Privacy Policy

1. Introduction

With the following information, we would like to give you, as a "data subject," an overview of the processing of your personal data by us and your rights under data protection law. In principle, our website can be used without providing personal data. However, if you wish to use special services offered by our company via our website, it may become necessary to process personal data. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain your consent.

The processing of personal data, such as your name, address, or email address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to "thoenes Dichtungstechnik GmbH." Through this privacy policy, we would like to inform you about the scope and purpose of the personal data we collect, use, and process.

As the party responsible for processing, we have implemented numerous technical and organizational measures to ensure the most complete protection possible of the personal data processed via this website. Nevertheless, internet-based data transmissions can generally have security gaps, so absolute protection cannot be guaranteed. For this reason, you are free to transmit personal data to us via alternative means, for example by telephone or by post.

You, too, can take simple and easily implementable measures to protect yourself against unauthorized access by third parties to your data. Therefore, we would like to give you some tips on how to handle your data securely:

• Protect your account (login, user or customer account) and your IT system (computer, laptop, tablet, or mobile device) with secure passwords.
• Only you should have access to your passwords. Make sure you always use your passwords for only one account (login, user, or customer account).
• Do not use one password for different websites, applications, or online services.
• Especially when using publicly accessible IT systems or systems shared with other people: you should always log out again after every login on a website, application, or online service.
  
  

Passwords should consist of at least 12 characters and should be chosen so that they cannot be easily guessed. Therefore, they should not contain common everyday words, your own name, or the names of relatives, but rather upper and lower case letters, numbers, and special characters.

2. Controller

The controller within the meaning of the GDPR is:

thoenes Dichtungstechnik GmbH Zeppelinstraße 1, 01665 Klipphausen, Germany

Phone: +49 35204 39280
Fax: +49 35204 392850
Email: info@thoenes-solution.com

Representatives of the controller: Thomas Zocher, Dr. Rudolf Zocher

3. Data Protection Officer

We would like to point out that no data protection officer needs to be appointed.

Contact person for data protection matters: info@thoenes-solution.com

4. Definitions

This privacy policy is based on the terms used by the European legislator when issuing the General Data Protection Regulation (GDPR). Our privacy policy should be easy to read and understand for both the general public and our customers and business partners. To ensure this, we would like to first explain the terminology used.

In this privacy policy, we use, among others, the following terms:

1. Personal data

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

2. Data subject

Data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing (our company).

3. Processing

Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

4. Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.

5. Profiling

Profiling is any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

6. Pseudonymization

Pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

7. Processor

Processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

8. Recipient

Recipient means a natural or legal person, public authority, agency, or other body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

9. Third party

Third party means a natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

10. Consent

Consent means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Our offering is generally aimed at adults. Persons under the age of 16 may not transmit any personal data to us without the consent of a parent or legal guardian. We do not request personal data from children and minors, do not collect it, and do not pass it on to third parties.

5. Transfer of data to third parties

Your personal data is not transferred to third parties for purposes other than those listed below.

We pass on your personal data to third parties only if:

1. You have given your explicit consent pursuant to Art. 6(1)(a) GDPR,

2. the disclosure is permitted under Art. 6(1)(f) GDPR to safeguard our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,

3. there is a legal obligation for disclosure under Art. 6(1)(c) GDPR, and

4. it is legally permissible and required under Art. 6(1)(b) GDPR for the processing of contractual relationships with you.

To protect your data and, where applicable, to enable us to transfer data to third countries (outside the EU/EEA), we have concluded data processing agreements based on the European Commission's standard contractual clauses. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR may serve as the legal basis for transfer to third countries. This does not apply to data transfers to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

Your personal data is not transferred to third parties for purposes other than those listed below.

We pass on your personal data to third parties only if:

1. You have given your explicit consent pursuant to Art. 6(1)(a) GDPR,

2. the disclosure is permitted under Art. 6(1)(f) GDPR to safeguard our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,

3. there is a legal obligation for disclosure under Art. 6(1)(c) GDPR, and

4. it is legally permissible and required under Art. 6(1)(b) GDPR for the processing of contractual relationships with you.

