Privacy Policy

I. Name and address of the data controller

The data controller as defined in the General Data Protection Regulation and also the national data protection legislation of Member States and other data protection terms is:

Fasel GmbH

Am Galgenacker 3

79232 March

Germany

Tel.: +49 7665 / 92410

Email: info@fasel-gmbh.de

Website: www.fasel-gmbh.de

II. General data processing information

1. Scope of processing personal data

We only process the personal data (information concerning personal and material relationships of certain natural persons, including names, addresses, telephone numbers and dates of birth) of our users to the extent necessary to provide a functioning website, content and services. Usually, we only process the personal data of our users with their consent. This does not apply to cases in which it is not possible to obtain consent in advance and the processing of data is permitted by law.

Legal basis for processing personal data

If we obtain the consent of the data subject for the processing of their personal data, Article 6 (1)(a) of the European Union General Data Protection Regulation (GDPR) serves as the legal basis.

Article 6 (1)(b) GDPR serves as the legal basis for the processing of personal data for the performance of a contract to which the data subject is party. This is also the case for data processing required to take steps prior to entering into a contract.

The processing of any personal data required to comply with a legal obligation to which our company is subject takes place on the basis of Article 6 (1)(c) GDPR.

Article 6 (1)(d) GDPR serves as the legal basis for the processing of personal data to protect the vital interests of the data subject or of another natural person.

The processing of data for the purposes of the legitimate interests pursued by our company or by a third party takes place on the basis of Article 6 (1)(f) GDPR, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Erasure of data and storage period

The personal data of the data subject is erased or made unavailable as soon as the purpose of the data storage no longer applies. Data may also be stored if provided for by European or national legislators in Union directives, laws or other provisions to which the controller is subject. Data is also erased or made unavailable if a retention period required under the standards referred to above expires, unless there is a requirement to continue to store the data for the conclusion or performance of a contract.

III. Providing the website and creating log files

1. Description and scope of the data processing

Every time a user accesses our website, our system automatically records data and information from the computer used to access the website.

The following data is collected:

• type of browser and version in use
• user operating system
• user IP address
• date and time of access
• accessed document
• websites from which the user accessed our website
• websites the user visits from our website

This data is stored in our system log files. This data is not stored together with any other personal data of the user.

Legal basis for data processing

The legal basis for the temporary storage of data and log files is Article 6 (1)(f) GDPR.

Purpose of data processing

The system has to temporarily store the IP address in order to deliver the website to the user’s computer. The user’s IP address must remain stored for the duration of the session.

Log files are stored to ensure that the website functions correctly. In addition, the data also helps us to optimise the website and ensure that our IT systems are secure. This data is not analysed for marketing purposes.

Our legitimate interest to data processing in these cases is also in accordance with Article 6 (1)(f) GDPR.

Duration of storage

Data is erased as soon as it is no longer required for the purpose for which it was collected. In the case of data recorded in order to deliver the website, this applies once the respective session has ended.

For data stored in log files, this is the case after seven days. It is possible for data to be stored for longer; however, in this case, user IP addresses are erased or anonymised so that they can no longer be assigned to the respective client.

Objecting to data processing or removing data

The data recorded to deliver the website and store data in log files is essential for the operation of the website. As a consequence, it is not possible for the user to object to this data processing.

IV. Use of cookies

a) Description and scope of data processing

Our website uses cookies. Cookies are text files stored on your computer within or by your browser. A cookie can be stored on the user’s operating system when the user accesses a website. This cookie contains a code that allows the browser to be recognised if the user accesses the website again.

We use cookies to make our website more user-friendly. Some of the elements on our website also require the browser to be recognised after the user has switched to a different page.

The following data is stored and transferred in cookies:

• whether a user would like to display the mobile version of the website;
• whether cookies are activated;
• storage of the chosen language settings;
• whether the user is logged in;
• page configuration;
• session ID for the time of the current visit.

b) Legal basis for data processing

The legal basis for the processing of personal data using cookies is Article 6 (1)(f) GDPR.

c) Purpose of data processing

The purpose of the essential technical cookies is to simplify the website experience for the user. Some of the website functions cannot be used without cookies. They require the browser to be recognised even after the user switches pages.

