Data protection statement in accordance with GDPR
- Name and address of the data controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) and the national data protection laws of other members states and various other data protection provisions is the:
Polyvlies Franz Beyer GmbH
Rodder Str. 52
Tel.: +49 5459 9310 0
- Responsible for the content
Rodder Str. 52
Tel.: +49 5459 9310 0
- Name and address of the data protection officer
The data protection officer for the data controller is:
Tel.: +49 2572 9365 77
- General information about data processing
Scope of the processing of personal data
In principle, we collect and use the personal data of our users only to the extent necessary to provide a functional website along with our content and services. The collection and use of the personal data of our users takes place regularly, only with the consent of the user. An exception applies in those cases in which prior consent for actual reasons is not possible and the processing of the data is permitted by law.
Legal basis for the processing of personal data
Insofar as we obtain the consent of the data owner for the processing operations involved with personal data, Art. 6 para. 1 (a) of the EU General Data Protection Regulation (GDPR) will serve as the legal basis.
Where the processing of the personal data is concerned, which is required to fulfil a contract to which the data owner is a party, Art. 6 para. 1 (b) of the GDPR will serve as the legal basis. This also applies to processing operations which are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 (c) of the GDPR will serve as the legal basis.
In the event that vital interests of the data owner or any other natural person require processing of personal data, Art. 6 para. 1 (d) of the GDPR will serve as the legal basis.
If the processing is necessary to safeguard the legitimate interests of our company or a third party, and the interests, fundamental rights and freedoms of the data owner are not the prior concerns, Art. 6 para. 1 (f) of the GDPR will accordingly serve as the legal basis for the processing.
Data deletion and storage duration
The personal data of the data owner will be deleted or blocked as soon as the purpose for the storage has lapsed. Moreover, such storage may be carried out if it is permitted by the European or national regulatory authorities with regard to EU directives, laws or other regulations to which the data controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for the conclusion or fulfilment of the contract.
Provision of the website and creation of log files
- Description and scope of the data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected here:
- information about the browser type and the version used
- the operating system of the user
- the Internet service provider of the user
- the IP address of the user
- the date and time of the access
- websites from which the user's system visits our website
websites which are accessed by the user's system via our website
The data is also stored in the log files of our system. Storage of this data, together with other personal data of the user, does not take place.
Legal basis for the data processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 (f) of the GDPR.
Purpose of the data processing
The temporary storage of the IP address by the system is necessary in order to allow delivery of the website to the computer of the user. For this purpose, the user's IP address must be stored for the duration of the session.
The storage in log files is carried out in order to ensure the functional capability of the website. In addition, the data is used by us to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this regard.
In these purposes, our legitimate interest in data processing is in accordance with Art. 6 para. 1 (f) of the GDPR.
Duration of the storage
The data will be deleted as soon as it is no longer required to achieve the purpose of its collection. In the case of the collection of the data for providing links to the website, this occurs when the respective session is completed.
Where the storage of the data in log files is involved, this occurs after fourteen days at the latest. Additional storage beyond this date is possible. In this case, the IP addresses of the users are deleted or removed, so that any allocation to the calling client is no longer possible.
Opposition and removal options
The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. There is consequently no contradiction on the part of the user.
a) Description and scope of the data processing
We use technical cookies in order to make our website more user-friendly. Some elements of our website require that the calling browser should also be identified after a page break.
b) Legal basis for the data processing
The legal basis for the processing of personal data using cookies is Art. 6 para. 1 (f) of the GDPR.
c) Purpose of the data processing
We require cookies for the following applications:
- The transfer of language settings
The user data collected by the technically required cookies will not be used to create user profiles.
e) Duration of storage, objection and removal options
The transmission of Flash cookies cannot be prevented by the settings on the browser - only by changing the settings for the Flash Player.
Contact form and email contact
- Description and scope of the data processing
On our website a contact form is available which can be used for making contact by electronic means. If a user makes use of this option, the data entered in the input mask will accordingly be transmitted to us and saved. The data involved includes:
- telephone number
At the time of sending the message, the following data is also stored:
- the IP-address of the user
- the date and time of the registration
For the processing of the data, your consent is obtained during the sending process and reference is made to this data protection statement.
Alternatively, contact is possible using the email address provided. In this case, the user's personal data which has been transmitted by email will be stored.
In this regard there will no disclosure of the data to third parties. The data will be used exclusively for the processing of the conversation.
- Legal basis for the data processing
The legal basis for the processing of the data results from the consent being given by the user in accordance with Art. 6 para. 1 (a) of the GDPR.
The legal basis for the processing of the data which is transmitted in the course of sending an email can be found in Art. 6 para. 1 (f) of the GDPR. If the email contact aims to conclude a contract, then the additional legal basis for the processing can be found in Art. 6 para. 1 (b) of the GDPR.
