Privacy Policy & Data Protection | Hafele Partner Portal

Data Protection Declaration

Welcome to the websites of Häfele SE & Co KG, https://partnerportal.hafele.com. The protection of your data is important to us. We would therefore like to inform you in the following about which data from your visit we will be using for which purpose.

1. Responsible

Controller within the definition of the General Data Protection Regulation (the “GDPR”) and other data protection provisions: applicable within the Member States of the European Union is:

Häfele SE & Co KG (“Häfele”)
Adolf-Häfele-Str. 1
72202 Nagold, Germany
Phone: + 49(0) 74 52 95 0
Fax: + 49 (0) 74 52 95 2 00
E-mail: info@haefele.de

2. Contact data of the Data Protection Officer

Häfele’s Data Protection Officer can be contacted as follows:

Häfele SE & Co KG
Data Protection Officer
Adolf-Häfele-Str. 1
72202 Nagold, Germany

E-mail: HDEDatenschutzbeauftragter@Haefele.de

3. Data processing

3.1. General information

Personal data is all data that can identify you personally, such as your name, address, email address and online user names. The personal data of our users is used as follows:

1. performing our services,
2. ensuring the delivery of technical support.

Unless otherwise described in the following sections, in general no personal data will be collected, processed or used in connection with the use of this website.

3.2. Storage of access data, creation of log files

Whenever a user accesses a page on this website, and whenever a file is accessed, access data about this procedure is recorded in a log file and saved. The recorded information is standard logging. Each data record consists of the following:

Date/time of request
Page from which the file was requested
Pages retrieved via our website by the user’s system
Called up file name
Transmitted volume of data
Access status (file transferred, file not found)
Description of operating system and web browser used, client IP address and user name (login data) of authenticated users

This data is used to deliver the content of our website, ensure the functionality of our information technology systems, and to optimise our online presence. The data may be used in an anonymised form for statistical purposes (see below), as well as for the purposes of data security, especially for error analysis and preventing hacking attempts (Art. 6 (1f) GDPR). Access rate will not be used for the creation of individual user profiles, nor be passed onto third parties, and will be erased after 90 days at the latest.

3.3. Use of IP addresses

Each time our homepage is accessed, Häfele uses the client IP address to determine the country from where the access is made, in order to route the requesting party to the specific Häfele homepage of the relevant country. This data is not used further, with the exception of the storage of access data, and creation of log files described under No. 3.2.

3.4. Contact form

If there is an option for entering personal or business information on this website, the information is always entered voluntarily. Information required to perform the desired operation is designated with an asterisk ‘*’. If you provide us with personal or business information via the contact forms, we will only use it for the respective intended purpose. Your consent constitutes the legal basis for this (Art. 6 (1a) GDPR). Data transfers are encrypted using SSL or TLS technology in order to prevent the unauthorised access of your personal data by third parties.

3.5. Supplier portal

You enter your surname, first name and other business data in order to register for the supplier portal. This will enable you to access our services for suppliers. The data will be stored for the duration of the registration, for the purpose of performing the contract and in order to fulfil statutory obligations. The legal basis for this is Art. 6 (1 a and b) GDPR. You may cancel your registration at any time. In that case, your access will be blocked immediately and erased upon the expiry of the statutory retention obligations.

3.6. Chat function

If you use the website’s chat function to contact the customer service, various information will be communicated to the customer service when initialising the chat (Art. 6 (1 a) GDPR). This information includes the website Help function invoked by you, and your browser and operating system versions. In addition, the chat platform will regularly relay information concerning the accessibility of the chat service at regular intervals. Based on this information, the website’s button for starting the chat will either be activated or deactivated. We store information concerning the start and end of the communication for 7 days only. Chat content is not stored. Data transfers are encrypted using SSL or TLS technology in order to prevent the unauthorised access of your personal data by third parties.

