This privacy policy outlines how we use your personal data and explains your rights as set out in the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)). The data controller is ZwickRoell GmbH & Co. KG (“we” or “us” hereinafter).
 

I. General information

1. Contact

If you have any questions or comments about the information in this policy or would like to contact us about asserting your rights, please direct your inquiries to:
 
ZwickRoell GmbH & Co. KG
August-Nagel-Straße 11, 89079 Ulm, Germany
Tel.: +49 7305 10-0
Email: info@zwickroell.com

2. Legal bases

The term “personal data” as used in data protection law refers to all information relating to an identified or identifiable natural person. We process personal data in line with relevant data protection laws, in particular the GDPR and BDSG. We process data only when there is a legal basis to do so. We process your personal data only with your consent (Section 15 (3) of the German Telemedia Act (Telemediengesetz (TMG)) or Article 6 (1) (a) GDPR), for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (Article 6 (1) (b) GDPR), for compliance with a legal obligation (Article 6 (1) (c) GDPR) or for the purposes of pursuing our legitimate interests or the legitimate interests of a third party, unless these interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (Article 6 (1) (f) GDPR).
If you apply for a vacancy at our company, we will also process your personal data in order to decide whether to offer you the position (Section 26 (1), sentence (1), BDSG).

3. Duration of storage

Unless stated otherwise in this policy, we will store your data only for as long as is necessary to achieve the purpose of the processing or to comply with our contractual or legal obligations. We may be obliged to retain your personal data under commercial law and tax law in particular. From the end of a calendar year in which we have collected data, the personal data in our accounting records will be retained for ten years, and personal data in commercial documents and contracts for six years. Furthermore, we will retain data in connection with obligatory proof of consent and with complaints and claims for the duration of the statutory limitation periods.
 

4. Categories of data recipients

We use processors to process your data. Their processing operations include, for example, hosting, maintenance and support for IT systems or destroying files and data storage devices. A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. Processors do not use the data for their own purposes but process data solely on behalf of the controller and are contractually obliged to ensure appropriate technical and organizational data protection measures. Furthermore, we may also transmit your personal data to bodies such as postal and delivery services if necessary. Further recipients may result from this policy.

5. Data transfer to third countries

Visiting our website may result in certain personal data being transferred to third countries, i.e. countries where the GDPR does not apply. Such a transfer can be carried out if the European Commission has decided that the third country in question has an adequate level of data protection. If the European Commission has not decided that the level of data protection in the third country in question is adequate, personal data can be transferred to this third country only if an appropriate safeguard is in place as per Article 46 GDPR or if one of the conditions of Article 49 GDPR has been met.
Unless indicated otherwise below, we use the European Union’s standard contractual clauses as an appropriate safeguard for the transfer of personal data to processors in third countries: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0087.
If you have consented to the transfer of your personal data to third countries, the legal basis for the transfer is Article 49 (1) (a) GDPR.

6. Data processing when you exercise your rights

If you exercise your rights according to Articles 15 to 22 GDPR, we will process the transferred personal data so that we can implement these rights and prove that we have done so. We process data stored for the purpose of exchanging and processing information for this purpose only and for the purpose of data protection monitoring. Furthermore, we restrict such processing in accordance with Article 18 GDPR.
The legal basis for this processing is Article 6 (1) (c) GDPR in conjunction with Articles 15 to 22 GDPR and Section 34 (2) BDSG.

7. Your rights

As a data subject, you have the right to establish your rights vis-à-vis us. Your rights as a data subject include the following in particular:
 

• Pursuant to Article 15 GDPR and Section 34 BDSG, you have the right to obtain from us confirmation as to whether and to what extent we are processing your personal data.
• Pursuant to Article 16 GDPR, you have the right to obtain from us rectification of your personal data.
• Pursuant to Article 17 GDPR and Section 35 BDSG, you have the right to obtain from us the erasure of your personal data.
• Pursuant to Article 18 GDPR, you have the right to restriction of the processing of your personal data.
• Pursuant to Article 20 GDPR, you have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller.
• Where you have given us your separate consent to data processing, you can withdraw this consent at any time pursuant to Article 7 (3) GDPR. Such a withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• If you consider that the processing of your personal data infringes the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR.

