Data privacy statement
As the data controller we have prepared this privacy notice to inform you in accordance with the requirements of the EU General Data Protection Regulation 2016/679 (GDPR) about the nature, scope and purpose of the processing of personal data in relation to the services we offer on our web site.
I. Definitions
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
‘Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
II. General Information
1. The data controller
Weil Technology GmbH
Neuenburger Str. 23
79379 Müllheim
Germany
Telephone: +49 7631 1809 0
Telefax: +49 7631 1809 149
E-Mail: info@weil-technology.com
2. Contact details of the Data Protection Officer
OBSECOM GmbH
Königstr. 40
70173 Stuttgart
Germany
Telephone: 0711 / 4605025-40
Telefax: 0711 / 4605025-49
E-Mail: datenschutz@obsecom.de
Webseite: https://www.obsecom.eu
3. Legal bases
We process personal data based on at least one of the following legal bases:
• The data subject has given consent to the processing of his or her personal data for one or more specific purposes (Art. 6 (1) lit. a GDPR);
• Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1) lit. b GDPR);
• Processing is necessary for compliance with a legal obligation to which we are subject (Art. 6(1) lit. c GDPR);
• Processing is necessary in order to protect the vital interests of the data subject or of another natural person (Art. 6 (1) lit. d GDPR);
• Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party (Art. 6 (1) lit. f GDPR)
In this privacy policy we refer to the respective legal basis of the individual data processing operations.
4. Onward transfer of personal data
We forward personal data to recipients (data processors or other third parties) only to the extent required and only if one of the subsequent conditions are met:
• the data subject has consented to the data transfer;
• the onward transfer is required to fulfil a contractual obligation or pre-contractual measure on the request of the data subject;
• we are obliged by law to make such a transfer;
• The onward transfer is made on the basis of our legitimate interest or on those of a third party.
5. Third countries
The transfer of personal data to a third country or an international organisation outside the European Union (EU) or the European Economic Area (EEA) is subject to legal or contractual permission only in accordance with the provisions under Art. 44 et seq. GDPR. It means that pursuant to Art. 45 GDPR an adequacy decision of the EU commission must be present for the respective country, appropriate safeguards for data privacy under Art. 46 GDPR, or Binding Corporate Rules under Art. 47 GDPR do exist. In individual cases, a data transfer may be permitted on the basis of an exception under Art. 49 GDPR.
We may use on our web site we external services provided by organisations based in the USA. If these services are active, personal data is collected in connection with the provision of the relevant service and may be transferred to and stored on servers in the USA. The European Court of Justice considers the USA to have an inadequate level of data protection. When data is transferred to the US, there is a fundamental risk that the US authorities may access and use the data for surveillance and monitoring purposes without notification and without the possibility of a legal remedy.
6. Rights of data subjects
As a data subject you have the following right:
• Pursuant to Art. 15 GDPR to request information about your personal data processed by us. You may also request information regarding the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed; the envisaged period for which the personal data will be stored, or the criteria used to determine that period; where the personal data are not collected from you, the data source; the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing; the existence of the right to request rectification or erasure of data concerning you, the right to restrict processing or to object to such processing, the right to lodge a complaint with a supervisory authority. Finally, you have a right to know whether personal data has been transferred to a third country or to an international organisation, and, if so, the appropriate safeguards relating to this transfer;
• Pursuant to Art. 16 GDPR to demand the immediate rectification of inaccurate personal data and to have incomplete personal data that are stored by us to be completed;
• Pursuant to Art. 17 GDPR to demand the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of a legal claim;
• Pursuant to Art. 18 GDPR to request the restriction of the processing of your personal data if the accuracy of the personal data is contested by you; the processing is unlawful but you oppose the erasure of the personal data and request the restriction of their use instead; we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; you have objected to processing pursuant to Art. 21(1) GDPR pending the verification whether our legitimate grounds override your interests;
• Pursuant to Art. 20 GDPR to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller;
• Pursuant to Art. 21 GDPR to object to the processing of your personal data on grounds relating to your particular situation, or if you object to processing for direct marketing purposes and the legal basis for the processing are our legitimate interests pursuant to Art. 6 (1) lit. f GDPR;
• Pursuant to Art. 7(3) GDPR to withdraw your consent given to us at any time. As a result, we are no longer allowed to continue to process the data that was based on this consent in the future;
• Pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. A list of contact details of the data protection officers and supervisory authorities can be found on this web site: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
If you wish to assert the data subject rights mentioned above, you can contact us or our data protection officer at any time using the contact details above.
