Data Privacy Statement

Privacy Policy

We are pleased that you are visiting our website. The protection and security of your personal information when using our website is very important to us. We would therefore like to inform you at this point about which of your personal data we collect when you visit our website and for what purposes this data is used. Personal data refers to individual details about the personal or factual circumstances of a specific or identifiable natural person (data subject), e.g. name, address, email addresses, user behavior. These are therefore data with which we can identify you. In addition, you will also occasionally find information here about data processing procedures outside this website (e.g. video conferences or newsletters).

Controller for Data Processing

Controller

for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR)
HD Möbelzubehör GmbH
Max-Planck-Str. 114
32107 Bad-Salzuflen
DE
05232-9552-0
mail@hd-fittings.com

Data Protection Officer

exkulpa gmbh
Waldfeuchterstr. 266
52525 Heinsberg
Telefon: 02452 / 99 33 11
E-Mail: datenschutz@hd-fittings.com

This privacy policy fulfills the legal requirements for transparency in the processing of personal data. This refers to all information relating to an identified or identifiable natural person. This includes, for example, information such as your name, age, address, telephone number, date of birth, email address, IP address or user behavior when visiting a website. Information for which we cannot establish a connection to your person (or only with disproportionate effort), e.g. through anonymization, is not personal data. The processing of personal data (e.g. collection, retrieval, use, storage or transmission) always requires a legal basis and a defined purpose.

Stored personal data will be deleted as soon as the purpose of processing has been achieved and there are no lawful reasons for further storage of the data. We will inform you in the individual processing operations about the specific storage periods or criteria for storage. Regardless of this, we store your personal data in individual cases for the assertion, exercise or defense of legal claims and in the event of statutory retention obligations.

Information pursuant to Art. 13 GDPR

This information is aimed at customers, prospects, suppliers, and employees. Your personal data will be processed by us for the following purposes:

To fulfill our contractual obligations to which we are committed towards you (Art. 6 para. 1 lit. b GDPR).
To carry out pre-contractual obligations (Art. 6 para. 1 lit. b GDPR).
To respond to inquiries (Art. 6 para. 1 lit. b GDPR).
If you have given us consent to process your personal data for specific purposes (e.g. to receive our newsletter), the data processing is based on your consent (Art. 6 para. 1 lit. a GDPR).
To comply with legal obligations to which our company is subject (Art. 6 para. 1 lit. c GDPR).
Where necessary, we also process your data to safeguard our legitimate interests, in particular to assert legal claims and defend in legal disputes, ensure IT security, consult and exchange data with credit agencies to determine credit and default risks, direct marketing and market research unless you have objected to the use of your data for this purpose, business management measures and further development of services and products, product and sales optimization measures, risk management measures, prevention or clarification of criminal offenses (Art. 6 para. 1 lit. f GDPR).

Categories of Recipients of Personal Data

Within our company, only those employees have access to the data who absolutely need it to perform their tasks (need-to-know principle). Individual processes and services are carried out by carefully selected service providers contracted in compliance with data protection, who are located within the EEA. If service providers commissioned by us gain access to personal data in the course of performing their services, data processing agreements have been concluded with them in accordance with Art. 28 para. 3 GDPR.

Duration of Data Storage

The data processed by us will be stored for the duration of the existence and settlement of the contractual relationship and in compliance with statutory retention obligations. These are in particular commercial and tax retention obligations according to the German Commercial Code (HGB) and the Fiscal Code (AO). The regular retention and documentation periods are therefore up to ten years. If no contractual relationship arises, we only process the data as long as the specific purpose requires.

Your Rights as a Data Subject

As a data subject, you have the following rights regarding your personal data processed by us:

Right to information about the data processed concerning you.
Right to rectification or deletion, if this data is incorrect, not up to date, or unlawfully collected by us.
Right to restriction of processing, if complete deletion is not possible, e.g. because we have to comply with statutory retention obligations.
Right to object to processing, if the data processing is based on a balancing of interests (so-called legitimate interest), as described above under „Purpose of Processing.“ This is the case if processing is not particularly necessary for the performance of a contract with you. When exercising your right to object, we ask you to explain the reasons why we should not process your data as carried out by us.