As part of the processing operations described in this privacy policy, personal data may be transferred to the USA. The USA does not have an adequate level of data protection (ECJ: Schrems II ruling). In particular, US investigative authorities may require US companies to hand over or disclose personal data without the data subjects being able to take effective legal action against this. There is therefore, in principle, a possibility that your personal data may be processed by US investigative authorities. We have no influence over these processing activities. To protect your data, we have concluded data processing agreements based on the European Commission's standard contractual clauses. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR may serve as the legal basis for transfer to third countries. This does not apply to data transfers to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

6. Technology

6.1 SSL/TLS encryption

To ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data, or contact inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar shows "https://" instead of "http://" and by the lock symbol in your browser bar.

We use this technology to protect your transmitted data.

6.2 Data collection when visiting the website

In the case of merely informational use of our website, i.e., when you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). Our website collects a series of general data and information each time you or an automated system accesses a page. This general data and information is stored in the server's log files. The following may be recorded:

1. browser types and versions used,

2. the operating system used by the accessing system,

3. the website from which an accessing system reaches our website (so-called referrers),

4. the sub-pages accessed via an accessing system on our website,

5. the date and time of access to the website,

6. an internet protocol address (IP address), and

7. the internet service provider of the accessing system.

When using this general data and information, we do not draw any conclusions about your person. Rather, this information is needed to:

1. correctly deliver the content of our website,

2. optimize the content of our website and the advertising for it,

3. ensure the long-term functionality of our IT systems and the technology of our website, and

4. provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.

This collected data and information is therefore evaluated by us statistically and further with the goal of increasing data protection and data security at our company, in order to ultimately ensure an optimal level of protection for the personal data we process. The data from the server log files is stored separately from all personal data provided by a data subject.

The legal basis for the data processing is Art. 6(1) sentence 1(f) GDPR. Our legitimate interest follows from the purposes for data collection listed above.

6.3 Encrypted payment transactions

If there is an obligation to transmit your payment data to us (e.g., account number when granting a direct debit authorization) after the conclusion of a fee-based contract, this data is required for payment processing.

Payment transactions via the common means of payment (Visa/MasterCard or direct debit procedure) are carried out exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the lock symbol in your browser bar.

We use this technology to protect your transmitted data.

7. Cookies

7.1 General information about cookies

Cookies are small files that your browser automatically creates and that are stored on your IT system (laptop, tablet, smartphone, etc.) when you visit our site.

Information is stored in the cookie that results from the context of the specific device used. However, this does not mean that we thereby gain direct knowledge of your identity.

The use of cookies serves to make the use of our offering more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted when you leave our site.

In addition, we also use temporary cookies to optimize user-friendliness, which are stored on your device for a specific, defined period of time. If you visit our site again to use our services, it is automatically recognized that you have already been with us and what entries and settings you have made, so that you do not have to enter these again.

Furthermore, we use cookies to statistically record the use of our website and to evaluate our offering for the purpose of optimization. These cookies enable us to automatically recognize, when you visit our website again, that you have already visited it. The cookies set in this way are automatically deleted after a respectively defined period of time. The respective storage period of the cookies can be found in the settings of the consent tool used.

7.2 Legal basis for the use of cookies

The data processed by cookies that are required for the proper functioning of the website is thus necessary to safeguard our legitimate interests and those of third parties pursuant to Art. 6(1)(f) GDPR.

For all other cookies, you have given your consent via our opt-in cookie banner within the meaning of Art. 6(1)(a) GDPR.

7.3 Notes on avoiding cookies in common browsers

Via the settings of the browser you use, you have the option at any time to delete cookies, allow only selected cookies, or disable cookies entirely. You can find further information on the support pages of the respective providers:

• Chrome: https://support.google.com/chrome/answer/95647?tid=311178978.
• Safari: https://support.apple.com/de-at/guide/safari/sfri11471/mac?tid=311178978.
• Firefox: https://support.mozilla.org/de/kb/cookies-und-website-daten-in-firefox-loschen?tid=311178978.
• Microsoft Edge: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-l%C3%B6schen-63947406-40ac-c3b8-57b9-2a946a29ae09.

