Privacy Policy

Name and contact details of the Controller as per Article 4(7) GDPR

Company: Scholz GmbH & Co KG

Address: Nalserstraße 39, 96317 Kronach, Germany

Tel: +49 (0)9261/60770
Fax: +49 (0)9261/607760
Email: info@scholz-htik.de

Data protection officer

Name: Andreas Hein

Appointed from: 1 April 2023

Email: info@its-datenschutz.de

Tel: 09273/50139-0

External appointment: Yes

External company: ITs Hein GmbH, Kulmbacher Straße 27b, 95460 Bad Berneck, www.its-datenschutz.de

Security and protection of your personal data

It is our top priority to maintain the confidentiality of the personal data you provide to us and to protect it against unauthorised access. We exercise the utmost care and implement state-of-the-art security standards to ensure maximum protection of your personal data.

As a company under private law, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the regulations of the German Data Protection Act (BDSG). We have taken technical and organisational measures to ensure that data protection regulations are observed by both us and our external service providers.

Definition of terms

The law states that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’). In order to ensure this, we hereby inform you of the legal definitions of the terms used in this privacy policy:

1. Personal data

‘Personal data’ is any information relating to an identified or identifiable natural person (hereinafter ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2. Processing

‘Processing’ is any operation or set of operations which is performed on personal data, whether or not by automated means, such as collecting, recording, organising, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, comparing or combining, restricting, deleting, or destroying.

3. Restriction of processing

‘Restriction of processing’ is the marking of stored personal data with the aim of limiting its processing in the future.

4. Profiling

‘Profiling’ is any form of automated processing of personal data consisting of the use of this personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

5. Pseudonymisation

‘Pseudonymisation’ is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

6. Filing system

‘Filing system’ is any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

7. Controller

‘Controller’ is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by EU or Member State law, the controller or the specific criteria for its nomination may be provided for by EU or Member State law.

8. Processor

A ‘Processor’ is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

9. Recipient

‘Recipient’ means a natural or legal person, public authority, agency, or another body to which the personal data is disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular enquiry in accordance with EU or Member State law shall not be regarded as recipients; the processing of such data by those public authorities shall comply with the applicable data protection rules according to the purposes of the processing.

10. Third party

‘Third party’ is a natural or legal person, public authority, agency, or body other than the data subject, controller, processor or persons who, under the direct authority of the controller or processor, are authorised to process personal data.

11. Consent

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or clear affirmative action, signify agreement to the processing of personal data relating to them.

Lawfulness of processing

The processing of personal data is only lawful if there is a legal basis for the processing. According to Article 6 Paragraph 1(a)-(f) of the GDPR, legal bases for the processing can include in particular:

a. the data subject has consented to the processing of their personal data for one or more specific purposes;

b. the processing is necessary for the fulfilment of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

c. the processing is necessary for compliance with a legal obligation to which the controller is subject;

d. the processing is necessary in order to protect the vital interests of the data subject or of another natural person;

e. the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

f. the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Information about the collection of personal data

(1) Below we explain what personal data is collected when you use our website. Personal data include name, address, email addresses, and user behaviour.

(2) When you contact us by email or through a contact form, the data you share (your email address, possibly your name, and your telephone number) is saved by us so that we can respond to your enquiry. We delete all the data collected in this respect once it is no longer required to be saved, or processing is restricted if there are legal obligations to preserve records.

Collection of personal data when you visit our website

If you only use our website for information purposes, i.e. you do not register or send us information in any other way, we only collect the personal data that your browser sends to our server. If you wish to view our website, we collect the following data which we require for technical reasons to display the website to you and to ensure stability and security (the legal basis for this is Article 6 Paragraph 1 (1(f)) GDPR:

•  IP address
•  Date and time of your visit to our website
•  Time zone difference to Greenwich Mean Time (GMT)
•  Webpage viewed
•  Access status/HTTP status code
•  Volume of data transferred
•  Website from which you came to our website
•  Browser
•  Operating system and its user interface
•  Language and version of browser.

Use of cookies

(1) In addition to the data stated above, cookies are stored on your computer when you use our website. Cookies are small text files, which are saved on your hard drive by your browser, which are used to transmit information to our website. Cookies cannot run programs or transmit viruses to your computer. They serve to make the webpages more user-friendly and effective overall.