3.7. Newsletter

You have the opportunity of subscribing to our newsletter. To do so, you are required to enter your email address to which we will send the newsletter. If you enter this into the input screen, we will record your (company) name in order to address the newsletter personally to you. By entering your email address you agree that we may use your data for the purpose of sending the newsletter to tell you about our news. The legal basis for this processing is Art. 6 (1a) GDPR. Your email address will not be used for any other purpose. Newsletters are sent by a service provider.

You can cancel your newsletter subscription and the consent you issued at any time; this will then take effect for the future. If you wish to cancel your newsletter subscription, please use the relevant button in the newsletter sent to you. Your email address will then be promptly erased from our system.

3.8. Webshop

If you would like to place an order in our webshop, the conclusion of the contract requires you to provide your personal data that we need in order to execute your purchase order. An “*” indicates the mandatory information required to execute contracts; other data is voluntary. To place an order with us, you are required to enter your company-specific customer number. We will process the data provided by you, in order to execute your purchase order. To this end, we may forward your payment data to our house bank. The legal basis for this is Art. 6 (1 1st sentence b) GDPR.

We may also process the data you provide, in order to inform you about other interest products in our portfolio, or to send your emails containing technical information. The legal basis for this is Art. 6 (1 1st sentence f) GDPR.

Commercial and tax law stipulations oblige us to store your address, payment and order details for a period of ten years. However, we will implement a limitation on processing after three years, meaning that your data will only be used in order to fulfil the statutory obligations.

The order procedure is encrypted using SSL or TLS technology in order to prevent the unauthorised access of your personal data – particularly your financial data – by third parties.

3.9. Use of apps

When you use the app, our servers will temporarily save the IP address of your device and other technical characteristics, such as the requested content (Art. 6 (1 b) GDPR). Häfele will not use the data over and beyond this. Our app enables you to use various functions provided by a third party (such as Apple or Google), and used by the “controller” of the data processing operation. Please consult the relevant operating system vendor for details on the functionality, and how you can turn the use on and off.

3.10. Integration of third-party services

We have integrated YouTube videos into our online site. This are stored on https://www.youtube.com/ and can be viewed directly via our website. These are all integrated into the “enhanced data protection mode”, meaning that YouTube will not receive any data about you as a user, if you do not play the videos. The data described in No. 3.3 will only be transferred if you view the videos. We have no control over this transfer of data.

We have integrated Google Maps – a service provided by Google LLC – into our website. (“Google”), Amphitheatre Parkway, Mountain View, CA 94043, USA, as the third-party provider. When you visit the website, the third-party provider receives the information that you have retrieved the relevant sub-pages of our website. Furthermore, the data described in No. 3.3 of his notice will be transferred. This takes place regardless of whether this third-party provider provides a user account which you have logged into, or if no user account exists. If you are logged into the plug-in provider, this data will be directly correlated with your user account. If you do not wish the plug-in provider to make the correlation with your profile, you need to log out before activating the button.

Google stores this data for user profiles where relevant, and it uses the data for the purposes of advertising, market research and/or for the appropriate design of its website. This kind of analysis is particularly performed (not only for logged-in users) for the purpose of delivering appropriate advertising, and to inform other users of the social network about your activities on our website. You have a right to object to the formation of these user profiles. You have to contact Google in order to exercise this right. The legal basis for this processing is Art. 6 (1f) GDPR.

Further information regarding the purpose of scope of the collection and the processing of this data by the plug-in provider can be found in Google’s Privacy Police: https://policies.google.com/privacy?hl=en-GB&gl=de. It also contains further information on your rights in this connection, and the configuration options to enable you to protect your privacy.

3.11. Cookies

Cookies will be stored on your computer when you use our website. Cookies are small text files stored on your hard disk by your browser to make site-specific information available to the website using the cookie (in this case, our website). Cookies cannot run applications or transmit viruses to your computer. Their purpose is to make the general online experience more user-friendly and effective. The legal basis for this is Art. 6 (1 f) GDPR.

