bg-country-switch

Data Protection

Last update: August 11th, 2020

Privacy Notice

Compliance with data protection regulations is very important to PAUL HARTMANN AG (hereinafter referred to as "HARTMANN", "we" or "us"). We would therefore like to inform you in the following about the processing of your personal data, in particular about the purposes of the respective data processing and the data categories processed, subdivided according to individual services or forms of use and about the rights to which you are entitled. With regard to the related terms, such as "personal data" or "processing", we refer to the relevant definitions in Art. 4 General Data Protection Regulation (GDPR).

If you are a shareholder, customer, supplier of or applicant at HARTMANN, you will find information on processing your personal data in the form of a PDF here:

Shareholders can find more information here
Customers can find more information here
Suppliers can find more information here
Applicants can find more information here

We kindly ask you to inform yourself regularly about the content of our data protection declaration. We will adapt the data protection declaration as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require a cooperative action on your part (e.g. consent) or other individual notification.

Status: 11.08.2020

1. Responsible party and contact information

Responsible party:
PAUL HARTMANN AG
Paul-Hartmann-Straße 12
89522 Heidenheim
Phone: +49-7321-36-0
Fax: +49-7321-36-3636
E-Mail: info@hartmann.info

Contact Data Protection:
PAUL HARTMANN AG
Department CFO-DPM / DPO
Paul-Hartmann-Straße 12
89522 Heidenheim
E-Mail: datenschutz@hartmann.info

Do you have general questions or comments about this data protection declaration or specific questions about the processing of your data? We will gladly answer them. On request we will also correct, supplement or delete your personal data and we will comply with your further data subject rights.

2. Legal bases and purposes of data processing

In accordance with Art. 13, 14 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not expressly mentioned in this data protection declaration, the following applies:

The legal basis for obtaining consent is Article 6 (1) a and Article 7 GDPR as well as Article 9 (2) a and Article 7 GDPR (e.g. delivery of user-specific offers and information about our products and services, surveys on our websites, analysis of the use of our products, services and websites, personalisation of offers on the Internet, by e-mail, fax and other channels, advertising or market and opinion research), the legal basis for processing for the purpose of fulfilling our services and carrying out contractual measures and responding to enquiries is Art. 6 (1) b GDPR (e.g. execution of contract and/or service, processing of payments for purchases and other services, processing due to a complaint, communication via telephone, e-mail, fax, live chat, video call and other channels, supply advice), the legal basis for processing for the fulfilment of our legal obligations is Art. 6 (1) c GDPR (e.g. compliance with the statutory retention periods) and the legal basis for processing to safeguard our legitimate interests is Art. 6 (1) f GDPR (e.g. Analysis and clarification of misuse or attacks on communication systems, legitimation and authentication; protection against or investigation of possible fraudulent transactions, communication via telephone, e-mail, fax, live chat, video call and other channels; sending samples, premiums, products and information, providing user-specific offers and information about our products and services, surveys on our websites, personalisation of offers on the Internet, by e-mail, fax and other channels, determining the effectiveness of our advertising). In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) d GDPR serves as the legal basis.

3. Security measures

In accordance with Articles 24, 32 GDPR, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the varying probability of occurrence and severity of the risk to the rights and freedoms of natural persons. Such measures shall include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to personal data, as well as access, input, disclosure, safeguarding of availability and segregation thereof. Furthermore, we have established procedures to ensure the exercise of data subject rights, deletion of personal data and response to threats to personal data. Furthermore, we take the protection of personal data into account as early as the development and selection of hardware, software and procedures, in accordance with the principle of data protection by means of technological design and by means of data protection-friendly presettings (Art. 25 GDPR).

The security measures include in particular the encrypted transmission of data between your browser and our server. Third party security measures include in particular IP masking (pseudonymization of your IP address).

4. Cooperation with third parties and data processors

If, in the course of our processing, we disclose (third parties) personal data to other persons and companies - including Group companies -, transmit it to them or otherwise grant them access to the data, this is only done on the basis of a legal authorisation (e.g. if a transfer of the data to third parties, such as to payment service providers, is necessary for the performance of the contract in accordance with Art. 6 (1) b GDPR), if you have consented to this, if a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosters, etc.).

Insofar as we commission so-called contract processors with the processing of personal data on the basis of a so-called "data processing agreement" and thereby secure for ourselves, among other things, the necessary powers of influence or control with regard to the processing and use of personal data, this is done on the basis of Art. 28 GDPR. However, we remain responsible to you for the legality of the data processing.

