1. General Information

The protection of your personal data is important to us. In this Privacy Policy, we inform you which personal data we process when you visit our website and use the contact functions offered via the website, the purposes for which this is done, and the legal basis for the processing.

Personal data means any information relating to an identified or identifiable natural person.

As a general rule, we process personal data only insofar as this is necessary for the provision and security of our website, the processing of enquiries, the performance of pre-contractual or contractual measures, or on the basis of another legal provision.

We endeavour to collect and process only the personal data that is necessary for the respective purpose.

In particular, this website does not use services for analytics, marketing or advertising purposes. In particular, we do not use Google Analytics or comparable analytics or tracking services. No external Google Fonts are loaded and no interactive Google Maps are embedded. Likewise, no social networks or external content such as YouTube, Vimeo or reCAPTCHA are embedded in the website.

2. Controller

The controller responsible for the processing of personal data on this website is:

Windräder Ingenieurbüro Cerbe & Dr. Rische GbR
Manfred-von-Ardenne-Ring 5
01099 Dresden
Tel +49 351-8112690
Fax +49 351-858934577
E-mail: info@windraeder-service.de

3. General Legal Bases for Processing

Depending on the specific processing operation, we process personal data on the basis of the following provisions:

·         Art. 6(1)(a) GDPR, where you have given your consent to the processing of your personal data for one or more specific purposes;

·         Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract;

·         Art. 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation to which we are subject;

·         Art. 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

Our legitimate interests may include, in particular, the secure, stable and technically reliable provision of our website, the processing of incoming enquiries, and the establishment, exercise or defence of legal claims.

Where special categories of personal data within the meaning of Art. 9(1) GDPR are processed, this is done only insofar as an appropriate legal basis exists under Art. 9 GDPR in conjunction with the applicable statutory provisions.

4. Collection and Processing of Personal Data When Visiting the Website

When you access our website, certain technical information is automatically processed by the web server or the technical infrastructure we use.

This may include, in particular:

·         IP address,

·         date and time of access,

·         browser type and browser version,

·         operating system used,

·         pages and files accessed,

·         referrer URL,

·         status or error messages, and

·         other technically necessary information.

This data is processed in particular for the technical provision of the website, to ensure the security and stability of the online service, to detect and rectify technical errors, and to prevent misuse and unauthorised access.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically reliable provision and protection of our website.

The data referred to above is not used to analyse the behaviour of individual visitors or to create user profiles for advertising purposes.

5. Hosting

Our website is hosted by the following provider:

dogado GmbH
Antonio-Segni-Straße 11
44263 Dortmund
Germany

As part of the hosting service, personal data generated when using our website may be processed. This may include, in particular, IP addresses, technical communication data, access and usage data, and data that you submit to us via forms.

The processing is carried out for the secure and technically reliable provision of our online service.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically secure and reliable provision of our website and the infrastructure required for this purpose.

Insofar as dogado processes personal data on our behalf, the processing is based on a data processing agreement pursuant to Art. 28 GDPR. dogado provides an appropriate data processing agreement for this purpose.

6. Recipients of Personal Data and Data Processors

As a general rule, we disclose personal data only if this is necessary for the respective processing purpose, if we are legally obliged to disclose it, or if another legal basis permits such disclosure.

Where we use external service providers that process personal data on our behalf, this is done on the basis of corresponding agreements pursuant to Art. 28 GDPR, insofar as the relevant requirements are met.

The service providers used for our website and/or the functions offered through it include, in particular:

·         dogado GmbH as hosting provider;

·         Microsoft in connection with the use of Microsoft 365 and/or Exchange Online for business e-mail communication, in particular for the e-mail mailbox of the person responsible for recruitment.

Within our company, personal data is made accessible only to those persons who require such data for their respective tasks.

Any further disclosure takes place only where an appropriate legal basis exists or where this is necessary to safeguard our legitimate interests.

7. Storage Period

As a general rule, we store personal data only for as long as is necessary for the respective processing purpose.