Use of cookies:

This website uses the following types of cookies, and their scope and function is described below:
– transient cookies (see 2)
– persistent cookies (see 3).
Transient cookies are automatically deleted when you close your browser. This also particularly include session cookies. These store what is known as a session ID, which correlates various queries made by your browser during one common session. This helps to identify your computer when you return to the website. Session cookies are deleted once you log out or close your browser.
Persistent cookies are automatically deleted after a given time, that varies depending on the cookie. You may delete any cookie using the security preferences in your browser at any time.
You can configure your browser settings as required and deny the acceptance of third-party cookies or all cookies. Please note that if you do so, you may not be able to enjoy all the services provided by this website.
If you have an account with us, we will use cookies to help us identify you during subsequent visits. Otherwise you would have to log in again during every visit.
The flash cookies we use are not captured by your browser but by your flash plug-in. We also use HTML5 storage objects, which are stored on your terminal device. These objects save the necessary data independently of the browser used and do not have an automatic expiry date. If you do not wish the flash cookies to be processed, you must install the applicable add-on, such as “Better Privacy” for Mozilla Firefox or the Adobe Flash Killer Cookie for Google Chrome. You can prevent the use of HTML5 storage objects by using the privacy mode of your browser. We also recommend that you manually delete your cookies and browser history regularly.

If you wish to prevent the use of cookies, you can configure your browser to block the acceptance of cookies. Please consult the instructions of your browser provider for the specific details of how this works.

3.12. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC. (“Google“), Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how it is used. The information generated by the cookie on your use of this website will normally be transmitted to a Google server in the United States and stored there. This website uses Google Analytics with the extension “gat._anonymizeIp();” to guarantee the anonymous capture of IP addresses (“IP masking”). If IP anonymization is activated on this website, however, your IP address will be truncated by Google from within a member state of the European Union or from within any other country which is party to the Agreement on the European Economic Area. Only in exceptional cases will the complete IP address be sent to a Google server in the United States and truncated there. Google will use this information on our behalf for purposes of evaluating your use of the website, compiling reports on website activity and providing the website operator with other services relating to website use and internet usage. Google will not associate your IP address (sent by your browser and transferred via Google Analytics) with any other data held by Google. The legal basis for the processing of your personal data is Art. 6 (1f) GDPR.

You may refuse the storage of cookies by selecting the appropriate settings in your browser software, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the acquisition of the data generated by the cookie (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=en).

An opt out cookie will be placed that will prevent future acquisition of your data while visiting this website. Deactivate Google Analytics. Further information concerning usage conditions and data protection can be found at https://www.google.com/analytics/terms/gb.html or at https://policies.google.com/?hl=en-GB.

3.13. Mouseflow

This website uses Mouseflow, an analytics tool provided by Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark), to record randomly selected individual visits (with anonymised IP address only). This generates a record of the movements and clicks of the mouse, with the purpose of recording randomly selected website visits in order to use this information to make improvements to the website. This information cannot be attributable to any particular individual, and it will not be made available to anyone else. If you wish to prevent the recording of this information, you do this on all websites that use Mouseflow, by clicking on the following link: https://mouseflow.com/opt-out/.

3.14. Social Media Plug-ins

When you access the social media page of our homepage, so-called social plug-ins (“plug-ins”) of the social networks Facebook, Instagram and the microblogging service Twitter are used. Facebook and Instagram are operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”). Twitter is operated by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (“Twitter”). You can find an overview of the plugins and their appearance here:
https://developers.facebook.com/docs/plugins, http://blog.instagram.com/post/36222022872/introducing-instagram-badges and https://dev.twitter.com/web/overview

When you visit the Social Media page of our website, your browser establishes a direct connection to the Facebook, Instagram or Twitter servers. The content of the plugin is transmitted by the respective provider directly to your browser and integrated into the page. By integrating the plugins, the providers receive the information that your browser has called the corresponding page of our website, even if you do not have a profile on the corresponding social network or are not logged in. This information (including your IP address) is transmitted directly from your browser to a server of the respective provider in the USA and stored there.

