Privacy Policy
Responsible:
Name/Company: Langer & Laumann Ing.-Büro GmbH
Street/No.: Wilmsberger Weg 8
Postcode, City, Country: 48565 Steinfurt, Germany
Register Court: Steinfurt Local Court, HRB 2943
Managing Director: Carsten Blanke, Florian Rauch
Telephone: +49 (2552) 92 7 91 0
Email address: info@lul-ing.de
Contact details of the Data Protection Officer:
Langer & Laumann Ing.-Büro GmbH
– Data Protection Officer –
Email: datenschutz@lul-ing.de
Last updated: 15 December 2020
1. General Information on Data Processing and Legal Bases
1.1. This Privacy Policy explains the nature, scope and purpose of the processing of personal data within our online services and the websites, functions and content associated with them (hereinafter collectively referred to as the “Online Services” or “Website”). This Privacy Policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) used to operate the Online Services.
1.2. The terms used, such as “personal data” or “processing”, refer to the definitions set out in Article 4 of the General Data Protection Regulation (GDPR).
1.3. The personal data of users processed as part of these Online Services includes:
- Login data (account data, email address)
- Master data (product enquiries, newsletter subscriptions – name, address, email address)
- Usage data (website visitor tracking within our Online Services)
- Content data (emails, contact form enquiries)
1.4. The term “user” covers all categories of data subjects affected by data processing. These include:
- Customers
- Prospective customers
- Other visitors to our Online Services
The terms used, such as “user”, are to be understood as gender-neutral.
1.5. We process users’ personal data only in compliance with the applicable data protection regulations. This means that users’ data is processed only where permitted by law. In particular, this applies where the processing of data is necessary to provide our contractual services (e.g. processing orders) and online services, where processing is required by law, where users have given their consent, or on the basis of our legitimate interests (i.e. our interest in analysing, optimising and operating our Online Services economically and securely within the meaning of Article 6(1)(f) GDPR), in particular for measuring reach, creating profiles for advertising and marketing purposes, collecting access data and using third-party services.
1.6. We would like to point out that the legal basis for consent is Article 6(1)(a) and Article 7 GDPR; the legal basis for processing for the performance of our services and the implementation of contractual measures is Article 6(1)(b) GDPR; the legal basis for processing for compliance with our legal obligations is Article 6(1)(c) GDPR; and the legal basis for processing for the purposes of safeguarding our legitimate interests is Article 6(1)(f) GDPR.
2. Security Measures
2.1. We implement organisational, contractual and technical security measures in accordance with the state of the art to ensure compliance with data protection legislation and to protect the data we process against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons.
2.2. Security measures include, in particular, the encrypted transmission of data between your browser and our server.
3. Disclosure of Data to Third Parties and Third-Party Providers
3.1. Data is disclosed to third parties only within the framework of the applicable legal provisions. We disclose users’ data to third parties only where this is necessary, for example, on the basis of Article 6(1)(b) GDPR for contractual purposes or on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR in the economical and efficient operation of our business.
3.2. Where we engage subcontractors to provide our services, we take appropriate legal precautions and implement suitable technical and organisational measures to ensure the protection of personal data in accordance with the applicable statutory provisions.
3.3. Where this Privacy Policy refers to content, tools or other services provided by other providers (hereinafter collectively referred to as “third-party providers”) and the stated registered office of such providers is located in a third country, it should be assumed that data is transferred to the countries in which the third-party providers are based. Third countries are countries in which the GDPR does not have direct legal effect, i.e. generally countries outside the European Union (EU) and the European Economic Area (EEA). Data is transferred to third countries either where an adequate level of data protection exists, where users have given their consent, or where another legal basis permits such transfer.
4. Contact
4.1. If you contact us by email, telephone or fax, your enquiry, including all personal data resulting from it (name, enquiry), will be stored and processed by us for the purpose of handling your request. We will not disclose this data without your consent.
The processing of this data is based on Article 6(1)(b) GDPR where your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us (Article 6(1)(f) GDPR).
The data you send to us as part of contact enquiries will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully dealt with). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.
5. Collection of Access Data and Log Files
5.1. On the basis of our legitimate interests within the meaning of Article 6(1)(f) GDPR, we collect data relating to every access to the server on which this service is hosted (so-called server log files). Access data includes the name of the website or file accessed, the date and time of access, the volume of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
5.2. This server log file information is stored for security reasons (e.g. to investigate misuse or fraudulent activity) for a period of seven days (error log) or 60 days (access log) and is then deleted. Data that needs to be retained as evidence is excluded from deletion until the relevant incident has been finally resolved. The server is located in Germany.
6. Cookies & Reach Measurement
6.1. Cookies are pieces of information transmitted by our web server or third-party web servers to users’ web browsers and stored there for later retrieval. Cookies may consist of small files or other forms of information storage.