8. Content of our website

8.1 Registration as a user

You have the option to register on our website by providing personal data.

Which personal data is transmitted to us in this process is evident from the respective input mask used for registration. The personal data you enter is collected and stored exclusively for internal use by us and for our own purposes. We may arrange for the transfer to one or more processors, for example a parcel delivery service provider, which likewise uses the personal data exclusively for internal use attributable to us.

Registration on our website also stores the IP address assigned by your internet service provider (ISP), as well as the date and time of registration. This data is stored against the background that this is the only way to prevent misuse of our services, and this data, if necessary, enables the investigation of crimes committed. Insofar, the storage of this data is necessary for our protection. This data is generally not passed on to third parties, unless we are legally obligated to do so or the disclosure serves the purpose of prosecution.

Your registration, with voluntary disclosure of personal data, also serves to offer you content or services that, due to the nature of the matter, can only be offered to registered users. Registered persons are free to change the personal data provided at registration at any time or to have it completely deleted from our data stock.

We will provide you at any time upon request with information about what personal data is stored about you. Furthermore, we will correct or delete personal data at your request, provided this does not conflict with statutory retention obligations. A data protection officer named in this privacy policy and all other employees are available to the data subject as contact persons in this regard.

The processing of your data takes place in the interest of a convenient and simple use of our website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

8.2 Data processing when opening a customer account and for contract processing

Pursuant to Art. 6(1)(b) GDPR, personal data is collected and processed when you provide it to us for the performance of a contract or when opening a customer account. Which data is collected can be seen from the respective input forms. Deletion of your customer account is possible at any time and can be done, among other things, by sending a message to the controller's address given above. We store and use the data you provide for contract processing. After complete processing of the contract or deletion of your customer account, your data is blocked, taking into account tax and commercial retention periods, and deleted after these periods have expired, unless you have expressly consented to further use of your data or a legally permitted further use of data has been reserved by us, of which we inform you accordingly below.

8.3 Data processing for order processing

The personal data we collect is passed on to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. We pass on your payment data to the commissioned credit institution as part of payment processing, insofar as this is necessary for payment processing. If payment service providers are used, we will inform you of this explicitly below. The legal basis for the disclosure of data is Art. 6(1)(b) GDPR.

8.4 Data processing for identity verification

To the extent necessary, we verify your identity on the legal basis of Article 6(1)(b) and (f) GDPR with the help of information from service providers. The authorization to do so results from the protection of your identity and the avoidance of attempted fraud to our detriment. The fact and result of our inquiry is added to your customer account or guest account for the duration of the contractual relationship.

8.5 Conclusion of contracts for online shop, retailer, and shipment of goods

We transmit personal data to third parties only if this is necessary in the course of contract processing, for example to the companies entrusted with the delivery of the goods or the credit institution commissioned with payment processing. No further transmission of the data takes place, or only if you have expressly consented to the transmission. Your data is not passed on to third parties without your express consent, for example for advertising purposes.

The basis for data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

8.6 Contact / contact form

Personal data is collected when you contact us (e.g., via contact form or email). Which data is collected when using a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted after your request has been finally processed; this is the case when it can be inferred from the circumstances that the matter in question has been finally clarified and there are no statutory retention obligations that conflict with deletion.

8.7 Blog comment function

We offer users on a blog located on our website the opportunity to leave individual comments on individual blog posts. A blog is a portal maintained on a website, generally publicly viewable, in which one or more persons, called bloggers or web bloggers, can post articles or write down thoughts in so-called blog posts. Blog posts can generally be commented on by third parties.

If you leave a comment on the blog published on this website, in addition to the comments you leave, information on the time of the comment entry and the username you chose are also stored and published. Furthermore, the IP address assigned by your internet service provider (ISP) is also logged. This storage of the IP address takes place for security reasons and in case you violate the rights of third parties or post illegal content through a comment made. The storage of this personal data therefore takes place in our own interest, so that we can exculpate ourselves in the event of a legal violation. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. This collected personal data is not passed on to third parties, unless such disclosure is legally required or serves our legal defense.