We require cookies for the following applications:

• Changing language settings
• Saving display options

The user data collected by means of essential technical cookies is not used to create user profiles.

This is the basis for our legitimate interest in processing personal data pursuant to Article 6 (1)(f) GDPR.

e) Duration of storage, objecting to data processing and removing data

Cookies are stored on a user’s computer and transmitted from there to us. This means that you, as the user, have complete control over the use of cookies. You can deactivate or restrict the transfer of cookies by changing the settings in your browser. Saved cookies can be erased at any time, including automatically. However, deactivating cookies for our website may result in some website functions not being fully available.

V. Newsletter

1. Description and scope of the data processing

Our website also offers users the ability to subscribe to a newsletter free of charge. When registering for the newsletter, the data entered on the registration page is sent to us. The following data is

gathered during the registration process:

• Title
• First name
• Surname
• Email address

In addition, the following data is collected when users register for the newsletter:

• Date and time of registration

When registering for the newsletter we obtain your consent for processing your data and refer to this privacy statement.

No data is disclosed to third parties in relation to sending newsletters. Data is only used for the purposes of the newsletter.

Legal basis for data processing

Once the user registers for the newsletter and if the user gives their consent, the legal basis for processing data is Article 6 (1)(a) GDPR.

Purpose of data processing

The purpose of collecting the user’s email address is to send the newsletter.

The collection of other personal data within the scope of the registration process serves to prevent the services or the email address in question being misused.

Duration of storage

Data is erased as soon as it is no longer required for the purpose for which it was collected. User email addresses are therefore only stored for as long as the user is registered for the newsletter.

Other personal data collected as part of the registration process is usually erased after a period of seven days.

Objecting to data processing or removing data

The user can cancel the newsletter at any time using the link included in the newsletter itself.

This allows users to withdraw their consent for the storage of the personal data collected during the registration process.

VI. Contact form and email correspondence

1. Description and scope of the data processing

Our website contains a contact form that can be used to send electronic messages. If a user would like to get in contact with us in this manner, the data entered on the contact form is sent to us and stored by us. This data is:

• Company
• Title, first name and surname
• Address and postcode
• Telephone number and email address
• Entered message

The fields required to communicate with the user are marked on the form as mandatory. All other information is optional.

The following data is also stored when the message is sent:

• Date and time of registration

When you send a message, we obtain your consent for processing your data and refer to this privacy statement.

You can also get in touch by using the email address provided, in which case the personal data of the user submitted together with the email is stored.

No data is disclosed to third parties in this regard. Data is only used for the purposes of the correspondence.

Legal basis for data processing

If the user gives their consent, the legal basis for processing data is Article 6 (1)(a) GDPR.

The legal basis for processing data transferred as part of an email is Article 6 (1)(f) GDPR. If the aim of the email correspondence is to enter into a contract, Article 6 (1)(b) GDPR offers a supplementary legal basis for data processing.

Purpose of data processing

The sole purpose of processing personal data from the contact page is to process the correspondence. In the case of email correspondence, this is also the necessary legitimate interest when it comes to processing data.

Other personal data processed when sending messages is aimed at preventing the contact form from being misused and ensuring that our IT systems remain secure.

Duration of storage

Data is erased as soon as it is no longer required for the purpose for which it was collected. When it comes to personal data entered on the contact page and personal data submitted by email, this is the case when the correspondence with the user has been concluded. The correspondence is concluded if circumstances suggest that the matter in question has been resolved or clarified.

Other personal data collected as part of correspondence is usually erased after a period of seven days.

Objecting to data processing or removing data

Users are able to withdraw their consent to the processing of personal data at any time. Users contacting us by email can withdraw their consent to the storage of personal data at any time. If consent is withdrawn, the correspondence cannot be continued.