7. Erasure and restriction of personal data
Unless otherwise provided for in this privacy notice, personal data will be deleted, if these data are no longer necessary in relation to the purposes for which they were collected or otherwise processed and the deletion does not conflict with statutory retention requirements. In addition, we will erase the personal data processed by us in accordance with Art. 17 GDPR on your request, if the conditions provided therein are met. If personal data are required for other lawful purposes, they will not be erased, but their processing will be restricted in accordance with Art. 18 GDPR. In case of restriction, the data will not be processed for other purposes. This applies, for example, to personal data that must be retained by us for commercial or tax law reasons. For example, data must be kept for 6 years pursuant to Section 257 (1) Nos. 2 and 3 German Commercial Code (HGB) and Section 147 (1) Nos. 2, 3, 5 German Tax Code (AO); data must be kept for 10 years pursuant to Section 257 (1) Nos. 1 and 4 HGB and Section 147 (1) No. 1, 4, 4a AO.
8. Cookies
Our web site uses cookies. Cookies are small text files that your browser automatically creates and stores on your device (laptop, tablet, smartphone, PC, etc.) when you visit our web site. Cookies do no harm to your device, nor do they contain any viruses or other malicious software. The cookie stores information which is created in relation to the specific device you are using. However, this does not mean that we become immediately aware of your identity. Cookies are mainly used to make the web site more user-friendly, effective and secure.
We use the following cookies on our web site:
Necessary cookies
The data processed by necessary cookies are required for the aforementioned purposes to protect our legitimate interests and those of third parties in the provision and operation of our website in accordance with Art. 6 (1)(f) GDPR.
Name: cookie_consent_user_accepted
Name: _gat_gtag_UA_125190125_1
Provider: Google
Purpose: Google Aanlytics: throttles the request rate to limit data collection on high traffic websites
Expires: 10 Minutes
Sample content: 1
Further information: https://policies.google.com/privacy?hl=en
Name: cookie_consent_level
Cookies for tracking and statistics
The legal basis for the use of cookies for advertising and market research is your voluntarily given consent in accordance with Art. 6 (1) lit. a GDPR.
Name: _ga
Provider: Google
Purpose: Google Universal Analytics. Differentiation of unique users by randomly generated number as client ID. Used to identify returning visitors, calculate visitor, session and campaign data.
Expires: 2 Years
Sample content: GA1.3.1369932704.1580458261
Further information: https://policies.google.com/privacy?hl=en
Name: _gid
Provider: Google
Purpose: Google Universal Analytics. Used to distinguish users.
Expires: 24 Hours
Sample content: GA1.3.1183256634.1586250684
Further information: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=en
Most browsers accept cookies automatically. However, if you do not wish to accept cookies, you can configure your browser so that no cookies are stored on your device or a message is displayed before new cookies are created. Information on how to remove cookies in Internet Explorer / Edge, please refer to: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies. Information on the removal of cookies in Firefox, please refer to: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox?redirectlocale=en-US&redirectslug=delete-cookies-remove-info-websites-stored. Learn how to remove cookies in Safari here: https://support.apple.com/en-gb/guide/safari/sfri11471/mac.
A general objection to the use of cookies used for online marketing purposes can be made for a variety of services, such as explained at http://www.youronlinechoices.com/ or the opt-out page of the Network Advertising Initiative http://optout.networkadvertising.org. However, disabling cookies may mean that you may not be able to use all the features of our web site.