8.8 Application management / job exchange

We collect and process the personal data of applicants for the purpose of handling the application process. Processing may also take place electronically. This is particularly the case if an applicant submits corresponding application documents to us electronically, for example by email or via a web form on the website. If we conclude an employment or service contract with an applicant, the transmitted data is stored for the purpose of processing the employment relationship in compliance with statutory provisions. If we do not conclude a contract with the applicant, the application documents are automatically deleted two months after notification of the rejection decision, unless deletion conflicts with other legitimate interests on our part. Another legitimate interest in this sense is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

The legal basis for processing your data is Art. 88 GDPR in conjunction with Section 26(1) BDSG.

9. Newsletter dispatch

9.1 Promotional newsletter

On our website, you are given the opportunity to subscribe to our company's newsletter. Which personal data is transmitted to us when ordering the newsletter can be seen from the input mask used for this purpose.

We inform our customers and business partners at regular intervals about our offers by way of a newsletter. Our company's newsletter can generally only be received by you if

1. you have a valid email address, and

2. you have registered for the newsletter dispatch.

For legal reasons, a confirmation email will be sent using the double opt-in procedure to the email address you entered for the first time for newsletter dispatch. This confirmation email serves to verify whether you, as the owner of the email address, have authorized receipt of the newsletter.

When registering for the newsletter, we also store the IP address of the IT system used by you at the time of registration, as assigned by your internet service provider (ISP), as well as the date and time of registration. The collection of this data is necessary in order to be able to trace (possible) misuse of your email address at a later date, and therefore serves our legal protection.

The personal data collected as part of a registration for the newsletter is used exclusively for sending our newsletter. Furthermore, subscribers to the newsletter may be informed by email if this is necessary for the operation of the newsletter service or a registration in this regard, as might be the case in the event of changes to the newsletter offering or a change in the technical circumstances. The personal data collected as part of the newsletter service is not passed on to third parties. You can cancel your subscription to our newsletter at any time. The consent to the storage of personal data that you have given us for newsletter dispatch can be revoked at any time. A corresponding link can be found in every newsletter for the purpose of revoking consent. Furthermore, there is the option to unsubscribe from the newsletter dispatch at any time directly on our website or to inform us of this in another way.

The legal basis for data processing for the purpose of newsletter dispatch is Art. 6(1)(a) GDPR.

9.2 CleverReach

This website uses CleverReach for sending newsletters. The provider is CleverReach GmbH & Co. KG, (CRASH Building), Schafjückenweg 2, 26180 Rastede. CleverReach is a service with which newsletter dispatch can be organized and analyzed. The data you enter for the purpose of newsletter subscription (e.g., the email address) is stored on CleverReach's servers in Germany or Ireland.

Our newsletters sent with CleverReach enable us to analyze the behavior of newsletter recipients. Among other things, it can be analyzed how many recipients opened the newsletter message and how often which link in the newsletter was clicked. With the help of so-called conversion tracking, it can also be analyzed whether a predefined action (e.g., the purchase of a product on our website) took place after clicking the link in the newsletter. Further information on data analysis by CleverReach newsletters can be found at: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.

The data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the revocation.

If you do not want analysis by CleverReach, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in each newsletter message. Furthermore, you can also unsubscribe from the newsletter directly on the website.

You can revoke the consent you have given at any time. You can also prevent the processing at any time by unsubscribing from the newsletter. You can also prevent the storage of cookies by setting your web browser accordingly. You can also prevent the storage and transmission of personal data by deactivating JavaScript in your web browser or installing a JavaScript blocker (e.g., https://noscript.net or https://www.ghostery.com). We point out that as a result of these measures, not all functions of our website may be available to you.

The data you have provided to us for the purpose of newsletter subscription is stored by us until you unsubscribe from the newsletter and is deleted after unsubscribing from the newsletter, both from our servers and from CleverReach's servers. Data stored with us for other purposes (e.g., email addresses for the member area) remains unaffected by this.