(2) This website uses the following types of cookies. Their scope and how they work is also explained:

• Temporary cookies (see a)
• Persistent cookies (see b)

a. Temporary cookies are automatically deleted when you close your browser. These include session cookies in particular. They save what is known as a session ID, which is used to assign the requests made by your browser to the overall session. In this way your computer can be recognised when you return to our website. The session cookies are deleted when you log out or close your browser.

b. Persistent cookies are automatically deleted after a specified period of time, which can vary depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

c. You can set your browser to refuse
to allow third-party cookies or all cookies if you wish. Third-party cookies are cookies placed by a third party, therefore not by the actual website you are currently visiting. Please note that if you disable cookies, you may not be able to use all of the functions of this website.

d. We use cookies to identify you on subsequent visits if you have an account with us. Otherwise, you would have to log in again every time you visit.

e. The Flash cookies used are not recorded by your browser but by your Flash plug-in. We also use HTML5 storage objects, which are stored on your end device. These objects save the required data independently of the browser you use and have no automatic expiry date. If you do not want the Flash cookies to be used, you will need to install an appropriate add-on, e.g. ‘Better Privacy’ for Mozilla Firefox (https://addons.mozilla.org/de/firefox/addon/betterprivacy/) or Adobe Flash Killer Cookie for Google Chrome. You can stop HTML5 storage objects from being used by setting your browser to private mode. We also recommend that you regularly delete your cookies and browsing history manually.

Other functions and services on our website

(1) As well as using our website solely for information purposes, we offer various services which you may be interested in using. To this end, you will usually have to enter further personal data, which we use to provide the respective service and to which the aforementioned principles on data processing apply.

(2) In some cases, we use external service providers to process your data. These are carefully selected and appointed by us, are bound by our instructions, and are regularly monitored.

(3) We can also forward your personal data to third parties if we offer sales campaigns, competitions, agreements or similar services together with partners. You will receive further information about this when you provide your personal data or below in the description of the service.

(4) If our service provider or partner is located in a country outside of the European Economic Area (EEA), we shall inform you about the implications of this in the description of the service.

Children

Our services are essentially aimed at adults. Persons under the age of 18 should not send any personal data to us without the consent of their parents or legal guardians.

Rights of the data subject

(1) Withdrawal of consent

If you have consented to the processing of your personal data, you can withdraw this consent at any time. The withdrawal of consent shall not affect the lawfulness of the processing based on your consent prior to its withdrawal.

You can contact us at any time to withdraw your consent.

(2) Right to confirmation

You are entitled to ask the controller for confirmation of whether we process your personal data. You can request this confirmation at any time using the contact details above.

(3) Right of access

If we process your personal data, you can request information about this personal data and the following information at any time:

a. the purposes of the processing;

b. the categories of personal data concerned;

c. the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third-party countries or international organisations;

d. where possible, the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;

e. the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction of the processing of personal data concerning the data subject, or to object to such processing;

f. the right to lodge a complaint with a supervisory authority;

g. where the personal data is not collected from the data subject, any available information as to their source;

h. the existence of automated decision-making, including profiling, referred to in Article 22 Paragraphs 1 and 4 of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data is transferred to a third-party country or to an international organisation, you have the right to be informed of the appropriate safeguards relating to the transfer pursuant to Article 46 of the GDPR. We shall provide a copy of the personal data undergoing processing. For any further copies requested by you, we can charge a reasonable fee based on administrative costs. If you make the request by electronic means, and unless otherwise requested, the information shall be provided in a commonly used electronic form. The right to obtain a copy referred to in Paragraph 3 shall not adversely affect the rights and freedoms of others.

(4) Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

(5) Right to erasure (‘right to be forgotten’)

You have the right to have the controller erase personal data concerning you without undue delay and we have the obligation to erase personal data without undue delay where one of the following grounds applies:

a. the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.

b. the data subject withdraws their consent on which the processing is based pursuant to Article 6 Paragraph 1(a) or Article 9 Paragraph 2(a) of the GDPR, and where there is no other legal basis for the processing.

c. the data subject objects to the processing pursuant to Article 21 Paragraph 1 of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21 Paragraph 2 of the GDPR.

d. The personal data has been unlawfully processed.

e. The personal data must be erased for compliance with a legal obligation in EU or Member State law to which the controller is subject.

f. The personal data has been collected in relation to the offer of information society services referred to in Article 8 Paragraph 1 of the GDPR.