III. Individual processing operations
1. Hosting
In order to make our web site available, we use services provided by hosting companies, such as: Provision of web servers, disk space, database services, and security or maintenance services. Here we, or our hosting providers, process personal data of the web site visitors based on our legitimate interests in providing efficient and secure access to our web site in accordance with Art. 6 (1) lit. f GDPR.
2. Access data and log files
By visiting our web site or its individual pages, your device’s internet browser automatically sends information to the server of our web site. This information is stored in so-called log files by us or our hosting provider and will be deleted after 6 Months at the latest.
The following information is stored:
• IP address of the requesting computer;
• Date and time of access;
• Name and URL of the requested file;
• Web site from which our site was accessed (Referrer-URL);
• The browser used and your computer’s operating system;
• Status codes and the transferred amount of data;
• Name of your access providers.
This data will be used for the following purposes:
• The provision of our web site, including all of its features and contents;
• To ensure a smooth connection to our web site;
• To ensure a more user-friendly experience on our web site;
• To ensure system security and stability;
• For anonymised statistical evaluation of web site access;
• To optimise our web site;
• For disclosure to law enforcement authorities in the event of unlawful interference / attacks on our systems;
• For further administrative purposes.
The legal basis for data processing is Art. 6 (1)(f) GDPR. Our legitimate interest relates to the data collection purposes mentioned above. Under no circumstances will we use the personal data collected for the purpose of drawing conclusions about a person.
3. General means of contact
If you contact us using the contact details published on our web site (for example, by e-mail) and in this context provide us with personal data, we will use this data to process your request on the basis of Art. 6 (1)(b) GDPR, if your request is related to the performance of a contract or is required to perform pre-contractual action. In all other cases, processing is based on your consent in accordance with Art. 6 (1)(a) GDPR and / or our legitimate interest in the effective processing of requests addressed to us pursuant to Art. 6 (1)(f) GDPR. We will store your personal data until you ask us for deletion, revoke your consent to the storage, or the data are no longer necessary for the purpose for which they were collected (for example, after completion of your request). Mandatory statutory provisions - especially retention periods - remain thereof unaffected.
4. Contact form
If you use the contact form, you will be asked to provide your e-mail address, Name and any other contact details, so that we can get in touch with you. Further information can be provided voluntarily. The data processing for the purpose of contacting us and answering your request takes place in accordance with Art. 6 (1)(a) GDPR based on your voluntary consent. All personal data collected in connection with the contact form will be deleted after your request has been processed, unless further storage is required for the documentation of other transactions (for example, subsequent conclusion of a contract). We use an external service provider on our website to manage contact requests. The provider is HubSpot, Inc.; 25 First Street, Cambridge, MA 02141; USA.
5. E-Mail direct marketing to customers
If you are an existing customer and we have received your e-mail address in connection with the sale of goods or services, we may use your e-mail address for direct marketing purposes of our own similar goods or services. This only applies if you have not objected and we clearly and unequivocally have advised you of the possibility of objection at the time of collecting the e-mail address, and every time we use it. The legal basis of processing is our legitimate interest in direct marketing according to Art. 6 (1)(f) GDPR.
6. Newsletter
If you would like to receive our newsletter, we need your e-mail address and name. The data processing for the purpose of sending the newsletter takes place in accordance with Art. 6 (1)(a) GDPR based on your voluntary consent by means of the so-called double-opt-in procedure. The e-mail address will be used and stored for this purpose until you withdraw your consent or unsubscribe from receiving the newsletter. You can unsubscribe at any time, for example by using the link at the bottom of each newsletter. You can also send your withdrawal/unsubscribe request at any time to the e-mail address given under Clause II.