You can view CleverReach's privacy policy at: https://www.cleverreach.com/de/datenschutz/.

10. Web analysis

10.1 Google Analytics 4 (GA4)

On our websites, we use Google Analytics 4 (GA4), a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

In this context, pseudonymized user profiles are created and cookies are used (see "Cookies" section). The information generated by the cookie about your use of this website may include, among other things:

• a brief collection of the IP address without permanent storage
• location data
• browser type/version
• operating system used
• referrer URL (previously visited page)
• time of the server request

The pseudonymized data may be transmitted by Google to a server in the USA and stored there.

The information is used to evaluate the use of the website, to compile reports on website activity, and to provide other services related to website usage and internet usage for purposes of market research and demand-oriented design of these internet pages. This information may also be transferred to third parties, insofar as this is required by law or as far as third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data.

These processing operations take place exclusively upon granting of express consent pursuant to Art. 6(1)(a) GDPR.

Further information on data protection when using GA4 can be found at: https://support.google.com/analytics/answer/12017362?hl=de.

10.2 Google Analytics Universal

On our websites, we use Google Analytics, a web analysis service provided by Google Ireland Limited (https://www.google.de/intl/de/about/), Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). In this context, pseudonymized user profiles are created and cookies are used (see "Cookies" section). The information generated by the cookie about your use of this website, such as

1. the browser type/version,

2. the operating system used,

3. the referrer URL (the previously visited page),

4. the host name of the accessing computer (IP address), and

5. the time of the server request,

is transmitted to a Google server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activities, and to provide other services related to website usage and internet usage for purposes of market research and demand-oriented design of these internet pages. This information may also be transferred to third parties, insofar as this is required by law or as far as third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data. The IP addresses are anonymized so that assignment is not possible (IP masking).

You can prevent the installation of cookies by setting your browser software accordingly; however, we point out that in this case, you may not be able to fully use all functions of this website.

These processing operations take place exclusively upon granting of express consent pursuant to Art. 6(1)(a) GDPR.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) as well as the processing of this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de). Optionally, you can remove the cookies via the following link: Google Analytics Opt-Out.

You can view Google Analytics' privacy policy at: https://support.google.com/analytics/answer/6004245?hl=de.

10.3 Microsoft Clarity

We use Microsoft Clarity. "Microsoft Clarity" refers to a process by Microsoft in which user analysis is possible on the basis of a pseudonymous user ID and thus on the basis of pseudonymous data, such as the evaluation of data about mouse movements or performance data about certain internet presentations.

In doing so, we process in particular usage data (e.g., internet presentations visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), location data (information on the geographic position of a device or a person), movement data (mouse movements, scroll movements) in pseudonymized form. We have made the corresponding settings so that data collection at and by Microsoft is pseudonymized from the outset, in particular in the form of IP masking (pseudonymization of the IP address).

All users of our website who have consented to the corresponding use via our cookie consent service are affected by this data processing. Data processing thus takes place solely on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

The purpose of the processing is tracking (e.g., interest-/behavior-based profiling, use of cookies), remarketing, conversion measurement (measuring the effectiveness of marketing measures), interest-based and behavior-based marketing, profiling (creating user profiles), reach measurement (e.g., access statistics, recognition of returning users), cross-device tracking (cross-device processing of user data for marketing purposes).

You are informed of your right to object in accordance with this privacy policy. You can also set an opt-out with the respective provider.

a) Europe: https://www.youronlinechoices.eu.

b) Canada: https://www.youradchoices.ca/choices.

c) USA: https://www.aboutads.info/choices.

d) Cross-territory: https://optout.aboutads.info.

Microsoft Clarity: online marketing and web analysis; offered by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; website: https://clarity.microsoft.com; privacy policy: https://privacy.microsoft.com/de-de/privacystatement; opt-out option: https://choice.microsoft.com/de-DE/opt-out.

