1. General information and controller

This privacy statement clarifies the type, scope and purpose of processing of personal data (including collection, processing and use as well as obtaining consent) within our online and offline offer and the associated websites, functions and content (hereinafter jointly referred to as the "online offer" or "website") in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The privacy statement applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) on which the online offer is executed. In addition, the privacy policy also applies to all offers and contact options where personal data must be stored in both the online and the offline area.

The provider of the online offer and the controller according to the GDPR is:

RINGSPANN GmbH
Schaberweg 30-38
61348 Bad Homburg
Germany

Telefon: + 49 (0) 82120715-183
E-Mail: info@ringspann.de

(hereinafter referred to as "provider", "we" or "us").

The term "user" or "data subject" includes all customers and visitors of our online and offline offer. The terms used, such as "user" or "data subject", are to be understood in a gender-neutral way.

2. Data protection officer

Dentons GmbH
Thurn-und-Taxis-Platz 6
60313 Frankfurt am Main

Telephone: +49 69 45 00 12 390
Email: privacy.germany@dentons.com

3. Basic information on data processing

We process the personal data of users solely in compliance with the relevant data protection regulations in accordance with the requirements of data economy and data avoidance. This means that users' data will only be processed if there is legal permission, in particular if the data are necessary for the provision of our contractual services and for online services, or if required by law or if consent has been given.

We take organisational, contractual and technical security measures in accordance with the state of the art in order to ensure that the provisions of data protection laws are complied with and to protect the data processed by us against accidental or intentional manipulation, loss, destruction or access by unauthorised persons.

If content, tools or other means are used within the scope of this privacy statement by other providers (hereinafter jointly referred to as "third-party providers") whose named headquarters are abroad, it can be assumed that data transfer takes place to the countries in which the third-party providers are domiciled. Transfer of data to third countries is carried out in accordance with Chapter V of the GDPR.

4. Purposes and legal bases of data processing

In addition to the use expressly stated in this privacy statement, personal data will be processed for the following purposes on the basis of legal permission or consent of the users:

1. The provision, execution, maintenance, optimisation and security of our services, service activities and user services (Art. 6 (1) point b) GDPR, insofar as processing takes place within the framework of an imminent or concluded contract, or Art. 6 (1) point f) GDPR, insofar as it concerns a mere visit to the website on your part and the use of the communication and information facilities available on the website).
2. Ensuring effective customer service and technical support (Art. 6 (1) point b) or point f) GDPR, cf. above).
3. For the technical implementation of our website and to be able to provide you with our information on this website (e.g. IP address, cookies, browser information), Art. 6 (1) point f) GDPR and s. 26 Telecommunications-Telemedia Data Protection Act, insofar as the technical means and the corresponding data processing are necessary for the operation of the website and Art. 6 (1) point a) GDPR in other cases).
4. To receive and process an application from you for one of our job offers (Art. 6 (1) point b) GDPR).
5. Registration for the use of calculation programs
6. Orders in the web shop
7. Technical inquiries

When you contact us (e.g. via contact form or e-mail), the user’s details will be stored for the purpose of processing the enquiry and in the event that follow-up questions arise (Art. 6 (1) point b) or f) GDPR).

5. Categories of collected data

In principle, visiting our website does not require any processing of personal data, with the exception of the IP address or other personal technical data that can be processed by our tracking tools used on the website. We inform you about this processing via our consent management banner according to section 25 Telecommunications-Telemedia Data Protection Act.

Furthermore, we process the personal data that you transmit to us when you contact us via the website (e.g. e-mail address, surname, first name, telephone numbers, company name, professional position, etc.). In this respect, the information is available to you when you contact us (Art. 13 (4) GDPR).

6. Deletion of data

Personal data will be deleted if they have fulfilled their purpose of use and there are no retention obligations or retention rights that preclude deletion.

7. Transfers to third parties and categories of recipients

We only transfer users’ data to third parties if this is necessary to fulfil our contractual or legal obligations. Categories of recipients can be: logistics companies, IT, cloud providers, legal and tax consultants, event managers, financial service providers, production partners, suppliers, marketing and PR service providers.

The website is hosted in-house. The servers are located in Germany and the (personal) data collected via the website are processed in Germany. This can include, but is not limited to, IP addresses, contact requests, meta and communication data, contract data, contact data, first and last names, website accesses and other data generated via a website. Processing is necessary for the operation of the website, as well as for the provision of the content you have requested, and can also be carried out without your consent.

Transfer also takes place if we are entitled or obliged to pass on data on the basis of legal provisions and/or official or court orders. This can be in particular the provision of information for the purposes of law enforcement, for the prevention of danger or for the enforcement of intellectual property rights.

