I. Name and Address of the Data Controller

The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other provisions of data protection law is:

HOS Anlagen und Beteiligungen GmbH & Co. KG
Schäferhauser Str. 2
73240 Wendlingen
Germany
Tel.: 07024/9460
E-Mail: info@hos-gruppe.de
Website: www.hos-gruppe.de

II. Name and Address of the Data Protection Officer

The data protection officer of the controller is:

Frank Reiner
HOS Anlagen und Beteiligungen GmbH & Co. KG
Schäferhauser Str. 2
73240 Wendlingen
Germany
Tel.: 07024/946174
E-Mail: freiner@hos-gruppe.de
Website: www.hos-gruppe.de

III. General Information on Data Processing

1. Scope of the processing of personal data

We collect and use our users’ personal data strictly only where it is necessary to provide a functional website and our content and services. Collecting and using our users’ personal data generally takes place only with the consent of the user. An exception applies in such cases where obtaining consent in advance is not possible for practical reasons and processing the data is permitted by statutory provisions.

2. Legal basis for the processing of personal data

Where we obtain the consent of the data subject for processing operations, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
In the processing of personal data that is necessary for the performance of a contract to which the data subject is party, Article 6(1)(b) GDPR forms the legal basis. This also applies to processing operations necessary prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR forms the legal basis.
In the event that processing personal data is necessary in order to protect the vital interests of the data subject or of another natural person, Article 6(1)(d) GDPR forms the legal basis.
If processing is necessary for the purposes of pursuing the legitimate interests of our company or a third party, and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) forms the legal basis for the processing.

3. Data erasure and storage duration

The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. It may be stored for longer than that where this is laid down by the European or national legislator in EU regulations, laws or other provisions to which the data controller is subject. The data will also be blocked or erased if a storage period under the aforementioned standards expires, unless further storage of the data is necessary to enter into or fulfil a contract.

IV. Provision of the website and creation of log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer
The following data will be collected:

  1. Information on the browser type and the version used
  2. The user’s operating system
  3. The user’s Internet service provider
  4. The user’s IP address
  5. Date and time of access
  6. Websites from which the user’s system accesses our website
  7. Websites accessed by the user’s system via our website

The data is also stored in the log files of our system. This does not apply to the IP addresses of the user or other data that enable the assignment of the data to a user. This data is not stored together with other personal data of the user.

2. Legal basis for the data processing

The legal basis for the temporary storage of data is Art. 6(1)(f) GDPR.

3. Purpose of the data processing

Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the IP address of the user must remain stored for the duration of the session.
These purposes also include our legitimate interest in data processing under Art. 6(1)(f) GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Where data is collected to provide the website, this is the case once the respective session is terminated.

5. Options for objecting and removal

Collecting data for the provision of the website and storing data in log files is essential for the operation of the website. Consequently, there is no option to object on the part of the user.

V. Use of cookies

a) Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the web browser or by the web browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again.
We use cookies to make our website more user-friendly. Some elements of our website require that the requesting browser be identifiable even after changing pages.
The following data is stored and transmitted in the cookies:
Language settings
The user data collected in this way is pseudonymised by technical means. Therefore, it is no longer possible to assign the data to the calling user. The data is not stored together with other personal data of the users.

b) Legal basis for the data processing

The legal basis for the data processing of personal data using cookies is Art. 6(1)(f) GDPR.

c) Purpose of the data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website will not be available without the use of cookies. For these it is necessary for the browser to be recognised even after a page change.
We require cookies for the following applications:
Applying language settings
The user data collected by technically necessary cookies is not used to create user profiles.
These purposes also include our legitimate interest in the processing of personal data under Art. 6(1)(f) GDPR.

e) Duration of storage, objection and removal option

Cookies are stored on the user’s computer and transmitted to our site by the user. Therefore, you as a user also have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing the settings in your web browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it is possible that not all features of the website can be used to the full extent.

VI. Contact form and email contact

1. Description and scope of data processing

A contact form is available on our website, which can be used for online contact. If a user uses this option, the data entered in the input screen will be transmitted to us and stored. These details are:

Surname, first name
Address
Email address
Message

At the time the message is sent, the following data will also be stored:
Your consent will be obtained for the processing of the data as part of the sending process and reference will be made to this data protection statement.
Alternatively, you can contact us using the email address provided. In this case, the personal data of the user transmitted with the email will be stored.
No data will be disclosed to third parties in this context. The data will be used exclusively for the processing of the conversation.

2. Legal basis for the data processing

The legal basis for the processing of the data is Art. 6(1)(a) GDPR if the user has given his consent.
The legal basis for processing the data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. If the purpose of the email contact is to enter into a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR.

3. Purpose of the data processing

We only use the processing of the personal data from the input screen for the processing of establishing contact. In the case of contact by email, this also constitutes the necessary legitimate interest in the processing of the data.
The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the input screen of the contact form and that sent by email, this is the case when the respective conversation with the user has ended. The conversation ends when it can be inferred from the circumstances that the matter in question has been conclusively resolved.
The additional personal data collected during the sending process will be deleted after no later than a period of seven days.

5. Options for objecting and removal

The user has the option to revoke his consent to the processing of personal data at any time. If the user contacts us by email, he can object to the storage of his personal data at any time.
In such a case, the conversation cannot be continued.
In this case, all personal data stored in the course of establishing contact will be erased.