7. Hubspot
We use the Hubspot marketing platform to manage our online marketing activities. The provider is HubSpot, Inc; 25 First Street, Cambridge, MA 02141; USA (hereinafter ‘Hubspot’). Hubspot processes personal data on our behalf for the purpose of website analysis, to send and evaluate the reach of our newsletters and the processing of form inputs (for example, contact form). For this purpose, we transfer information to Hubspot about the use of this website, usage behaviour and, among other things, information such as browser type / version, operating system, referrer URL (the previously visited page), host name of the accessing computer and time of server request. This data is used to ensure that our website is designed to meet the needs of our customers and is continuously optimised, to measure the success of marketing measures and to create statistical evaluations. For the purpose of sending newsletters, we transfer your e-mail address and, if necessary, other data required for the provision of the newsletter to Hubspot.
We embed so-called tracking pixels into our newsletters to analyse reader behaviour of the subscribers. Among other things, we record how many recipients have opened the newsletter, how often readers have clicked on certain links in the newsletter and whether readers have carried out predefined actions after clicking on a link. We use this data to create statistical evaluations of the success or failure of our marketing campaigns, optimise the newsletter mailing and tailor the content of future newsletters to your interests. The collected data is deleted after a statistical evaluation. If you do not agree with the analysis of your reading behaviour, you must unsubscribe from the newsletter. You can unsubscribe at any time, for example via a link at the end of each newsletter, via an unsubscribe form on our website or by e-mail to the e-mail address stated above.
The legal basis for data processing by Hubspot is our legitimate interest in a demand-driven website and the use of a user-friendly and secure newsletter system in accordance with Art. 6 (1)(f) GDPR.
The personal data collected may be stored on servers in the USA. The data transfer to Hubspot is legitimised according to Art. 46 (2)(c) GDPR based on the EU Standard Contractual Clauses. A copy of the Standard Contractual Clauses can be viewed at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en.
For more information on how Hubspot handles your personal data, please refer to the privacy policy at: https://legal.hubspot.com/de/privacy-policy.
8. Application form
If you use our application form, you will be asked to provide your name, contact information and further application documents so that we can review your application and contact you. The data processing for the purpose of processing your application is carried out in accordance with Art. 6 (1)(a) GDPR based on your voluntary consent. Taking into account the limitation periods of the General Equal Treatment Act (AGG), application documents will be kept for a period of 6 months after completion of the application process and then deleted, unless storage is required for the documentation of other operations (for example, subsequent recruitment).
Your application will be sent to the central personnel department of the group of companies for processing and processing. In addition, your application will be made available to the personnel department of the respective location. The legal basis is our justified interest in central internal processing for administrative purposes in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR.
If you apply for a job at a location in the USA, your application data will be transmitted to Weil Technology North America LLC (WENA). The transfer of data to WENA is legitimised according to Art. 46 (2) lit. c DS-GVO based on the EU standard contractual clauses. A copy of the EU Standard Contractual Clauses can be found at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en.
9. Video surveillance
To safeguard the company’s property, to investigate theft, and for the settlement of claims, we monitor the publicly accessible area of our premises and the company’s access areas at Neuenburger Str. 23, Müllheim, at times when the premises are unattended. Images recorded will be deleted automatically within a few days after the purpose for data processing was accomplished. Video surveillance is carried out based on our legitimate interests for the prevention of criminal offenses under Art. 6 para. 1 lit. f GDPR.
10. Whistleblower protection reporting portal
For the receipt of information in accordance with the Whistleblower Protection Act, we refer to the reporting portal of our external liaison officer, who is responsible for the operation of our internal reporting centre. The provider is OBSECOM GmbH, Königstr. 40, 70173 Stuttgart, Germany, e-mail: mitteilungen@obsecom.de. For the purpose of receiving and processing reports, the reporting centre collects and processes the salutation, name, email address, telephone number and type of affiliation to the company of the person making the report. The purpose of the data processing is to confirm receipt of the report in order to maintain contact with the whistleblower, to request further information if necessary or to refer to other competent bodies and to provide the whistleblower with feedback on follow-up measures. The legal basis for data processing is Art. 6 para. 1 sentence 1 lit c) GDPR in conjunction with Art. 10 HinwSchG. § Section 10 HinwSchG. If a report is made by telephone, voice message or in the context of a meeting, the reporting centre can save the reports as a permanently accessible audio recording of the conversation or its complete and accurate transcript (verbatim record). The purpose of the data processing is to document the report. Data will only be stored as audio recordings or verbatim transcripts if the person providing the information has consented to this in advance. The legal basis for data processing is the voluntarily granted consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR in conjunction with Section 11 para. 2 HinwSchG. § Section 11 para. 2 HinwSchG. All personal data collected in connection with a notification will be stored for a period of 3 years after completion of the procedure in accordance with Section 11 (5) HinwSchG and then deleted.