Where the controller has made the personal data public and is obliged pursuant to Paragraph 1 to erase the personal data, the controller, taking account of the available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, this personal data.

The right to erasure (‘right to be forgotten’) shall not apply to the extent that processing is necessary:

• to exercise the right of freedom of expression and information;
• to comply with a legal obligation which requires processing by EU or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of the public interest in relation to public health in accordance with Article 9 Paragraph 2(h) and (i) as well as Article 9 Paragraph 3 of the GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 Paragraph 1 of the GDPR insofar as the right referred to in Paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of this processing; or
• for the establishment, exercise or defence of legal claims.
   

(6) Right to restriction of processing

You have the right to have us restrict the processing of your personal data where one of the following applies:

a. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

b. the processing is unlawful and the data subject opposes the erasure of their personal data and requests the restriction of its use instead;

c. the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise, or defence of legal claims; or

d. the data subject has objected to processing pursuant to Article 21 Paragraph 1 of the GDPR pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under the aforementioned conditions, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of a Member State.

The data subject can contact us at any time using the contact details above to assert this right to a restriction of processing.

(7) Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where:

a. the processing is based on consent pursuant to Article 6 Paragraph 1(a) or Article 9 Paragraph 2(a) or on a contract pursuant to Article 6 Paragraph 1(b) of the GDPR and

b. the processing is carried out by automated means.

In exercising your right to data portability pursuant to Paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability shall be without prejudice to the right to erasure (‘right to be forgotten’). This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

(8) Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6 Paragraph 1(e) or (f) of the GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless they demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you can exercise your right to object by automated means using technical specifications.

Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89 Paragraph 1, you have the right to object to the processing of personal data concerning you on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for the public interest.

You can exercise this right to object at any time by contacting the controller.

(9) Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal consequences for you or similarly significantly affects you. This shall not apply if the decision:

a. is necessary for entering into or fulfilling a contract between the data subject and a data controller;

b. is authorised by EU or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

c. is based on the data subject’s explicit consent.

The controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express the data subject’s point of view and to contest the decision.

The data subject can exercise this right at any time by contacting the controller.

(10) Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes this regulation.

(11) Right to an effective judicial remedy against a supervisory authority

Without prejudice to any other administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR, you have the right to an effective judicial remedy if you believe that the rights granted to you on the basis of this regulation have been breached as a result of your personal data being processed in a way that does not comply with this regulation.

Use of Matomo

(1) This website uses the Matomo web analytics service to analyse and regularly improve the use of our website. We can use the statistics we obtain to improve our service and make it more interesting to you as the user. The legal basis for the use of Matomo is Article 6 Paragraph 1(1(f)) of the GDPR.

(2) Cookies are stored on your computer for this analysis. Information collected in this way is only saved by the controller on their server in [Germany]. You can stop the analysis by deleting existing cookies and preventing the saving of cookies. Please note that if you prevent cookies from being saved, you may not be able to use all of the functions of this website. You can prevent cookies from being saved in your browser settings. You can prevent the use of Matomo by unticking the box below and thereby enabling the opt-out plug-in:

(3) This website uses Matomo with the ‘AnonymizeIP’ extension. This shortens IP addresses so that they cannot be directly related to persons. The IP address sent by Matomo from your browser is not added to the other data collected by us.

(4) The Matomo program is an open source project. For this third-party supplier’s information on data protection, please see matomo.org/privacy-policy/

Leadinfo:
We use the lead generation service of Leadinfo B.V., Rotterdam, the Netherlands. It recognises visits from companies to our website based on IP addresses and shows us publicly available information, such as company names or addresses. In addition, Leadinfo installs two first-party cookies to analyse user behaviour on our website and processes domains from form entries (e.g. ‘leadinfo.com’) in order to correlate IP addresses with companies and improve services. Further information can be found at www.leadinfo.com. At www.leadinfo.com/en/opt-out you have an opt-out option. If you opt out, your data will no longer be collected by Leadinfo.