VII. Rights of the Data Subject

If your personal data is processed, you are the data subject within the meaning of the GDPR and the data controller must grant you to the following rights:

1. Right to information

You can require confirmation from the data controller whether personal data relating to you is being processed by us.

If such processing is present, you can require the data controller to provide you with information on the following matters:

  1. the purposes for which the personal data is processed;
  2. the categories of personal data processed;
  3. the recipients or categories of recipients to whom the personal information about you has been or will be disclosed;
  4. the planned storage period of the personal data relating to you or, if no specific details on this are possible, criteria for the determination of the storage period;
  5. the existence of a right to rectification or erasure of the personal data relating to you, a right to restriction to the processing by the data controller or a right to object to the processing;
  6. the existence of a right of appeal to a supervisory authority;
  7. all available information on the origin of the data, if the personal data is not collected from the data subject;
  8. the existence of automated individual decision making including profiling in accordance with Article 22(1) and (4) GDPR and, at least in these cases, meaningful information on the logic involved as well as the scope of the desired effects of such processing for the data subject.

You have the right to require information about whether the personal data relating to you is transferred to a third country or to an international organisation. In this connection you can require that you are informed about the appropriate safeguards under Article 46 GDPR in connection with the transfer..

2. Right to rectification

You have the right to rectification and/or completion by the data controller if the processed personal data relating to you is incorrect or incomplete. The data controller must carry out the rectification without delay.

3. Right to restriction of processing

Under the following conditions you can require the restriction of the processing of the personal data relating to you:

  1. if you contest the accuracy of the personal data relating to you for a period enabling the data controller to check the accuracy of the personal data;
  2. the processing is unlawful and you object to the erasure of the personal data and instead require the restriction of the use of the personal data;
  3. the data controller no longer needs the personal data for the purposes of processing but you need it for the establishment, exercise or defence of legal claims or
  4. if you have objected to processing in accordance with Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.

If the processing of the personal data relating to you has been restricted, this data may, apart from storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a member state.

If the restriction of processing under the above conditions has been restricted, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a) Erasure obligation
You can require from the data controller that the personal data relating to you is erased without delay and the controller is required to erase this data without delay if one of the following reasons applies:

  1. The personal data relating to you is no longer necessary for the purposes for which it was collected or processed in any other way.
You withdraw your consent on which the processing under Article 6(1)(a) or Article 9(2)(a) GDPR is based and there is no other legal basis for processing.
  2. Under Article 21(1) GDPR you object to the processing and there are no overriding legitimate grounds for the processing or you object to the processing under Article 21(2) GDPR.
  3. The personal data relating to you has been processed unlawfully.
  4. The erasure of the personal data relating to you is necessary for fulfilling a statutory obligation under Union law or the law of the member states to which the data controller is subject.
  5. The personal data relating to you has been collected relating to the offer of information society services under Article 8(1) GDPR.

b) Information to third parties
Where the data controller has made the personal data relating to you public and is required to erase it under Article 17(1) GDPR, the controller must, taking into account the available technology and the implementation costs, take reasonable steps including technical measures, to inform controllers that are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, this personal data.

c) Exceptions
There is no right to erasure where the processing is necessary

  1. for exercising the right to freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  2. on public interest grounds in the area of public health under Article 9(2)(h) and (i) as well as Article 9(3) GDPR;
  3. for archive purposes in the public interest, scientific or historical research purposes or for statistical purposes under Article 89(1) GDPR where the right under a) is likely to make impossible or seriously impair the achievement of the aims of this processing or for the establishment, exercise or defence of legal claims.

5. Right to information

If you have asserted the right to correction, erasure or restriction of the processing by the data controller, the latter is required to inform all recipients to which the personal data relating to you has been disclosed of this rectification or erasure of the data or restriction of processing, unless it proves impossible or associated with disproportionate expense.

You have the right to be notified by the data controller about these recipients.

6. Right to data portability

You have the right to receive the personal data relating to you, which you have provided to the data controller, in a structured, commonly used and machine-readable format. In addition you have the right to send this data to another data controller without hindrance from the controller to which the personal data has been provided if

  1. the processing is based on consent under Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract under Article 6(1)(b) GDPR and
  2. processing is carried out using automated procedures.

Furthermore, in the exercise of this right, you have the right to have the personal data relating to you transmitted directly from one data controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task that is in the public interest or carried out in the exercise of official authority vested in the data controller.

7. Right to object

You have the right on grounds relating to your particular situation to object at any time to the processing of the personal data relating to you carried out on the basis of Article 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.

The controller may no longer process the personal data relating to you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data relating to you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, the personal data must no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to withdraw the data protection declaration of consent

You have the right to withdraw your consent to the processing of your data at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

  1. is necessary for entering into, or performance of, a contract between you and the data controller,
  2. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests or
  3. is based on your explicit consent

However these decisions must not be based on special categories of personal data referred to in Article 9(1) GDPR, unless (a) or (g) of Article 9(2) GDPR applies and suitable measures to safeguard your rights and freedoms, and legitimate interests are in place.

In the cases referred to in (1) and (3), the data controller must implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged must inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy under Article 78 GDPR.