If you are logged in to Facebook, Instagram or Twitter, the providers can directly assign your visit to our website to your profile on Facebook or Twitter. If you interact with the plugins, for example by pressing the “Like” button or the “Instagram” button, the corresponding information is also transmitted directly to a server of the provider and stored there. The information is also published on the social network and displayed to your contacts there. The purpose and scope of the data collection and the further processing and use of the data by the providers as well as your rights in this regard and setting options to protect your privacy, please refer to the data protection information of the providers.

Privacy Notices from Instagram:
https://help.instagram.com/155833707900388

If you do not want Facebook, Twitter or Instagram to associate the information collected through our site directly with your profile on the social network, you must log out of that network before visiting our site. You can also prevent the loading of plugins completely with add-ons for your browser, e.g. with the script blocker „NoScript“ (http://noscript.net/).

We operate the online presence within the social networks Facebook, Instagram and Twitter to communicate with our business partners and to get in touch with you as a visitor of this site. The operation of these pages, including the processing of the personal data of the users, is based on our legitimate interests in a supportive information and interaction opportunity with our customers pursuant to Art. 6 para. 1 lit. f. DSGVO.

If the users are requested by the respective providers of the platforms to give their consent to the aforementioned data processing, the legal basis for the processing is Art. 6 Para. 1 lit. a., Art. 7 DSGVO.

We would like to point out that the transfer and further processing of personal data of users to third countries, such as the USA, as well as the associated possible risks for users (e.g. in the form of more difficult law enforcement) cannot be excluded by us as the operator of the site. US providers certified under the Privacy Shield are committed to complying with EU privacy standards.

User data is usually processed for market research and advertising purposes. For example, user profiles can be created on the basis of user behaviour and the resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements inside and outside the platforms. For these purposes, cookies are regularly stored on the computers of the users, in which the user behaviour and the interests of the users are stored. In addition, data can also be stored in the user profiles across all devices.

Facebook
In its ruling of 5 June 2018, the European Court of Justice (ECJ) ruled that the operator of a Facebook fan page is jointly responsible with Facebook for the processing of personal data. Facebook’s privacy policy contains further information on data processing: https://www.facebook.com/about/privacy/ . An objection possibility (so-called opt-out) can be found here: https://www.facebook.com/settings?tab=ads are perceived.
The so-called “Insights” on the Facebook page provide us with statistical data of various categories. These statistics are generated and provided by Facebook. As the operator of this site, we have no influence on the generation and display of this information. We cannot turn off this function or prevent the generation and processing of data. Information about this data processing can be found directly on Facebook at https://www.facebook.com/legal/terms/information_about_page_insights_data.

Instagram
Instagram’s privacy policy can be found at: https://help.instagram.com/155833707900388.

Twitter
Twitter’s privacy policy can be found at: https://twitter.com/de/privacy. You can find an opt-out option at: https://twitter.com/personalization

4. Transfer of data to third parties

We transfer your data to processors, these being companies we commission to process data within the legally defined parameters, Art. 28 GDPR (service providers, contractors). In this case, Häfele will still remain responsible for the protection of your data (i.e. we are the “controller”). We have implemented legal, technical and organisational measures, alongside the performance of regular controls, to ensure that processors comply with the provisions of the data protection laws. We commission contractors in the following areas in particular: IT, sales, marketing, finance, consulting, customer service, HR, logistics, printing.

We will also transfer your data to our co-operation partners, who deliver services to you under their own responsibility (suppliers, delivery companies). This is the case when you request us to deliver services from these partners, or if you consent to the involvement of the partner, or if we engage the partner in a situation in which we are legally permitted to do so, such as the performance of a contract, in accordance with Art. 6 (1 b)
GDPR.