11. Plugins and other services

11.1 Google Maps

On our website, we use Google Maps (API). The operating company of Google Maps is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Maps is a web service for displaying interactive (land) maps in order to visually display geographic information. Through the use of this service, our location, for example, can be shown to you and a possible route made easier.

Already when calling up those subpages into which the map from Google Maps is integrated, information about your use of our website (such as your IP address) is transmitted to Google servers in the USA and stored there. In addition, Google Maps reloads the Google web fonts. The provider of the Google WebFonts is also Google Ireland Limited. When you call up a page that embeds Google Maps, your browser loads the web fonts required to display Google Maps into your browser cache. For this purpose too, the browser you use establishes a connection to Google's servers. As a result, Google becomes aware that our website was accessed via your IP address. This happens regardless of whether Google provides a user account through which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not wish for this assignment to be made to your Google profile, you must log out of your Google user account. Google stores your data (even for non-logged-in users) as usage profiles and evaluates them. You have a right to object to the creation of these user profiles, and you must contact Google to exercise this right.

If you do not agree to the future transmission of your data to Google as part of the use of Google Maps, there is also the option of completely disabling the Google Maps web service by switching off JavaScript in your browser. Google Maps, and thus the map display on this website, cannot then be used.

These processing operations take place exclusively upon granting of express consent pursuant to Art. 6(1)(a) GDPR.

You can view Google's terms of use at https://www.google.de/intl/de/policies/terms/regional.html, and the additional terms of use for Google Maps can be found at https://www.google.com/intl/de_US/help/terms_maps.html

You can view Google Maps' privacy policy ("Google Privacy Policy") at: https://www.google.de/intl/de/policies/privacy/.

11.2 Google Tag Manager

On this website, we use the Google Tag Manager service. The operating company of Google Tag Manager is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This tool allows "website tags" (i.e., keywords that are embedded in HTML elements) to be implemented and managed via an interface. Through the use of Google Tag Manager, we can automatically track which button, link, or personalized image you have actively clicked on, and can then record which content of our website is particularly interesting for you.

The tool also triggers other tags, which in turn may collect data under certain circumstances. Google Tag Manager does not access this data. If you have made a deactivation at the domain or cookie level, this will remain in place for all tracking tags implemented with Google Tag Manager.

These processing operations take place exclusively upon granting of express consent pursuant to Art. 6(1)(a) GDPR.

Further information on Google Tag Manager as well as Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/.

11.3 Userlike

This website uses chat software from the company Userlike UG (haftungsbeschränkt), Probsteigasse 44-46, 50670 Cologne, Germany. You can use the chat like a contact form to chat with our employees in near real time. When starting the chat, the following personal data is collected [to be adjusted depending on widget settings]: date and time of access, browser type/version, IP address, operating system used, URL of the previously visited website, amount of data sent. And if provided: first name, last name, and email address. Depending on the course of the conversation with our employees, further personal data entered by you may arise in the chat. The nature of this data depends heavily on your inquiry or the problem you describe to us. The processing of all this data serves to provide you with a quick and efficient way to make contact and thus to improve our customer service.

All our employees have been and are trained on the topic of data protection and instructed on the safe and trustworthy handling of customer data. All our employees are obligated to confidentiality and have accordingly signed an addendum in their employment contracts on the obligation to maintain confidentiality and observe data protection.

By calling up the website [Name of your website], the chat widget is loaded in the form of a JavaScript file from AWS Cloudfront. The chat widget technically represents the source code that is executed on your computer and enables the chat.

In addition, [Your company name] stores the chat history for the duration of [enter duration]. This serves the purpose of possibly saving you extensive explanations of the history of your request, as well as for the ongoing quality control of our chat offering. The processing is therefore permitted pursuant to Art. 6(1)(f) GDPR. If you do not want this, please feel free to let us know using the contact details listed below. Stored chats will then be deleted by us without delay.

The storage of chat data also serves the purpose of ensuring the security of our information technology systems. This is also our legitimate interest, which is why the processing is permissible under Art. 6(1)(f) GDPR.

Further information can be found in the privacy policy of Userlike UG (haftungsbeschränkt).