- Purpose of the data processing
We use the processing of the personal data from the input mask only for processing the contact communication. In the case of contact communication via email, the required legitimate interest also involves the processing of the data.
The other personal data processed during the sending process serves to prevent any misuse of the contact form and to ensure the security of our information technology systems.
- Duration of the storage
The data will be deleted as soon as it is no longer required for achieving the purpose of its collection. With regard to the personal data taken from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is accordingly ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.
The additional personal data collected during the sending process will be deleted at the latest after a period of seven days.
- Objection and removal options
The user has the opportunity at any time to revoke their consent to the processing of the personal data. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation may not continue.
All personal data stored in the course of the contact communication will in this case be deleted.
On our website in the section "Career" you will find the needed information to apply for vacancies. You have the option of applying by e-mail or phone. We collect the following data for processing your application: first and last name, contact details, application documents or data (e.g. CV, certificates).
We collect and process the personal data of candidates for the purpose of handling the application process in accordance with Art. 6 sec. 1 p. 1 lit. b GDPR and § 26 sec. 1 Federal Data Protection Act (BDSG).
Any further processing will not take place or will only take place with your express consent pursuant to Art. 6 sec. 1 p. 1 lit. a GDPR in conjunction with Art. 7 GDPR. In accordance with your express consent pursuant to Art. 6 sec. 1 p.1 lit. a GDPR, we may store your application for future job placements for a pre-determined period of time. In the case of revocation, your application can no longer be considered for the application process.
If we conclude an employment contract with an candidate, the transmitted data will be included in your personnel file for processing the employment relationship in accordance with Art. 6 sec. p. 1 lit. b GDPR and § 26 sec. 1 Federal Data Protection Act (BDSG). In this case, your application documents will only be deleted and destroyed once the employment relationship has been terminated and a further three years have expired since the end of the year of termination.
If no employment contract is concluded, the application documents will be automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests of the controller conflict with such deletion. Another legitimate interest in this sense is, for example, a duty to provide evidence in proceedings under the General Equal Treatment Act (AGG).
Rights of the data owner
If your personal data is processed, you are according to the terms of the GDPR the data owner, and you have the following rights with regard to the data controller:
- Right to information
You may ask the data controller for a confirmation as to whether personal data concerning you will be processed by us.
If such processing exists, you may request the details from the data controller with regard to the following information:
(1) the purposes for which the personal data is processed;
(2) the categories of the personal data which are processed;
(3) the recipients or categories of recipients to whom the personal data relating to you has been or will be disclosed;
(4) the planned duration of the storage of your personal data or, if specific information in this respect is not available, criteria for determining the duration of storage;
(5) the existence of a right to rectification or deletion of the personal data concerning you, a right to restriction of the processing by the data controller or a right to object to this processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) all the available information concerning the origin of the data, if the personal data is not collected from the data owner;
(8) the existence of automated decision making including profiling in accordance with Art. 22 paras. 1 and 4 of the GDPR and – at least in these cases – meaningful information about the logic involved, as well as the consequences and the intended effects of such processing where the data owner is concerned.
You have the right to request information about whether your personal information will be transmitted to a third country or to an international organisation. In this connection you may request to be informed about the appropriate guarantees in accordance with Art. 46 of the GDPR in connection with the transfer.
- Right to rectification
You have a right to rectification and/or completion by the data controller, if the processed personal data concerning you is incorrect or incomplete. The data controller will undertake the rectification without delay.
- Right to restriction of the processing
You may request the restriction of the processing of your personal data under the following conditions:
(1) if you dispute the accuracy of your personal information for a period of time which allows the data controller to verify the accuracy of your personal information;
(2) the processing is illegal and you refuse the deletion of the personal data and instead demand the restriction of the use of the personal data;
(3) the data controller no longer needs the personal data for the purposes of the processing; however, you need it for the assertion, exercise or defence of legal claims, or
(4) if you object to the processing in accordance with Art. 21 para. 1 of the GDPR and it has not yet been determined whether the reasons for justification given by the data controller outweigh your reasons.
If the processing of personal data concerning you has been restricted, this data - apart from its storage - may only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person, or for reasons of important public interest affecting the Union or a member state.
If the restriction of the processing was carried out after the aforementioned conditions were restricted, you will be informed by the data controller before the restriction is lifted.
- Right to deletion
- Deletion obligations
You may require the data controller to delete your personal information without delay, and the data controller is obliged to delete this data immediately if one of the following reasons applies:
(1) your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
(2) you revoke your consent upon which the processing in accordance with Art. 6 para. 1 (a) or Art. 9 para. 2 (a) of the GDPR was based, and there is no other legal basis for the processing.
(3) you raise an objection in accordance with Art. 21 para. 1 of the GDPR to the processing and there are no prior justifiable reasons for the processing, or you raise an objection in accordance with Art. 21 para. 2 of the GDPR to the processing.
(4) your personal data has been processed unlawfully.