5. Data transfers to third countries

If we process personal data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of using the services of third parties or if personal data is disclosed or transferred to third parties, this will only take place if it is done to fulfil our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or transfer personal data in a third country only if the special prerequisites of Art. 44 ff. GDPR. This means that processing is carried out, for example, on the basis of special guarantees, such as the officially recognised establishment of a data protection level equivalent to that of the EU or compliance with officially recognised special contractual obligations (so-called "standard contractual clauses").

6. Additional information for website users

This information informs you about the type, scope and purpose of the processing of personal data within our online offer and the associated websites, functions and contents as well as external online presences, such as our social media profiles (hereinafter jointly referred to as "online offer“). You can find further information in our “Privacy Notice Customers”.

6.1 Cookies, analysis, tracking, optimisation

Information on the cookies we use is mainly found in our cookie policy. Information on technologies from us or from third parties, which are not only used to provide a function within our online offer, but also exclusively or additionally serve the analysis of user behaviour, tracking, the optimisation of our marketing activities or other purposes, is made available to you in this data protection declaration and in our cookie policy.

6.2 Purposes of data processing

We process your personal data in particular for the following purposes:

Provision of the online offer, its contents and functions; marketing, advertising, public relations and market research; security measures; tracking (e.g. interest/behavioural profiling, use of cookies); remarketing; visitor action evaluation, interest-based and behaviour-based marketing, profiling (creation of user profiles); version measurement (measurement of the effectiveness of marketing measures); target group formation (determination of target groups relevant for marketing purposes or other output of content); cross-device tracking (cross-device processing of user data for marketing purposes).

6.3 Categories of data

We process in particular the following data categories:

Usage data (e.g. websites visited, services used, interest in content, access times); meta/communication data (e.g. device information, IP addresses, browser type); location data (data indicating the location of an end user's end device).

6.4 Collection of access data and log files

On the basis of our legitimate interests within the meaning of Art. 6 (1) f GDPR, we collect data on every access to the server on which this service is located (so-called server log files). The access data includes the path of the website accessed, files linked to it, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider as well as other browser header data. In particular, the processing of your IP address as personal data is necessary for communication between your browser and our server.

Log file information is stored for a period of 6 months for security reasons (e.g. for the clarification of abuse or fraud) and then deleted. Data whose further storage is required for evidential purposes is excluded from deletion until final clarification of the respective incident. This data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 (1) c GDPR.

6.5 Online presence in social media

We maintain online presences within social networks and platforms in order to be able to communicate with the customers, interested parties and users active there and to inform them about our services. When accessing social networks and platforms, the terms and conditions and data processing guidelines of the respective operator apply.

We process your personal data if you communicate them within social networks and platforms, e.g. by writing articles on our online presences or sending us messages. In addition, Facebook, among other things, may provide statistics and insights (e.g., total number of page views, "Like" information, page activity, post interactions, video views, post reach, comments, shared content, responses, etc.) that help us understand the types of actions you take on our sites. This enables us to better understand your interests and preferences and can, for example, increase the attractiveness of articles or our performance presentation or choose the right time for publication.

We point out that your personal data may be processed by the respective operator outside the European Union or the European Economic Area. As a result, risks may arise for you, in particular the enforcement of rights may become more difficult.

If you click on the button of the respective operator, you will be redirected to our respective online presence in a separate browser window and can - if you are logged in to your user account - share or subscribe to our news, among other things. Clicking the button will establish a direct connection between your browser and the server of the respective operator. The respective operator receives the information that you have visited our website with your IP address. The respective operator may collect further personal data as soon as you use their offers. In addition, it is then possible for the respective operator to assign your visit to our website to you and your user account, provided you are logged in to your user account.

In addition, your personal data may be further processed for the purposes of market research and advertising. This means that profiles can be created from your usage behaviour and the preferences and interests derived from it. Such profiles can be used, for example, to place suitable advertisements within our online presence or on other online presences or websites based on the interests determined. Cookies are placed and stored on your end device, with the help of which personal data on usage behaviour can be collected and bundled for further processing - to determine your interests. The collection and bundling of this personal data can - especially if you are logged in to your user account - also be realised across several end devices used by you.