12. Payment providers

12.1 PayPal

We have integrated components of PayPal on this website. The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which represent virtual private or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not maintain a PayPal account. A PayPal account is managed via an email address, which is why there is no classic account number. PayPal makes it possible to trigger online payments to third parties or to receive payments. PayPal also performs trustee functions and offers buyer protection services.

If you select "PayPal" as the payment method during the ordering process in our online shop, your data will be automatically transmitted to PayPal. By selecting this payment option, you consent to the transmission of personal data required for payment processing.

The personal data transmitted to PayPal is generally first and last name, address, email address, IP address, telephone number, mobile phone number, or other data necessary for payment processing. Also necessary for the processing of the purchase agreement is personal data related to the respective order.

The transmission of the data serves the purpose of payment processing and fraud prevention. We will transmit personal data to PayPal in particular if there is a legitimate interest in the transmission. The personal data exchanged between PayPal and us may be transmitted by PayPal to credit agencies under certain circumstances. This transmission is intended for identity and credit checks.

PayPal passes on the personal data to affiliated companies and service providers or subcontractors, where applicable, insofar as this is necessary to fulfill contractual obligations or the data is to be processed on our behalf.

You have the option to revoke your consent to the handling of personal data vis-à-vis PayPal at any time. A revocation does not affect personal data that must necessarily be processed, used, or transmitted for (contractual) payment processing.

The use of PayPal takes place in the interest of orderly and smooth payment processing. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The transmission of your personal data takes place exclusively upon granting of express consent pursuant to Art. 6(1)(a) GDPR.

You can view PayPal's applicable privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

13. Your rights as a data subject

13.1 Right of confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

13.2 Right of access Art. 15 GDPR

You have the right to obtain from us, at any time and free of charge, information about the personal data stored about you as well as a copy of this data in accordance with statutory provisions.

13.3 Right to rectification Art. 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, you have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

13.4 Erasure Art. 17 GDPR

You have the right to demand that we delete the personal data concerning you without delay, provided one of the legally prescribed reasons applies and insofar as the processing or storage is not necessary.

13.5 Restriction of processing Art. 18 GDPR

You have the right to demand that we restrict processing if one of the legal requirements is met.

13.6 Data portability Art. 20 GDPR

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us to whom the personal data was provided, provided the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and the processing is carried out using automated means, provided the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, in exercising your right to data portability pursuant to Art. 20(1) GDPR, you have the right to obtain the direct transmission of personal data from one controller to another controller, insofar as this is technically feasible and provided this does not adversely affect the rights and freedoms of others.

13.7 Right to object Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) (processing in the public interest) or (f) (processing on the basis of a balancing of interests) GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the purpose of asserting, exercising, or defending legal claims.

In individual cases, we process personal data in order to conduct direct marketing. You can object at any time to the processing of personal data for the purpose of such advertising. This also applies to profiling, insofar as it is connected with such direct marketing. If you object to the processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you which takes place for scientific or historical research purposes or for statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you are free to exercise your right to object by automated means using technical specifications.

13.8 Withdrawal of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

13.9 Complaint to a supervisory authority

You have the right to lodge a complaint with a supervisory authority responsible for data protection regarding our processing of personal data.

14. Routine storage, deletion, and blocking of personal data

We process and store your personal data only for the period necessary to achieve the purpose of storage, or as provided for by the legal regulations to which our company is subject.

If the purpose of storage no longer applies or a prescribed storage period expires, the personal data is routinely blocked or deleted in accordance with statutory provisions.

15. Duration of storage of personal data

The criterion for the duration of storage of personal data is the respective statutory retention period. After expiry of the period, the corresponding data is routinely deleted, provided it is no longer required for the performance or initiation of a contract.

16. Currency and amendment of the privacy policy

This privacy policy is currently valid and has the status: December 2022.

Due to the further development of our website and offerings, or due to changed legal or regulatory requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed and printed out by you at any time on the website at https://thoenes-solutions.com/en/Shop-Service/Privacy-Policy/.