Once the purpose of the processing no longer applies, the data is deleted unless a statutory retention obligation exists or further storage is necessary for the establishment, exercise or defence of legal claims or for another legally permissible reason.

Statutory retention obligations may arise in particular from commercial and tax law provisions. In such cases, the retention period is determined by the applicable statutory requirements.

8. Cookies and Similar Technologies

Our website uses cookies and/or similar technologies.

These are exclusively technically necessary cookies and/or similar technologies that are required for the technical provision, functionality or security of the website.

We do not use cookies for analytics, marketing or advertising purposes and do not use cookies for profiling.

8.1 Contao HTTPS CSRF Token

Our website uses a CSRF protection token provided by Contao.

This token serves to protect the website and certain functions against so-called Cross-Site Request Forgery (CSRF) attacks. The cookie or corresponding value is used exclusively for the technical security of the website and is generally required only for the duration of the respective browser session.

8.2 PHP Session Cookie

A PHP session cookie may be used to manage a technical session.

This cookie is used exclusively for the technical management of the current session and enables the web server to assign multiple related requests to the same browser session. It is generally deleted when the browser session ends.

8.3 Legal Basis for Technically Necessary Cookies

Where information is stored on your terminal device or information already stored on your terminal device is accessed when cookies or similar technologies are used, this takes place only within the framework of the statutory requirements.

For technically strictly necessary processes, § 25(2) no. 2 TDDDG is particularly relevant. Under this provision, consent is not required if the storage of information or access to information already stored is strictly necessary to enable the provider of a digital service to provide a digital service expressly requested by the user.

Where consent is required for a process under § 25 TDDDG, it will be obtained before the relevant process begins.

9. Contact Form

If you contact us via the contact form provided on our website, we process the personal data you enter.

This may include, in particular:

·         first and last name,

·         contact details,

·         e-mail address,

·         telephone number, where applicable, and

·         the content of your message and any other information you voluntarily provide.

The processing is carried out to handle your enquiry, answer your questions and, where applicable, deal with follow-up questions.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is related to the performance of a contract or is necessary to take steps prior to entering into a contract.

In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us pursuant to Art. 6(1)(f) GDPR.

Where consent is obtained in an individual case, processing is based on Art. 6(1)(a) GDPR.

The data transmitted as part of a contact enquiry is deleted as soon as the enquiry has been conclusively dealt with and there are no statutory retention obligations or other legally permissible reasons for further storage.

10. Contact by E-mail, Telephone or Fax

If you contact us by e-mail, telephone or fax, we process the personal data you provide in order to handle your request.

This may include, in particular, your name, contact details, the content of communications and other information you provide.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is related to the performance of a contract or is necessary to take steps prior to entering into a contract.

In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us pursuant to Art. 6(1)(f) GDPR.

Where consent has been obtained, processing is based on Art. 6(1)(a) GDPR.

The data is deleted as soon as the purpose of the processing no longer applies and there are no statutory retention obligations or other legally permissible reasons for further storage.

11. Link to Google Maps

No interactive Google Maps are embedded on our website. We only use external links through which you can access Google Maps.

The provider of the Google services accessed is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

When you click on such a link, you leave our website and are redirected to Google Maps. Data processing by Google only takes place once you access the external website and/or service.

It cannot be ruled out that personal data may also be transferred to companies affiliated with Google, in particular Google LLC in the USA.

We ourselves do not transmit any personal data to Google merely by displaying the external link. Further data processing only takes place when you actively access the external link.

The link is provided on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing you with a convenient way to plan locations and routes.

For the processing of personal data by Google after you leave our website, Google is responsible as an independent controller. Google's privacy provisions apply in this respect.

12. Transfer of Data to Third Countries

Personal data is transferred to countries outside the European Union (EU) and/or the European Economic Area (EEA) only where the statutory requirements for such transfer are met.

In particular, when using cloud-based services, processing or access from countries outside the EU and/or EEA cannot always be completely ruled out, depending on their specific technical and organisational configuration.