IV. Google Services
Provider of the services below is Google Ireland Limited (Register No: 368047), Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter „Google“).
The information collected by Google in connection with the provision of the respective services may be transferred to and processed by Google servers in the USA. Please also note our information on data transfer to third countries, see above.
For more information about how Google handles personal data, please refer to Google’s Privacy Policy: https://www.google.com/intl/de/policies/privacy/. For information on the use of data for advertising purposes by Google, settings and your right to object please refer to: https://www.google.de/policies/privacy/partners/, https://www.google.de/policies/technologies/ads/, https://adssettings.google.de/
1. Google services for which your consent is required
The legal basis for the use of the following services is your voluntarily given consent according to Art. 6 (1)(a) GDPR. The legal basis for data transfer to the USA is also your voluntarily given consent in accordance with Art. 49 (1)(a) GDPR.
Google Analytics
Our Web site uses Google Analytics. Google Analytics uses cookies. Google Analytics collects information about the visits of web site users and analyses their behavior. This data serves the purpose of developing a user-friendly web site design, the continuous optimisation of our services and offers, to measure the success of marketing activities, and to create statistical analysis. In this context, pseudonymised user profiles are created and cookies are used. Google Analytics collects information such as browser type / version, operating system, referrer URL (the previously visited page), host name of the accessing computer (IP address), time of server request. The information generated is transferred to the US and stored on servers owned by Google. The collected user data and event data will be deleted after after 26 months. Information may also be transferred to third parties if required by law or if third parties process this data on behalf of us or Google. Under no circumstances will your IP address be merged with any other data that is kept by Google. The IP address will be anonymised so that assignment is impossible. You can prevent the local storage of cookies by configuring your browser software accordingly. However, be advised that in this case you may not be able to use all the features of this web site to the full extent possible. Additionally, in order to prevent Google from collecting and processing the data generated in relation to your use of the web site you may download and install the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en. You can prevent Google from gathering your data by clicking on this link [Google Analytics deaktivieren] which sets an opt-out cookie on your computer. This cookie ensures that Google Analytics will not collect and store any user data from your browser when visiting this web site. Attention: If you delete your cookie cache, this will result in the opt-out cookie being deleted as well. Then you must re-activated the opt-out cookie again.
2. Other Google services
The legal basis for the use of the following services are our legitimate interests according to Art. 6 (1)(f) GDPR. Our legitimate interests are listed below for each service individually.
Google reCAPTCHA
This web site uses Google reCAPTCHA to ensure that the forms provided on our web site are used by an actual person and are not abused by bots or automated procedures. We use this service in our legitimate interest in the security of our website and the detection of bot activity. This service collects your IP address and any additional data required by Google for providing the reCAPTCHA service. The collected information about your use of this web site is stored on servers in the USA. This information may also be transferred to third parties if required by law or if third parties process this data on behalf of us or Google.
Google Tag Manager
This web site uses Google Tag Manager in order to manage web site through a single tag management interface. Google Tool Manager only implements tags. This means: no cookies are used and no personal data is collected. Google Tag Manager triggers other tags, which may collect data. However, Google Tag Manager does not access this data. If deactivated at the domain or cookie level, it will remain effective for all tracking tags as far as they are implemented with the Google Tag Manager.