Insofar as your data are passed on to service providers in the necessary scope, they will only have access to your personal data to the extent necessary for the performance of their tasks. These service providers are obliged to handle your personal data in accordance with applicable data protection laws, in particular the GDPR. We conclude contracts with processors in accordance with Art. 28 GDPR ab.

Beyond the aforementioned circumstances, we do not transmit your data to third parties without your consent. In particular, we do not transfer personal data to an entity in a third country or an international organisation.

8. International data transfer

Ringspann does not currently have a global group orientation, so our internal processes do not provide for any transfer of data outside the European Union (EU) / European Economic Area (EEA), except in situations where we involve service providers who have their own group companies in a country outside the EU/EEA. As a rule, such service providers then act as our processors. In any case, we ensure that the requirements of Chapter V GDPR are complied with for corresponding data processing. If you have any further questions in this regard, please see paragraph 6 below and/or privacy.germany@dentons.com.

In the course of our business relationships, your personal data may also be shared with or disclosed to third parties who are involved in our service provision as independent controllers. These can also be located outside the EU/EEA, i.e. in third countries.

Any processing outside the EU/EEA is carried out exclusively for the fulfilment of contractual and business obligations, serves to fulfil our legitimate interests or is based on your explicit consent. We will inform you about the respective details of the disclosure below at the relevant points.

For some third countries, the European Commission certifies data protection comparable to the EEA standard by means of so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.html). However, in other third countries to which personal data may be transferred there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we make sure that data protection is sufficiently guaranteed. This is possible through binding company regulations, standard contractual clauses of the European Commission on the protection of personal data, certificates or recognised codes of conduct. For more information please contact privacy.germany@dentons.com.

9. Cookies and reach measurement / third-party providers

Note that all cookies that require consent (i.e. cookies that are not necessary for the operation and functionality of the website) must be explicitly authorised by you via our cookie banner (consent) before they are activated. For more information, please see our consent manager banner and "Cookies" below.

10. Rights of data subjects

The applicable data protection law grants data subjects comprehensive rights of data subjects vis-à-vis the controller with regard to the processing of their personal data (rights of information and intervention), about which we provide information below:

Right of access pursuant to Art. 15 GDPR: in particular, data subjects have the right to information about their personal data that we process, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom their data have been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to the processing, complaint to a supervisory authority, the origin of their data, if they have not been collected by us from the data subjects, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the scope and intended effects of such processing, as well as the right to be informed of the guarantees in accordance with Art. 46 GDPR in the event of disclosure of their data in third countries;

Right to rectification in accordance with Art. 16 GDPR: data subjects have the right to immediate rectification of incorrect data concerning them and/or completion of their incomplete data stored by us;

Right to erasure in accordance with Art. 17 GDPR: data subjects have the right to request erasure of their personal data if the requirements of Art. 17 (1) GDPR are met. However, this right does not exist, in particular, if processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;

Right to restriction of processing in accordance with Art. 18 GDPR: data subjects have the right to request restriction of the processing of their personal data as long as the accuracy of their data that they contest is verified, if the data subjects refuse erasure of their data due to unlawful data processing and instead request restriction of processing of their data, if the data subjects need their data for the establishment, exercise or defence of legal claims, after we no longer need this data after the purpose has been achieved or if data subjects have objected for reasons of their particular situation, as long as it has not yet been determined whether our legitimate reasons prevail;

Right to notification pursuant to Art. 19 GDPR: if data subjects have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom personal data concerning the data subject have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. The persons concerned have the right to be informed about these recipients.

Right to data portability in accordance with Art. 20 GDPR: data subjects have the right to receive personal data that they have provided to us in a structured, commonly used and machine-readable format or to request transfer to another controller, to the extent technically feasible;

Right to withdraw consent given in accordance with Art. 7 (3) GDPR: data subjects have the right to withdraw their consent to the processing of data at any time with effect for the future. In the event of withdrawal of consent, we will delete the data concerned without undue delay, unless further processing can be supported by a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before withdrawal;

Right to lodge a complaint in accordance with Art. 77 GDPR: if data subjects consider that the processing of personal data concerning them infringes the GDPR, they have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their place of residence, place of work or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

RIGHT TO OBJECT

INSOFAR AS WE PROCESS PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, USERS HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE FOR REASONS ARISING FROM THEIR PARTICULAR SITUATION.

IF AFFECTED USERS MAKE USE OF THEIR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF PERSONAL DATA ARE PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, DATA SUBJECTS HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING THEM FOR THE PURPOSE OF SUCH MARKETING. DATA SUBJECTS CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF DATA SUBJECTS EXERCISE THEIR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

11. Amendments to the privacy statement

We reserve the right to amend the privacy statement in order to adapt it to changed legal situations, or in the event of changes to the service and to data processing. However, this only applies with regard to statements on data processing. If the consent of users is required or if components of the privacy statement contain provisions of the contractual relationship with users, changes will only be made with such consent.