Personal data is transferred within the Häfele Group for internal administrative purposes connected with centralised customer care and order processing. The legal basis for this is Art. 6 (1 f) GDPR. Häfele has instituted internal guidelines that obliged its companies to implement the technical/organisational measures for ensuring the security of data processing operations.

Finally, in certain cases we have a legal obligation to provide certain data to public agencies if requested.

5. Length of the storage

Unless otherwise described in this Data Protection Declaration, personal data will be erased once it has fulfilled its applicable, specified purpose, and there are no retention obligations preventing its erasure. Data is routinely erased following the expiry of the retention period, provided it is not needed for the initiation or fulfilment of a contract, and there is no other existing legal basis for the data processing.

6. Security of data processing

We maintain up-to-date technical and organisational measures for ensuring the security of the data processing operation, especially in order to protect your personal data from risks during data transfer and from becoming known to unauthorised third parties. These measures are modified in accordance with the current state-of-the-art, the need for protecting the personal data in question, and the risks to your rights and freedoms. Generally speaking, your data will be processed in Germany and within other European countries. If, in exceptional cases, your data is also processed in countries outside of the European Union (i.e. in “third countries”), this will take place to the extent that you have explicitly consented to it, or if it is necessary in order for us to deliver our service to you, or if it is stipulated by law (Art. 49 GDPR). Furthermore, your data will be processed in third countries only insofar as certain measures are in place to ensure that a reasonable level of data protection exists there (e.g. adequacy decision taken by the EU Commission or “appropriate safeguards”, Art. 44 et seqq. GDPR).

7. Rights of the data subject

You have the right

to demand information concerning the categories of data processed, the purposes of the processing, any recipients of the data, the envisaged storage period (Art. 15 GDPR);
to demand the rectification or augmentation of incorrect or incomplete data (Art. 16 GDPR);
to withdraw consent at any time, effective for the future (Art. 7 (3) GDPR);
to object to the processing of your personal data on grounds relating to your particular situation (Art 21 (1) GDPR);
in certain cases defined in Art. 17 GDPR, to demand the erasure of data – especially insofar the personal data is no longer necessary for the envisaged purpose or if it is processed unlawfully, or if you withdraw your consent in accordance with (3) above, or if you have stated your objection in accordance with (4) above;
under certain conditions, to demand the restriction to the processing of data, insofar as it is not possible to erase it, or the obligation to erase disputed (Art. 18 GDPR);
to data portability, i.e. you are entitled to receive the personal data concerning you, which you provided to us, in a commonly used machine-readable format, such as CSV, and, where relevant, to transmit it to others (Art. 20 GDPR);
to object to the competent data processing supervisory authority regarding the processing of your personal data; the competent supervisory authority in this case is the Data Protection Commissioner of Baden-Württemberg (https://www.baden-wuerttemberg.datenschutz.de/).

8. Amendment of the Data Protection Declaration

We reserve the right to amend this Data Protection Declaration in accordance with relevant changes to the law or the services we offer. Older versions shall remain accessible.

9. Data Protection Information for Applicants

Häfele takes your data privacy very seriously. When you provide us with your application documents and your personal data, you agree that this information may be collected, stored and used as part of the application process. The legal basis for the processing of this data is Art. 6 (1) b) GDPR.

Rights of the data subject
In accordance with the GDPR and the FDPA, you are entitled to be kept informed, to demand the correction, erasure and restrictions on the processing of your data, and its portability. If you wish to exercise your rights, please contact our Data Protection Officer.

Your data will be erased after 12 months at the latest, or in case of hiring it will be transferred to the personnel administration at Häfele. The legal basis for this is Art. 6 (1) b) GDPR. Your specific consent shall be required in order to retain your application in our pool of applicants, or to forward it to other companies within the Häfele Group.

Nagold, 24^th May 2018