Of course, you can also object at any time to the processing of your personal data for advertising purposes. Please address your objection to the address provided in the imprint or send us an email to the address provided in the imprint.

Right to withdraw consent, if you have given us consent to process your data. You may revoke your consent at any time without giving reasons by contacting our company. Please contact the address provided in the imprint.
Furthermore, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by our company.

If you have questions about data protection, you are welcome to contact us by email at the address provided in the imprint.

Cookies

Cookies are small text files that are sent from us to the browser of your end device and stored there in the course of your visit to our websites. Alternatively, information can also be stored in the local storage of your browser. Some functions of our website cannot be offered without the use of cookies or local storage (technically necessary cookies). Other cookies, however, enable us to carry out various analyses, so that we are able, for example, to recognize the browser you use when you revisit our website and to transmit various information to us (non-essential cookies). With the help of cookies, we can make our internet offering more user-friendly and effective for you, for example by tracking your use of our website and determining your preferred settings (e.g. country and language settings). If third parties process information via cookies, they collect the information directly via your browser. Cookies do not cause any damage to your end device. They cannot execute programs and cannot contain viruses. We inform you about the respective services for which we use cookies in the individual processing operations. Detailed information about the cookies used can be found in the cookie settings or the consent manager of this website.

Data Processing in Detail

Below we inform you about the individual processing operations, the scope and purpose of data processing, the legal basis, the obligation to provide your data and the respective storage period. Automated decision-making in individual cases, including profiling, does not take place.

Provision of the Website

When accessing and using our website, we collect the personal data that your browser automatically transmits to our server. The following information is temporarily stored in a so-called log file:

IP address of the requesting computer
Date and time of access
Name and URL of the file retrieved
Website from which the access occurs (referrer URL)
Browser used and, if applicable, the operating system of your computer as well as the name of your access provider

Our website is not hosted by us, but by a service provider who processes the aforementioned data on our behalf in accordance with Art. 28 GDPR for the purpose of providing the website.

The use of the hosting provider is carried out for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 para. 1 lit. f GDPR).

Contact Form

Type and scope of processing

If you send us inquiries (e.g. via contact form, email or telephone), we store all data resulting from this (e.g. name, email address, subject of the inquiry, etc.). We need this data to process your request and to answer any follow-up questions. We do not pass on this data without your consent.

Purpose and legal basis

The processing of this data is carried out on the basis of Art. 6 para. 1 lit. b GDPR, if your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. Otherwise, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if you have previously given it.

Storage duration

The data you enter in the contact form remains with us until you ask us to delete it, revoke your consent to store it, or the purpose for data storage ceases to apply (e.g. after your request has been processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Applications

Type and scope of processing

You have the option to apply to us on our website (e.g. by email, post or via online application form).

Purpose and legal basis

We process applicants‘ personal data in accordance with legal requirements for the purpose of handling the application process and for the implementation of pre-contractual measures in the sense of Art. 6 para. 1 lit. b GDPR (initiation of an employment relationship) and – if you have given consent – Art. 6 para. 1 lit. a GDPR. Consent may be revoked at any time. Within our company, your personal data will only be shared with persons involved in processing your application.

If the application is successful, the data you have submitted will be stored on the basis of Art. 6 para. 1 lit. b GDPR for the purpose of carrying out the employment relationship in our data processing systems.

Storage duration

Your data will be stored for a period of 6 months beyond the end of the application process. This is usually to fulfill legal obligations or to defend against possible claims from statutory regulations. After this, we are obliged to delete or anonymize your data. In this case, the data will only be available to us as so-called metadata without direct personal reference for statistical evaluations (e.g. proportion of female or male applicants, number of applications per period, etc.).

If it is apparent that the data will be required after the 6-month period has expired (e.g. due to a pending legal dispute), deletion will only take place when the purpose for the extended storage ceases.

Inclusion in the Applicant Pool

As part of the application process, we offer applicants the opportunity to be included in our “talent pool” for a period of 12 months on the basis of consent in accordance with Art. 6 para. 1 lit. a GDPR.

The application documents in the talent pool are processed solely within the framework of future job advertisements and recruitment and will be destroyed no later than at the end of the period. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the current application process, and that they can withdraw this consent at any time for the future.