6.2. We use “session cookies”, which are stored only for the duration of the current visit to our website (to store the wishlist function). A session cookie contains a randomly generated unique identification number, known as a session ID. A cookie also contains information about its origin and storage period. These cookies do not store any personal data. Session cookies are deleted when you stop using our Online Services, for example when you log out or close your browser.
6.3. Users are informed about the use of cookies for reach measurement in this Privacy Policy.
6.4. If users do not wish cookies to be stored on their computer, they are asked to disable the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Disabling cookies may result in limitations to the functionality of these Online Services.
7. Reach Analysis with Matomo (formerly PIWIK)
7.1. On the basis of our legitimate interests (i.e. our interest in analysing, optimising and operating our Online Services economically within the meaning of Article 6(1)(f) GDPR), we use Matomo, an open-source software solution for the statistical analysis of user access. Users’ IP addresses are truncated before being stored. However, Matomo uses cookies that are stored on users’ computers and enable analysis of their use of these Online Services. Pseudonymous usage profiles may be created from the processed data.
7.2. The information generated by the cookie about your use of these Online Services is stored on our server and is not disclosed to third parties.
Matomo status / Enable and disable tracking
8. Newsletter
8.1. The following information explains the content of our newsletter, the subscription, distribution and statistical analysis procedures, as well as your rights to object. By subscribing to our newsletter, you consent to receiving it and to the procedures described below.
8.2. Newsletter content: We send newsletters, emails and other electronic notifications containing promotional information (hereinafter referred to as “newsletters”) only with the recipients’ consent or where otherwise permitted by law. Where the content of a newsletter is specifically described as part of the subscription process, this description is decisive for the users’ consent.
8.3. Double opt-in and logging: Subscription to our newsletter uses a so-called double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your subscription. This confirmation is necessary to prevent someone from registering using another person’s email address. Newsletter subscriptions are logged in order to provide evidence that the registration process complies with legal requirements. This includes storing the date and time of registration and confirmation, as well as the IP address. Changes to the data stored with the email service provider are also logged.
8.4. Email service provider: Newsletters are sent using CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany, hereinafter referred to as the “email service provider”. The email service provider’s privacy policy can be viewed here: https://www.cleverreach.com/de/datenschutz.
8.5. According to its own information, the email service provider may also use this data in pseudonymous form, i.e. without assigning it to an individual user, to optimise or improve its own services, for example to technically optimise the delivery and presentation of newsletters or for statistical purposes, such as determining the countries from which recipients access the newsletters. However, the email service provider does not use our newsletter recipients’ data to contact them independently or to pass it on to third parties.
8.6. Registration data: To subscribe to the newsletter, it is sufficient to provide your email address and company. We optionally ask you to provide your name so that we can address you personally in the newsletter.
8.7. Statistical collection and analysis - The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from the email service provider’s server when the newsletter is opened. During this retrieval, technical information such as information about your browser and system, as well as your IP address and the time of retrieval, is initially collected. This information is used to technically improve the services based on technical data, or to analyse target groups and their reading behaviour based on where newsletters are accessed (which can be determined using the IP address) or access times.
Statistical analysis also includes determining whether newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be associated with individual newsletter recipients. However, neither we nor the email service provider seek to monitor individual users. Rather, the analyses help us understand the reading habits of our users and adapt our content accordingly, or send different content based on our users’ interests.
8.8. The use of the email service provider, the performance of statistical analyses and the logging of the subscription process are based on our legitimate interests pursuant to Article 6(1)(f) GDPR. Our interest lies in using a user-friendly and secure newsletter system that serves our business interests while also meeting users’ expectations.
8.9. Cancellation/Withdrawal - You may unsubscribe from our newsletter at any time, i.e. withdraw your consent. This also withdraws your consent to the newsletter being sent by the email service provider and to statistical analysis. It is unfortunately not possible to withdraw consent separately for the distribution of the newsletter or for statistical analysis. A link to unsubscribe from the newsletter can be found at the end of every newsletter. If users have only subscribed to the newsletter and subsequently unsubscribe, their personal data will be deleted.
9. Integration of Third-Party Services and Content
9.1. Within our Online Services, we use content or service offerings from third-party providers on the basis of our legitimate interests (i.e. our interest in analysing, optimising and operating our Online Services economically within the meaning of Article 6(1)(f) GDPR), in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”). This always requires the third-party providers of such content to be able to access users’ IP addresses, as they would otherwise be unable to send the content to users’ browsers. The IP address is therefore required for the delivery of such content. We endeavour to use only content whose providers use the IP address solely for delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to analyse information such as visitor traffic to the pages of this Website. The pseudonymous information may also be stored in cookies on users’ devices and may include technical information about the browser and operating system, referring websites, the time of the visit and other information about the use of our Online Services. Such information may also be combined with information from other sources.