8. Right to object

Pursuant to Article 21 (1) GDPR, you have the right to object, on grounds relating to your particular situation, to processing which is based on Article 6 (1) (e) or (f) GDPR. Where we process your personal data for direct marketing purposes, you can object to this processing pursuant to Article 21 (2) and (3) GDPR.

9. Data protection officer

You can get in touch with our data protection officer using the following contact details:
 
ZwickRoell GmbH & Co. KG
FAO Mr. Jörg Zimmerman
August-Nagel-Straße 11, 89079 Ulm, Germany
 
Email: datenschutz@zwickroell.com
 

II. Data processing on our website

When you use our website, we record the information that you yourself provide. We also automatically record certain information about your use of our website while you are on the site. Under data protection law, IP addresses are generally classed as personal data. Every device connected to the internet is allocated an IP address by the internet provider so that the device can send and receive data.

1. Processing of server log files

If you use our website for purely informational purposes, we will store general information, which your browser transmits to our server, automatically (as opposed to gathering information via a registration process). This information  includes the following as standard: the browser type and version used, the operating system, the pages accessed, the last page visited (referrer URL), the IP address, the date and time of the server request and the HTTP status code. We process these data for the purposes of pursuing our legitimate interests in accordance with Article 6 (1) (f) GDPR. The processing is necessary to ensure that the website functions properly and is secure. The stored data are erased after seven days, unless there is concrete evidence that reliably indicates that the website has been used unlawfully, prompting the need for the information to be checked and processed further. We are not able to identify you as the data subject using the information stored. According to Article 11 (2) GDPR, Articles 15 to 22 GDPR therefore do not apply except where you, for the purpose of exercising your rights under those articles, provide additional information enabling your identification.

2. Cookies

We use cookies and other comparable technology on our website (“cookies” hereinafter). Cookies are small text files that are placed on your browser when you visit a website. They identify the browser you are using and can be recognized again by web servers. You have full control over the use of cookies via your browser and can delete them in the security settings of your browser at any time. You can also withdraw your consent to the use of cookies either in all or in certain cases via your browser settings. The German Federal Office for Information Security provides more information about cookies on its website: https://www.bsi-fuer-buerger.de/BSIFB/DE/Empfehlungen/EinrichtungSoftware/EinrichtungBrowser/Sicherheitsmassnahmen/Cookies/cookies_node.html.
The use of certain cookies is necessary to allow our website to function properly and therefore does not require the user’s consent. We may also use cookies in order to provide certain features and content as well as for analysis and marketing purposes. These may include cookies from third parties (known as third-party cookies). In accordance with Article 6 (1) (a) GDPR, we use these types of cookies, which are not necessary for the proper functioning of the website, only with your consent. You can find more information about the specific types of cookies and their storage periods in the settings for our consent management tool.

3. Consent management tool

This website uses a cookie consent management banner. The banner allows our website users to give their consent to certain data processing operations or to withdraw consent that they have already given. By clicking “Submit,” or by saving your preferences for individual cookies, you consent to the use of those cookies. The legal basis for this under data protection law is your consent in accordance with Article 6 (1) (a) GDPR.
In addition, the banner enables us to provide proof of your declaration of consent. For this purpose, we process information and other log data relating to your declaration of consent. We also use cookies to collect these data.
It is necessary to process these data in order to provide proof that you have given your consent. The legal basis is consistent with our legal obligation to record your consent as per Article 6 (1) (c) GDPR in conjunction with Article 7 (1) GDPR.