If, as part of the application process, you receive an offer of employment from us and accept it, we will store the personal data collected during the application process at least for the duration of the employment relationship.

Video Conferences

Data processing

We use online conference tools to communicate with our customers. The tools we use in detail are listed below. If you communicate with us via video or audio conference, your personal data will be collected and processed by us and the provider of the respective tool.

The tools collect the data you provide, including your email address and phone number. They also process the duration of the conference, when you joined the conference, number of participants, and other metadata.

In addition, the provider of the tool processes all technical data required to handle the conference. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker as well as the type of connection.

If you share content within this service, it will be stored on the provider’s servers. This includes cloud recordings, chat messages, voice messages as well as photos and videos that you have shared while using this service.

Please note that we do not have full influence over the data processing operations of the tools used. For more information on data processing by the conference tools, please refer to the privacy policies of the tools used.

Purpose and legal basis

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 para. 1 lit. b GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). If you have previously given consent to data processing, your data will be processed solely on the basis of Art. 6 para. 1 lit. a GDPR; consent may be withdrawn at any time.

Storage duration

The data collected directly by us via the video and conference tools will be deleted from our systems as soon as you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence on the duration of storage of your data that the operators of the conference tools store for their own purposes. For details, please check directly with the operators of the conference tools.

Google Maps

Type and scope of processing

This website uses Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions, it is necessary to store your IP address. The information is usually transferred to a Google server and stored there.

We have no influence on this data transmission. If Google Maps is activated, Google may use web fonts for the purpose of uniform font display. Your browser loads the required fonts into your browser cache when accessing Google Maps so that fonts are displayed correctly.

The Google privacy policy can be found here: [https://policies.google.com/privacy?hl=en](https://policies.google.com/privacy?hl=en)

Purpose and legal basis

The use of Google Maps is based on our legitimate interest in an attractive presentation of our online offerings and in the easy findability of the locations we provide (Art. 6 para. 1 lit. f GDPR). If consent has been requested, the processing of data is carried out exclusively on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. This can be withdrawn at any time.

The company is certified under the „EU-US Data Privacy Framework“ (DPF), an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards when processing data in the USA. Certification under the DPF obliges companies to comply with these data protection standards.

Data transfer to the USA is based on the EU Commission’s standard contractual clauses: [https://business.safety.google/gdprcontrollerterms/sccs/](https://business.safety.google/gdprcontrollerterms/sccs/) and [https://business.safety.google/gdprcontrollerterms/](https://business.safety.google/gdprcontrollerterms/)

Google reCAPTCHA

Type and scope of processing

This website uses Google reCAPTCHA. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of reCAPTCHA, data entry (e.g. in a contact form) on this website is checked. Specifically, whether this is carried out by a human or by an automated program. Google reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. The analysis starts automatically as soon as the visitor accesses the website. The data collected during the analysis, such as the IP address, duration of stay of the website visitor, or mouse movements, are transmitted to Google.

Visitors are not informed that an analysis is taking place; it runs entirely in the background.

The Google privacy policy and terms of use can be found at the following links: [https://policies.google.com/privacy?hl=en](https://policies.google.com/privacy?hl=en) and [https://policies.google.com/terms?hl=en](https://policies.google.com/terms?hl=en)

Purpose and legal basis

The storage and analysis of data are based on our legitimate interest in protecting our web offerings from abusive automated spying and spam (Art. 6 para. 1 lit. f GDPR). If consent has been requested, the processing of data is carried out exclusively on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. This can be withdrawn at any time.

Vimeo Video

Type and scope of processing

This website uses plugins from the Vimeo video portal. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you start a Vimeo video on this website, a connection to their servers is established. The Vimeo server is informed which of our pages you have visited. Vimeo also obtains your IP address. However, we have configured the settings so that Vimeo cannot track your user activity and will not set any cookies.

Purpose and legal basis

The use of Vimeo is based on our legitimate interest in an attractive presentation of our online offerings (Art. 6 para. 1 lit. f GDPR). If consent has been requested, the processing of data is carried out exclusively on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. This can be withdrawn at any time.

Data transfer to the USA is based on the EU Commission’s standard contractual clauses. Vimeo’s privacy policy can be found here: [https://vimeo.com/privacy](https://vimeo.com/privacy)