The processing of your personal data is based on our legitimate interest in effective information and performance presentation and direct communication with you in relation to our online offer in accordance with Art. 6 (1) f GDPR.

Should you request information or wish to exercise other rights to which you are entitled, please contact the respective operator directly. The background to this is that only the respective operators have access to your personal data and can provide you with the relevant information and take further measures if necessary. Should you require assistance in exercising the rights to which you are entitled, you can also contact us at any time.

A description of the data processing carried out by the respective operator as well as the requirements for the implementation of an objection (opt-out) can be found in the information provided by the respective operator:

Provider: Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
Privacy policy:https://www.facebook.com/about/privacy/
Site insight data:https://www.facebook.com/legal/terms/information_about_page_insights_data
Opt-Out:https://www.facebook.com/settings?tab=ads

Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland
Privacy policy:https://twitter.com/de/privacy
Opt-Out:https://twitter.com/personalization

Anbieter: LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA
Privacy policy:https://www.linkedin.com/legal/privacy-policy
Opt-Out:https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany
Privacy policy:https://www.xing.com/app/share?op=data_protection

Provider: YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA
Privacy policy:https://policies.google.com/privacy?hl=de&gl=de

Provider: (Instagram) Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
Privacy policy:https://help.instagram.com/519522125107875

6.6 Links

We do not use social plug-ins from social networks that collect personal data on our websites. We only use links on our websites to social networks. This prevents our users' personal data from being passed on to social networks without their knowledge when they visit our websites. The links establish a connection to our online presence of the respective social network exclusively on request - therefore only after the user clicks on a link. After a click on the link, the IP address and the general header information of the browser of the user's browser are transmitted to the respective social network. The respective social network may collect further personal data as soon as you use its offers. For example, if you are logged into your account, Facebook may associate your visit with your account. We would like to point out that we have no knowledge of the content of the personal data transmitted in the further course of the process, nor of its use by the social networks.

The links described above are used for the following social networks:

Provider: Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
Privacy policy:https://www.facebook.com/about/privacy/

Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland
Privacy policy:https://twitter.com/de/privacy

Provider: LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA
Privacy policy:https://www.linkedin.com/legal/privacy-policy

Provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Deutschland
Privacy policy:https://www.xing.com/app/share?op=data_protection

Provider: Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
Privacy policy:https://help.instagram.com/519522125107875/

7. Contact

When you contact us (by contact form, telephone, fax, post or e-mail), your personal data will be processed for the purpose of handling your enquiry and its processing in accordance with Article 6 (1) b and f GDPR. The information marked as mandatory in the contact form is required for the processing of your enquiry.

As a rule, we delete inquiries 3 months after their receipt, at the latest, however, if they have been answered. In the event of statutory storage obligations to be observed, the deletion shall take place after their expiry.

8. Comments and reports

We maintain blogs with the possibility of commentary in our online offer. For the comment function, in addition to your comment, information on the time of the creation of your comment, your e-mail address and, if you are not anonymous, the user name you have chosen are stored. Comments remain in the blog as long as it is operated or you request its deletion.

If you write a comment, your IP address will be stored for 6 months on the basis of our legitimate interests in the sense of Art. 6 (1) f GDPR in addition to the time of creation, and then deleted. This is done for our security, as far as in individual cases illegal contents are left behind in comments (e.g. insulting contents, forbidden political propaganda, etc.) which require clarification, in particular the determination of the identity of the author. We will delete comments with the aforementioned content immediately. Should the further storage of your IP address and the time of creation of the respective comment be necessary for evidence purposes, these (personal) data are excluded from deletion until the final clarification of the respective incident. This (personal) data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 (1) c GDPR.

9. Newsletter

With the following notes we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your right of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.

Content of the newsletter: We send e-mails and other (electronic) notifications with advertising information (hereinafter "newsletter") only with your consent or on the basis of a legal permission. If the contents of the newsletter are specifically rewritten within the scope of a registration for the newsletter, they are decisive for the consent. Furthermore, our newsletters contain information about our products, offers, promotions and our company.

Newsletters are sent by us or by a service provider where required.

Logging double opt-in and changes: The registration to our newsletter is done in a so-called Double-Opt-In-Procedure. This means that you will receive an e-mail after registration asking you to confirm your registration. This confirmation is necessary so that nobody can register with foreign e-mail addresses. The newsletter registrations are logged in order to be able to prove the registration process according to the legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Changes to your (personal) data stored by the shipping service provider are also logged.