4. Applying for vacancies and submitting speculative applications

a. Processing job application data

If you apply for a vacancy at our company or submit a speculative application, we will process your application data solely for the purposes of pursuing your interest in employment at our company now or in the future and of assessing your application.
When you apply, you must provide certain information about yourself, including your name, contact details and all of the necessary application documents. The relevant data entry form for each application will indicate what specific information is required. Fields marked with an asterisk (*) are mandatory and must be filled out in order to complete the application.
In order to provide this career portal and to store, select and process applications, we use a service provided by rexx systems GmbH, which acts on our behalf as a processor solely bound by instruction in accordance with legal requirements. Your application will be seen and processed only by the relevant employees at our company. All employees who are entrusted with your application are obliged to respect the confidentiality of your data.
If we are unable to offer you a position, we will retain the data that you provided to us for up to six months after you completed the application process in order to answer questions about your application and rejection, unless legal provisions prevent the erasure of the data, or further retention is necessary for the purposes of providing evidence, or you have expressly consented to further retention.
The legal basis for the collection of these data is Section 26 (1), sentence 1, BDSG. Please note that if you expressly consent to us retaining your data for longer than six months, you have the right to withdraw this consent at any time pursuant to Article 7 (3) GDPR. Such a withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

b. Data transfer to third parties

If you use the application form to submit a speculative application for a position in a third country, the data you provide as part of your application will be transferred to our site in the third country concerned. These data will be transferred even if the site is in a third country where the GDPR does not apply. Please note that in such cases, the same level of protection of natural persons guaranteed by the GDPR very often does not exist.
In this case, data transfer takes place on the basis of Article 49 (1) (b) GDPR.

5. Job alerts

You can receive automatic email alerts notifying you of new vacancies that meet your search criteria.
You need a valid email address to sign up to the job alerts. You can also provide additional search criteria data voluntarily.
You will need to verify your email address by clicking on the link in the registration email sent to your account (known as a double opt-in process). If you subscribe to the newsletter on our website, we will process your personal data such as email address and name on the basis of your given consent. The legal basis for this processing is Article 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by clicking on the “Unsubscribe” link in the newsletter or by contacting us using the details provided above. The withdrawal of consent shall not affect the lawfulness of the data processing operations that have already taken place. When you sign up to receive our newsletter, we will also store your IP address and the data and time of the sign-up. It is necessary to process these data in order to provide proof that you have given your consent. The legal basis is consistent with our legal obligation to record your consent as per Article 6 (1) (c) GDPR in conjunction with Article 7 (1) GDPR.

6. YouTube

We use the service YouTube provided by Google Ireland Limited (Ireland/EU) to embed videos on our website. It is necessary to process your IP address to embed these videos so that the content can be sent to your browser. Your IP address is thereby transferred to Google and Google may place its own cookies. We use YouTube in privacy-enhanced mode so YouTube cannot use cookies to analyze viewing behavior. In addition, we have embedded YouTube videos on our website using the two-click process, whereby only a preview image is shown at first rather than the video. Only by clicking on the preview image can you request the video and thereby transfer your data.
The processing of personal data carried out when you request the video serves our legitimate interest of embedding YouTube videos on our website. We therefore process your data in order to pursue this legitimate interest in accordance with Article 6 (1) (f) GDPR.
The possibility that your data will be transferred to Google Inc. and YouTube LLC in the United States cannot be ruled out. Please see the “Data transfer to third countries” section for more information in this regard. You can find further details about Google’s privacy policy at https://www.google.com/policies/privacy.

7. Matomo

We use the service Matomo on this website. Matomo is an open-source website optimization software that anonymously analyzes the visits to our website using cookies. It anonymizes IP addresses immediately after they have been processed and before they have been stored. This means that Matomo does not carry out any further processing of personal data. The information generated by cookies relating to your use of our website is not used for any person-specific evaluations or for profiling, nor is it passed on to third parties. This data processing is carried out for the purposes of pursuing our legitimate interests in measuring the impact of our website’s reach and statistically analyzing how it is used.
 
We place cookies and carry out further processing of personal data as described here only with your consent. The legal basis for the data processing is therefore Article 6 (1) (a) GDPR. 
 

Date: May 2021