If you would like to exercise one of your rights and/or receive further information about your rights, please get in touch with us by email or by post using the addresses above.

All personal data stored as part of contacting us is erased if you withdraw your consent.

VIII. Rights of data subjects

The following list details all rights data subjects have under GDPR. We are not obliged to refer to any rights that are not relevant to our website, and we are therefore permitted to condense the list accordingly.

When your personal data is processed, you are the data subject as defined by GDPR and you have the following rights vis-à-vis the controller:

3. Right of access

You have the right to obtain from the controller confirmation as to whether or not your personal data is being processed.

If this is the case, you can request access to the personal data and the following information from the controller:

1. the purposes of the processing of personal data;
2. the categories of the personal data concerned;
3. the recipients or categories of recipient to whom your personal data has been or will be disclosed;
4. the envisaged period for which your personal data will be stored, or, if no precise storage period can be stated, the criteria used to determine that period;
5. the existence of the right to request from the controller rectification or erasure of your personal data, the right to request the restriction of the processing of your personal data or the right to object to the processing of your personal data;
6. the existence of the right to lodge a complaint with a supervisory authority;
7. any available information as to the source of data if the personal data is not collected from the data subject;
8. the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You also have the right to request information as to whether your personal data has been transferred to a third country or to an international organisation. In this context you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

Right to rectification

You have a right to have data rectified and/or incomplete data completed by the controller if your personal data is incorrect or incomplete. The controller must rectify the data without undue delay.

Right to the restriction of processing

You can request the right to restrict the processing of your personal data in one of the following circumstances:

1. you contest the accuracy of your personal data, for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but you do require the data for the establishment, exercise or defence of legal claims;
4. if you object to processing pursuant to Article 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.

Where processing has been restricted, your personal data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the processing of your personal data has been restricted as per the criteria defined above, you will be notified by the controller before this restriction is lifted again.

Right to erasure

a) Obligation to erase data

You have the right to obtain from the controller the erasure of personal data without undue delay, and the controller is obliged to erase personal data without undue delay where one of the following grounds applies:

1. Your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
2. You withdraw consent on which the processing is based according Article 6 (1)(a), or Article 9 (2)(a) GDPR, and where there is no other legal ground for the processing.
3. You object to the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21 (2) GDPR.
4. Your personal data has been unlawfully processed.
5. Your personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
6. The personal data has been collected in relation to the offer of information society services referred to in Article 8 (1) GDPR.

a) Information to third parties

Where the controller has made the personal data public and is obliged pursuant to Article 17 (1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replications of, said personal data.

b) Exceptions

The right to erasure does not apply to the extent that processing is necessary

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the area of public health in accordance with Article 9 (2)(h) and (i) as well as Article 9 (3) GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) GDPR in so far as the right referred to in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5. for the establishment, exercise or defence of legal claims.

Right of information

If you have exercised your right to the rectification, erasure or restriction of the processing of your personal data vis-à-vis the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of the rectification or erasure of the data or the restriction of its processing unless such notification proves impossible or would involve a disproportionate effort.

You have the right to be informed about these recipients by the controller.

Right to data portability

You have the right to receive the personal data you provided to a controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data have been provided, where:

1. the processing is based on consent pursuant to Article 6 (1)(a) GDPR or Article 9 (2)(a) or on a contract pursuant to Article 6 (1)(b) and
2. the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible; however, this must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Article 6 (1) (e) or (f) GDPR, including profiling based on those provisions.

The controller will no longer process your personal data unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the right to exercise your right to object by automated means using technical specifications.

Right to withdraw consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for entering into, or performance of, a contract between you and the controller;
2. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
3. is based on the data subject’s explicit consent.

However, these decisions may not be based on special categories of personal data referred to in Article 9 (1) GDPR, unless Article 9 (2)(a) or (g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in paragraphs (1) and (3), the data controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes this Regulation.

The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.