a display of the corresponding Facebook component. A complete overview of all Facebook plug-ins can be called-up at https://developers.facebook.com/docs/plugins/?locale=de_DE. As part of this technical process, Facebook is informed about which specific sub-page of our website is visited by the data subject.
If the data subject is logged in on Facebook at the same time, Facebook recognises our website with each call-up by the data subject for the entire duration of their stay on our website and which specific sub-page of our website the data subject is visiting. This information is collected through the Facebook component and associated with the respective Facebook account of the data subject. If the data subject clicks on one of the Facebook buttons integrated on our website, such as the “Like it“ button or if the data subject leaves a comment, Facebook assigns this information to the personal Facebook user account of the data subject and stores this personal data.
Facebook is always informed via the Facebook component when the data subject has visited our website, if the data subject is logged in at Facebook at the same time as the call-up to our website; this takes place regardless of whether the data subject clicks on the Facebook component or not. If the data subject does not want this information to be transmitted to Facebook, they can prevent it from being transmitted by logging out of their Facebook account before a call-up to our website is made.
The data guidelines published by Facebook, which can be called-up at https://de-de.facebook.com/about/privacy/, provide information on the collection, processing and use of personal data by Facebook. They also explain what setting options Facebook offers to protect the privacy of the data subject. In addition, different applications are available that enable data transmission to Facebook to be suppressed. Such applications can be used by the data subject to suppress data transmission to Facebook.

12. Data protection regulations on the service and use of Google Analytics (with an anonymisation function)
The responsible person has integrated the Google Analytics component (with an anonymisation function) on this website. Google Analytics is a web analysis service. Web analysis is the collection and evaluation of data on the behaviour of visitors to websites. A web analysis service records, among others, data on which internet site a data subject came from (the referrer), which sub-pages of the internet page were accessed, or how often and for which period of time a sub-page was considered. A web analysis is predominantly used to optimise a website and for the cost-benefit analysis of internet advertising.
The Google Analytics component’s operating company is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
The responsible person uses the addition “_gat._ anonymiseIp” for web analysis via Google Analytics. With this addition, Google shortens and anonymises the IP address of the internet connection of the data subject if access to our internet sites takes place from a Member State of the European Union or from another contracting state of the Agreement on the European Economic Area.
The purpose of the Google Analytics component is to analyse the flow of visitors to our website. Among other things, Google uses the data and information gained to evaluate the use of our website, to compile online reports for us that show the activities on our internet sites, and to provide other services associated with the use of our website.
Google Analytics places a cookie on the information technology system of the data subject. What cookies are has already been explained above. By setting the cookie, Google is enabled to analyse the use of our website. Whenever one of the individual pages of this website, which is operated by the responsible person for the processing and on which a Google Analytics component has been integrated, is accessed, the internet browser on the data subject’s information technology system is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. As part of this technical process, Google receives knowledge of personal data, such as the IP address of the data subject, which among other things is used by Google to trace the origin of the visitors and clicks and to enable commission billing to follow.
The cookie is used to store personal information, such as access time, the location from which access originated and the frequency of visits to our website by the data subject. Whenever our internet sites are visited, these personal data, including the IP address of the internet connection used by the data subject, will be transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass these personal data collected through the technical procedure on to third parties.
The data subject may prevent the setting of cookies by our website at any time, as described above, by adjusting the settings of the internet browser used and thereby permanently objecting to the setting of cookies. Such a setting of the employed internet browser would also prevent Google from placing a cookie on the information technology system of the data subject. In addition, a cookie already placed by Google Analytics can be deleted at any time via the internet browser or other software programs.
Furthermore, the data subject has the option of objecting to the collection of data generated by Google Analytics relating to the use of this website and the processing of this data by Google and preventing such processing. For this, the data subject must download and install a browser add-on at the link https://tools.google.com/dlpage/gaoptout. This browser add-on uses JavaScript to inform Google Analytics that no data or information about website visits may be transmitted to Google Analytics. Google will interpret the installation of the browser add-on as an objection. If the data subject’s information technology system is deleted, formatted or reinstalled at a later date, the data subject must reinstall the browser add-on to disable Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person within their sphere of influence, it is possible to reinstall or reactivate the browser add-on.
Further information and the applicable data protection provisions of Google can be called-up at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at the link https://www.google.com/intl/de_de/analytics/.
You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie is set to prevent your data from being collected when this website is visited in the future:
Disable Google Analytics