According to its own information, the delivery service provider may use your (personal) data in pseudononymous form, i.e. without allocation to a user, to optimise and improve its own services, e.g. for technical optimisation of the delivery and presentation of newsletters or for statistical purposes to determine from which countries the recipients come. However, the dispatch service provider does not use your (personal) data to write to you itself or to pass on your (personal) data to third parties.

Registration data: To subscribe to the newsletter, you only need to enter your e-mail address. Optionally we ask you - for personal contact - to enter your first and last name.

Performance measurement: The newsletters contain a so-called "web beacon". This is a pixel-sized file that is retrieved from the server of the mailing service provider when the newsletter is opened. Within the scope of this retrieval, technical information such as information on the browser and your system, as well as your IP address and the time of retrieval are initially collected. This information is used in particular for the technical improvement of the services and to determine your reading habits. Statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. This information can be assigned to you for technical reasons.

The dispatch of the newsletter and the measurement of success are based on your consent in accordance with Art. 6 (1) a, Art. 7 GDPR in conjunction with § 7 (2) No. 3 of the German Act against Unfair Competition (UWG). The registration procedure is recorded on the basis of our legitimate interests in accordance with Art. 6 (1) f GDPR and serves as proof of your consent to receive the newsletter.

Withdrawal: You can withdraw the receipt of our newsletter at any time. You will find a link to withdraw the receipt of our newsletter at the end of each newsletter. Your (personal) data will be deleted in case of a withdrawal.

10. Integration of third-party services and content

The personal data processed by us will be deleted in accordance with Art. 17 GDPR. Unless expressly stated within the scope of this data protection declaration, the personal data stored by us will be deleted as soon as they are no longer required for their intended purpose and, in particular, there are no legal storage obligations to prevent deletion. If the personal data are not deleted because their processing is necessary for other and legally permissible purposes, the processing is restricted. This means that the personal data is blocked and not processed for other purposes.

Instead of deleting your personal data, we will, if necessary, make it anonymous in such a way that it is irreversibly impossible to retrieve it in the future.

In accordance with the legal requirements, storage takes place in particular for 6 years in accordance with § 257 (1) of the German Commerical Code (HGB) (commercial books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting vouchers, etc.) and for 10 years in accordance with § 147 (1) of the German Tax Code (AO) (books, records, management reports, accounting vouchers, commercial and business letters, documents relevant for taxation, etc.).

12. Your rights

You have the right to withdrawyour consent to the processing of your personal data in accordance with Art. 7 (3) GDPR at any time with effect for the future. Processing that has taken place before the revocation therefore remains lawful.

In accordance with Art. 15 GDPR, you can request information about your personal data processed by us.

In accordance with Art. 16 GDPR, you can demand the immediate correction of incorrect or incomplete personal data stored by us.

In accordance with Art. 17 GDPR, you can request the deletion of your personal data stored with us in accordance with the conditions stated there, unless legally prescribed retention periods prevent immediate deletion (cf. Art. 17 (3) GDPR) and/or another case of Art. 17 (3) GDPR exists and/or a new purpose justifies further processing.

In accordance with Art. 18 (1) GDPR, you can demand the restriction of data processing if one or more conditions in accordance with Art. 18 (1) GDPR lit. a to d apply.

In accordance with Art. 20 (1) GDPR, you can receive the personal data processed by us in a structured, common and machine-readable format and transfer this data to another responsible person without hindrance by us.

In addition, you can lodge an objection to the processing of your personal data in accordance with Art. 21 (1) GDPR. In the event of an objection, we will stop processing your personal data. However, the right of objection only applies if special circumstances arise from your personal situation. In addition, compelling reasons worthy of protection that speak in favour of processing may prevail. Furthermore, certain processing purposes may conflict with your right of objection.

According to Article 21 (2) GDPR, you have the right to object to the processing of your personal data for the purposes of direct marketing at any time and without further conditions. This also applies to profiling, insofar as it relates to such direct advertising. If you lodge an objection, your personal data will no longer be processed for these purposes (cf. Art. 21 (3) GDPR).

Without prejudice to any other administrative or judicial remedy, you also have the right to appeal to the competent supervisory authority (cf. Art. 77 GDPR) if you believe that the processing of your data violates data protection regulations. In this context, however, we would ask you to address a possible complaint to us first. We will then attempt to remedy the situation as quickly and effectively as possible.