PRIVACY POLICY FKM WALZENTECHNIK DR. FREUDENBERG GMBH

• “Personal data” (Art. 4(1) GDPR) means any information that refers to an identified or identifiable natural person (“data subject”). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by means of information relating to their physical, physiological, genetic, mental, commercial, cultural, or social identity characteristics. Identifiability may also be given due to combination of such information or other additional knowledge. The origin, form, or embodiment of the information is irrelevant (photographs, video or audio recordings may also contain personal data).
• “Processing” (Art. 4(2) GDPR) means any operation that involves the handling of personal data, whether or not by means of automated (i.e., technology-based) procedures. This shall comprise in particular the collection (i.e., acquisition), recording, organization, structuring, storage, adaptation or transformation, retrieval, consultation, use, disclosure by transfer, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction of personal data, as well as the amendment of an objective or intended purpose on which a processing activity was initially based.
• “Controller” (Art. 4(7) GDPR) means the natural or legal person, public authority, institution, or other body who/that decides about the purpose and means of processing of personal data alone or jointly with others.
• “Third party” (Art. 4(10) GDPR) means any natural or legal person, public authority, agency, or other body, except for the data subject, controller, processor, and persons who, under the immediate responsibility of the controller or processor, are authorized to process personal data. This shall also include any other legal entities that are members of the group.
• The “Processor” (Art. 4(8) GDPR) means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller, in particular in accordance with its instructions (e.g., IT service provider). In particular, a processor is not a third party within the meaning of data protection law.
• “Consent” (Art. 4(11) GDPR) of the data subject designates any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by any other clear affirmative act, signify acceptance of the processing of personal data concerning them.

• Point (a) of the first sentence of Art. 6(1) GDPR (“consent”): When the data subject has freely given their consent, in an informed and unambiguous manner, by means of a statement or any other clear affirmative act, to the processing of personal data concerning them for one or several specific purposes;
• Point (b) of the first sentence of Article 6(1) GDPR: If processing is necessary for compliance with a contract to which the data subject is a party or for carrying out of pre-contractual measures taken at the data subject’s request;
• Point (c) of the first sentence of Article 6(1) GDPR: If processing is necessary for compliance with a legal obligation that the controller is subject to (e.g., a statutory obligation to keep records);
• Point (d) of the first sentence of Article 6(1) GDPR: If processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• Point (e) of the first sentence of Article 6(1) GDPR: If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
• Point (f) of the first sentence of Article 6(1) GDPR (“legitimate interests”): If processing is necessary for the purposes of legitimate (in particular legal or commercial) interests of the controller or of a third party, except where such interests are overridden by the conflicting interests or rights of the data subject (in particular if the data subject is a minor).

• in accordance with Art. 15 GDPR, you may demand information regarding your data processed by us. In particular, you may demand communication regarding the purposes of the processing, category of data, categories of recipients to whom your data have been or will be disclosed, the planned storage duration, the existence of a right to rectification, erasure, restriction of processing or objection, existence of a right to lodge a complaint, origin of your data unless they were collected by us, and the existence of automated decision-making, including profiling and any meaningful information on its details;
• in accordance with Art. 16 GDPR, you may demand rectification of any inaccurate data stored by us or completion of these without undue delay;
• in accordance with Art. 17 GDPR, you may demand erasure of your data stored by us as far as processing is not necessary in order to exercise the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest or for assertion, exercise, or defense of legal claims;
• in accordance with Art. 18 GDPR, you may demand restriction of the processing of your data, as far as you contest accuracy of the data, or if processing is unlawful;
• in accordance with Art. 20 GDPR, you may demand to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or demand transfer to another controller (“data portability”);
• in accordance with Art. 21 GDPR, you may object to processing, provided that processing is performed on the basis of points (e) or (f) of the first sentence of Art. 6(1) GDPR. This is in particular the case if processing is not necessary for compliance with a contract with you. Except in the case of an objection to direct marketing, please explain why you do not want us to process your data as we do when you exercise such an objection. In case of your justified objection, we will review the situation and shall either cease processing activities or adjust them, or explain our compelling legitimate grounds to you based on which we continue to process the data;
• in accordance with Art. 7(3) GDPR, you may withdraw your previously given consent (also if given before the GDPR entered into effect, i.e. before 05/25/2018) – i.e. your free will, stated in an informed manner and unambiguously by means of a declaration or other clear affirmative act, that you agree to the processing of the personal data concerned for one or several specific purposes – at any time towards us if you have given such consent. This has the consequence that we may no longer continue the processing activities that were based on this consent in future; and
• in accordance with Art. 77 GDPR, you may lodge a complaint with a data protection supervisory authority concerning the processing of your personal data in our undertaking, e.g., to the data protection supervisory authority competent for us: LDI NRW, Kavalleriestraße 2-4, D-40213 Düsseldorf, email: poststelle@ldi.nrw.de.

• the page from which the page was requested (the referrer URL)
   
• the name and URL of the requested page
   
• the date and time of the call
   
• the description of the type, language, and version of the web browser used
   
• the internet protocol address of the requesting computer, abbreviated so that a personal reference is no longer possible
   
• the amount of data transmitted
   
• the operating system
• the indication whether the call was successful (access status/http status code)
   
• the GMT time zone difference

• the page from which the page was requested (the referrer URL)
   
• the date and time of the call
   
• the description of the type of the web browser used
   
• the internet protocol address of the requesting computer, abbreviated so that a personal reference is no longer possible
   
• the email address
   
• the date and time of registration and confirmation

• Service providers for operation of our website and processing of data stored or transmitted by the systems (e.g., for data center services, payment processing, IT security). In this case, the legal basis for the transfer is point (b) or (f) of the first sentence of Art. 6(1) GDPR, insofar as it does not involve contract processors;
• Official authorities/public authorities, as far as this is necessary for compliance with a statutory obligation. In this case, the legal basis for forwarding is point (c) of the first sentence of Article 6(1) GDPR;
• Persons charged with carrying out our business (e.g., auditors, banks, insurance companies, legal advisors, supervisory authorities, parties involved in acquisitions or the formation of joint ventures). In this case, the legal basis for forwarding is point (b) or (f) of the first sentence of Article 6(1) GDPR.

• Technical cookies: These are essential for navigating the website, using basic features, and ensuring website security; they do not compile any information about you for marketing purposes, nor do they store which websites you have visited;
   
• Performance cookies: Such cookies compile information on how you use our website, which pages you visit and, e.g., whether any errors occur during website use; they do not compile any information that may identify you. All information compiled is anonymous and will only be used to improve our website and find out what interests our users;
   
• Advertising cookies, targeting cookies: These cookies are used to offer the website user marketing on the website or offers from third parties that fit their needs, and to measure the effectiveness of such offers; advertising and targeting cookies are stored no more than 13 months;
   
• Sharing cookies: These cookies are used to improve the interactivity of our website with other services (e.g., social networks); sharing cookies are stored for no more than 13 months.