9.2. The following overview provides information on third-party providers and their content, together with links to their privacy policies, which contain further information on data processing and, in some cases, objection options (so-called opt-out options):
- External fonts from Monotype GmbH, Horexstraße 30–4, 61352 Bad Homburg, Germany, www.linotype.com/de. The fonts are integrated by means of a server request to Monotype.
- The fonts are integrated in compliance with data protection requirements, as page accesses are used only for counting/billing purposes (Customer ID), and no personal data relating to visitors is stored or archived in the Monotype database.
- Videos from the “YouTube” platform operated by the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: www.google.com/policies/privacy.
All videos are integrated in compliance with the GDPR. (In this case, YouTube still establishes a connection to Google’s DoubleClick service; however, according to Google’s Privacy Policy, personal data is not analysed in this context.) YouTube therefore no longer stores information about website visitors unless they watch the video. If you click on the video, your IP address is transmitted to YouTube. If you are logged in to YouTube at the same time, this information is also associated with your user account.
10. Online Presence on Social Media
We maintain online presences within social networks and platforms in order to communicate with customers, prospective customers and users who are active there and to provide them with information about our services.
We would like to point out that users’ data may be processed outside the European Union. This may result in risks for users, as, for example, it may make it more difficult to enforce users’ rights. With regard to US providers certified under the Privacy Shield, we point out that they thereby undertake to comply with EU data protection standards.
Furthermore, users’ data is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behaviour and the resulting interests. These usage profiles may in turn be used to display advertisements within and outside the platforms that are presumed to correspond to users’ interests. For these purposes, cookies are generally stored on users’ computers, in which usage behaviour and interests are stored. Usage profiles may also contain data independently of the devices used by users, particularly where users are members of the respective platforms and are logged in to them.
The processing of users’ personal data is based on our legitimate interest in effectively informing and communicating with users pursuant to Article 6(1)(f) GDPR. If users are asked by the respective platform providers to consent to the processing described above, the legal basis for processing is Article 6(1)(a) and Article 7 GDPR.
For a detailed description of the respective processing activities and objection options (opt-out), please refer to the information provided by the respective providers linked below.
We also point out that, in the case of requests for information and the exercise of users’ rights, these can be asserted most effectively directly with the providers. Only the providers have access to users’ data and can directly take the appropriate measures and provide information. If you nevertheless require assistance, you can contact us.
- Facebook – Pages and Groups, (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland) on the basis of an agreement on joint processing of personal data – Privacy Policy: https://www.facebook.com/about/privacy/, Specifically for Pages: https://www.facebook.com/legal/terms/information_about_page_insights_data , Opt-Out: https://www.facebook.com/settings?tab=ads und http://www.youronlinechoices.com, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.
- Google/ YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland) – Privacy Policy: https://policies.google.com/privacy, Opt-Out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
- LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland) - Privacy Policy: https://www.linkedin.com/legal/privacy-policy , Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active.
11. Users’ Rights
11.1. Users have the right, upon request and free of charge, to obtain information about the personal data concerning them that we have stored.
11.2. In addition, users have the right to request the rectification of inaccurate data, restriction of processing and deletion of their personal data, where applicable, to exercise their right to data portability and, in the event of suspected unlawful processing of personal data, to lodge a complaint with the competent supervisory authority.
11.3. Users may also withdraw their consent, generally with effect for the future.
12. Deletion of Data
12.1. The data stored by us will be deleted as soon as it is no longer required for its intended purpose and provided that there are no statutory retention obligations preventing its deletion. If users’ data is not deleted because it is required for other legally permissible purposes, its processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to users’ data that must be retained for commercial or tax reasons.
12.2. In accordance with statutory requirements, data is retained for six years pursuant to Section 257(1) of the German Commercial Code (HGB) (books of account, inventories, opening balance sheets, annual financial statements, commercial letters, accounting records, etc.) and for ten years pursuant to Section 147(1) of the German Fiscal Code (AO) (books, records, management reports, accounting records, commercial and business correspondence, documents relevant for taxation, etc.).
13. Right to Object
Users may object at any time to the future processing of their personal data in accordance with the applicable statutory provisions. Objection may be made in particular to processing for the purposes of direct marketing.
14. Amendments to the Privacy Policy
14.1. We reserve the right to amend this Privacy Policy in order to adapt it to changes in the legal situation, changes to the service or changes in data processing. However, this applies only to provisions relating to data processing. Where users’ consent is required or where provisions of the Privacy Policy form part of the contractual relationship with users, amendments will only be made with users’ consent.
14.2. Users are requested to regularly review the contents of this Privacy Policy.