Where personal data is transferred to a third country, this is done in compliance with Arts. 44 et seq. GDPR.

This may involve, in particular, an adequacy decision by the European Commission, appropriate safeguards such as the standard data protection clauses adopted by the European Commission, or another transfer mechanism permitted under Arts. 44 et seq. GDPR.

Which specific transfer mechanism applies in an individual case depends on the respective service, the specific configuration and the contractual conditions applicable at the time.

13. Withdrawal of Consent

Where we process personal data on the basis of your consent, you may withdraw your consent at any time with effect for the future.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before the withdrawal.

As a general rule, an informal notification to us is sufficient to withdraw consent, for example by e-mail to:

info@windraeder-service.de

14. Right to Object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where the processing is based on Art. 6(1)(e) or Art. 6(1)(f) GDPR.

We will then generally no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes.

15. Your Rights as a Data Subject

Subject to the statutory requirements, you have the following rights:

15.1 Right of Access

Under Art. 15 GDPR, you have the right to request information about the personal data we process and about other information provided for by law.

15.2 Right to Rectification

Under Art. 16 GDPR, you have the right to request the rectification of inaccurate personal data and, where applicable, the completion of incomplete personal data.

15.3 Right to Erasure

Under Art. 17 GDPR, you have the right to request the erasure of your personal data subject to the statutory requirements.

15.4 Right to Restriction of Processing

Under Art. 18 GDPR, you have the right to request restriction of the processing of your personal data subject to the statutory requirements.

This may apply in particular if:

·         you contest the accuracy of your personal data;

·         the processing is unlawful, but you request restriction of processing instead of erasure;

·         we no longer need the personal data, but you require it for the establishment, exercise or defence of legal claims;

·         you have objected to the processing and it has not yet been determined whose interests prevail.

15.5 Right to Notification

Subject to the statutory requirements, under Art. 19 GDPR you have the right to have us inform recipients to whom your personal data has been disclosed about any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort.

15.6 Right to Data Portability

Under Art. 20 GDPR and subject to the statutory requirements, you have the right to receive personal data that you have provided to us and that we process by automated means on the basis of your consent or for the performance of a contract, in a structured, commonly used and machine-readable format.

Subject to the statutory requirements, you may also request that we transmit this data directly to another controller.

15.7 Right to Object

The right to object under Art. 21 GDPR is explained in more detail in Section 16 of this Privacy Policy.

16. Automated Decision-Making and Profiling

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, which produces legal effects concerning you or similarly significantly affects you, takes place in connection with the use of our website.

17. Right to Lodge a Complaint with a Supervisory Authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.

The data protection supervisory authority responsible for our company is, in particular:

Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17
01067 Dresden
Germany
Telephone: +49 351 85471-101

Further information and current contact details can be found on the authority's website.

The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

18. SSL/TLS Encryption

For security reasons, this website uses SSL/TLS encryption.

You can recognise an encrypted connection by the fact that the address bar of your browser begins with “https://” and, where applicable, displays a padlock symbol.

SSL/TLS encryption protects the transmission of data that you send to us during transmission against access by unauthorised third parties.

However, encryption of the transmission does not mean that personal data is no longer processed after it has been received by us or by service providers engaged by us.

19. Security of Data Processing

We take appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure or unauthorised access.

The security measures are adapted in line with technological developments and taking into account the respective risks.

Despite appropriate technical measures, complete security of data transmission over the Internet cannot be guaranteed.

20. Contact Regarding Data Protection

If you have any questions about the processing of your personal data or wish to exercise your rights as a data subject, you can contact us at any time:

Windräder Ingenieurbüro Cerbe & Dr. Rische GbR
Manfred-von-Ardenne-Ring 5
01099 Dresden
Tel +49 351-8112690
Fax +49 351-858934577
E-mail: info@windraeder-service.de

We will process your request in accordance with the statutory requirements.

Source: https://www.e-recht24.de