13. Privacy policy for the service and use of YouTube
The responsible person for processing has integrated components of YouTube into this website. YouTube is an internet video portal that allows video publishers to set video clips and to also allow other users to view, evaluate and comment on them free of charge. YouTube permits the publication of all types of videos, which makes it possible to call-up entire film and television programmes, as well as music videos, trailers or videos made by users themselves, via the internet portal.
The operating company of YouTube is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
Each call-up of one of the individual pages of this website, which is operated by the responsible person for the processing and on which a YouTube component (YouTube video) has been integrated, automatically causes the internet browser on the data subject’s information technology system to download a display of the corresponding YouTube component from YouTube. More information about YouTube can be found at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google are informed about which specific sub-page of our website has been visited by the data subject.
If the data subject is logged into YouTube at the same time, YouTube recognises, through the call-up of a sub-page containing a YouTube video, which specific sub-page of our website the data subject is visiting. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.
Via the YouTube component, YouTube and Google receive information that the data subject has visited our website when the data subject is logged on to YouTube at the same time as the call-up to our website; this takes place regardless of whether the data subject clicks on a YouTube video or not. If the data subject does not wish to transmit such information to YouTube and Google, they may prevent it from being transmitted by logging out of their YouTube account before a call-up to our website is made.
The data protection regulations published by YouTube and published at https://www.google.de/intl/de/policies/privacy/ are available and provide information on the collection, processing and use of personal data by YouTube and Google.

14. The legal basis for processing
Art. 6 I in lit. a of the GDPR serves our company as the legal basis for processing operations for which we obtain consent for a specific purpose. If the processing of personal data is necessary to fulfil a contract to which the data subject is party, as is the case for processing operations which are necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Art. 6 I in lit. b of the GDPR. The same applies to such processing operations that are necessary for carrying out pre-contractual measures, for example in cases of enquiries about our products or services. If our company is subject to a legal obligation requiring the processing of personal data, such as for the fulfilment of tax obligations, the processing is based on Art. 6 I lit. c of the GDPR. In rare cases, the processing of personal data may become necessary to protect vital interests of the data subject or another natural person. This would be the case, for example, if a visitor to our company were injured and his name, age, health insurance data or other vital information had to be passed on to a doctor, hospital or other third parties. The processing would then be based on Art. 6 I lit. d of the GDPR. Finally, processing operations could be based on Art. 6 I lit. f of the GDPR). Processing operations not covered by any of the aforementioned legal bases are based on this legal basis when necessary to safeguard the legitimate interests of our company or a third party, unless the interests, fundamental rights and fundamental freedoms of the data subject prevail. We are permitted to carry out such processing operations, in particular because they have been specifically mentioned by the European legislator. They considered that a legitimate interest could be assumed if the data subject is a customer of the responsible person (recital 47 sentence 2 of the GDPR)).

15. Legitimate interests in processing that are pursued by the responsible person or a third party
If the processing of personal data is based on Art. 6 I lit. f of the GDPR, our legitimate interest is to conduct our business in favour of the well-being of all our employees and shareholders.

16. Duration for which the personal data is stored
The criterion for the duration of the storage of personal data is the respective statutory retention period. After the deadline expires, the data in question will be routinely erased unless they are needed to fulfil or initiate the contract.

17. Statutory or contractual provisions for making personal data available; necessity for the conclusion of the contract; obligation of the data subject to provide the personal data; possible consequences of non-provision
We clarify that the provision of personal data is partly a legal requirement (e.g. tax rules) or can result from contractual arrangements (e.g. information on the contracting partner). It may sometimes become necessary, for the purpose of concluding a contract, that a data subject provide us with personal data that subsequently has to be processed by us. For example, the data subject is obliged to provide us with personal data if our company concludes a contract with him or her. Failure to provide personal data would result in the contract with the data subject not being concluded. The data subject must contact one of our employees before providing personal data. Our employee shall clarify to the data subject on a case-by-case basis whether the provision of the personal data is legally or contractually prescribed or necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and what the consequences would be if the personal data were not provided.

18. Existence of automated decision making
As a responsible company, we refrain from automatic decision-making or profiling.

19. Server log files
The provider of the pages automatically collects and saves information in so-called server log files, which your browser automatically transmits to us. These are:

browser type and browser version
operating system used
referrer URL
hostname of the accessing computer
time of the server request
These data cannot be assigned to specific persons. This data is not merged with other data sources. We reserve the right to retrospectively check these data if we become aware of concrete evidence of illegal use.

20. Google Maps
This website uses the Google Maps product of Google Inc. By using this website, you agree to the collection, processing and use of the automatically collected data by Google Inc, its representatives and third parties. You can find the terms of use for Google Maps at “Terms of use for Google Maps”.
This data protection declaration was created by the data protection generator of DGD Deutsche Gesellschaft für Datenschutz GmbH and was subsequently customised.