(5) The deletion of personal data concerning you is required to fulfil a legal obligation under the law of the EU or the member states to which the data controller is subject.
(6) The personal data relating to you has been collected in respect of information society services offered in accordance with Art. 8 para. 1 of the GDPR.
- Information to third parties
If the data controller has made the personal data concerning you public and is, in accordance with Art. 17 para. 1 of the GDPR, committed to its deletion, it will accordingly take the appropriate measures, including technical ones, taking into account the available technology and the implementation costs, in order to inform the data processors involved with processing the personal data that you, as the data owner, have requested from them the deletion of all links to such personal data or copies or replications of such personal data.
The right to deletion does not exist whenever the processing is required
(1) for the exercise of the right to freedom of expression and information;
(2) for the fulfilment of a legal obligation which the processing requires under the law of the Union or of the member states to which the data controller is subject, or for the performance of a task which is in the public interest or is carried out by a public authority which has been delegated to the data controller;
(3) for reasons of public interest in the field of public health in accordance with Art. 9 para. 2 (h) and (i) and Art. 9 para. 3 of the GDPR;
(4) for archival purposes pertaining to the public interest, for scientific or historical research purposes, or for statistical purposes in accordance with Art. 89 para. 1 of the GDPR, insofar as the law referred to in paragraph (a) is likely to render impossible or seriously prejudice the achievement of the objectives of that processing, or
(5) for asserting, exercising or defending legal claims.
- Right to information
If you have asserted the right to rectification, deletion or restriction of the processing with respect to the data controller, the latter is obliged to inform all recipients, to whom the personal data relating to you has been disclosed, with regard to this rectification or deletion of the data or the restriction of the processing, unless this proves impossible or requires disproportionate effort.
You have the right to be informed by the data controller about these recipients.
- Right to data portability
You have the right to receive the personal data which you have provided to the data controller in a structured, readily available and machine-readable format. In addition, you have the right to transmit this data to another data controller without interference from the data controller to which the personal data was made available, provided that
(1) the processing is based upon consent given in accordance with Art. 6 para. 1 (a) of the GDPR or Art. 9 para. 2 (a) of the GDPR, or is based upon an agreement in accordance with Art. 6 para. 1 (b) of the GDPR and
(2) the processing is carried out using automated procedures.
In exercising this right, you also have the right to expect that personal data relating to you will be transmitted directly from one data controller to another data controller, insofar as this is technically feasible. The freedoms and rights of other persons may not be affected.
The right to data portability does not apply to any processing of the personal data required for the performance of a task in the public interest or in the exercise of public authority which has been delegated to the data controller.
- Right to raise an objection
You have the right at any time, for reasons which arise from your particular situation, to raise an objection against the processing of personal data concerning you, which is carried out pursuant to Art. 6 para. 1 (e) or (f) of the GDPR; this also applies to profiling based on these provisions.
The data controller will no longer process the personal data relating to you unless it can demonstrate compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms, or if the processing is required for the assertion, exercise or defence of legal claims.
If the personal data relating to you is processed in order to allow the operation of direct mail, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail.
If you raise an objection to any processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
Regardless of Directive 2002/58/EC, you have the option, where the use of information society services is involved, to exercise your right to raise objections which are generated by automated procedures in which technical specifications are used.
- Right to revoke the declaration of consent regarding data protection
You have the right to revoke your data protection declaration at any time. The revocation of consent does not affect the legality of the processing carried out upon the basis of consent existing until the revocation.
- Automated decision-making on an individual basis including profiling
You have the right not to be subjected to a decision based solely upon automated processing - including profiling - which will have any legal effect upon you, or further affect you in a similar manner. This does not apply if the decision
(1) is required to complete or execute an agreement between you and the data controller,
(2) is permitted by the legal provisions of the Union or the member states to which the data controller is subject, and these legal provisions contain measures appropriate to safeguard your rights and freedoms, as well as your legitimate interests or
(3) is carried out with your explicit consent.
However, these decisions may not apply to specific categories of personal data under Art. 9 para. 1 of the GDPR, unless Art. 9 para. 2 (a) or (g) of the GDPR does not apply and reasonable measures have been taken to protect the rights and freedoms and your legitimate interests.
With regard to the cases mentioned in (1) and (3), the data controller will take appropriate measures in order to uphold the rights and freedoms as well as your legitimate interests, for which at least the right to obtain the intervention of a person on the part of the data controller forms part of a statement of one's own position and a contestation of the decision.
- Right to complain to a supervisory authority
Without prejudice to any other administrative or legal remedy, you will have the right to complain to a supervisory authority, in particular in the member state of your place of residence, place of employment, or the place of the alleged infringement, if you believe that the processing of the personal data concerning you violates the GDPR.
The supervisory authority to which the complaint has been submitted will inform the plaintiff of the status and results pertaining to the complaint, including the possibility of a legal remedy according to Art. 78 of the GDPR.