2.1 PROCESSING OF PERSONAL DATA WHEN VISITING OUR WEBSITES OR CONTACTING US BY E-MAIL; PURPOSE AND LEGAL BASIS
2.1.1 Informational use of our websites
When you use our websites for information purposes only – i.e. if you do not register or otherwise provide us with information – we collect only the personal data that your browser transmits to our server. When you view our websites, we collect the following data:
IP address,
Date and time of the request,
Time zone difference from Greenwich Mean Time (GMT),
Content of the request (specific page),
Access status/HTTP status code,
amount of data transferred in each case,
Website from which the request originates,
Browser,
operating system and its interface,
language and version of the browser software.
Purpose and legal basis
The purpose of processing this data is to display our websites to you and to ensure stability and security. The legal basis is Article 6(1)(f) of the GDPR. According to this, the processing of personal data is lawful for the purposes of our legitimate interests, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests. This personal data is stored only for the duration of your visit to our websites.
2.1.2 Contacting us by email or using the contact form on our websites
When you contact us by email or via a contact form, the data you provide (your email address, and where applicable your name and telephone number) will be stored by us for the purpose of answering your enquiries. We will delete the data collected in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply. The legal basis for these processing operations is Article 6( (1) sentence 1(f) of the GDPR, unless there are statutory retention obligations, in which case the legal basis for storage is Article 6(1) sentence 1(c) of the GDPR; according to this, processing is lawful where it is necessary for compliance with a legal obligation.
2.1.3 Cookies
a) In addition to the data mentioned above, cookies are stored on your computer when you use our websites. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, and through which certain information is transmitted to the party setting the cookie (in this case: us). Cookies cannot execute programs or transmit viruses to your computer. Their purpose is to make the website more user-friendly and effective overall. The legal basis for this is your consent – which may be withdrawn at any time – in accordance with Article 6(1)(a) of the GDPR, which you give at the start of your visit to our website, or Article 6(1)(f) of the GDPR.
b) These web pages use the following types of cookies, the scope and functioning of which are explained below:
Transient cookies (see aa)
Persistent cookies (see bb).
aa) Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These store a so-called session ID, which allows various requests from your browser to be assigned to the same session. This enables your computer to be recognised when you return to our websites. Session cookies are deleted when you log out or close your browser.
bb) Persistent cookies are automatically deleted after a period specified by us, which may vary depending on the cookie. You can delete the cookies at any time via your browser’s security settings. By deleting them, you simultaneously withdraw your consent to the processing of the respective cookie.
c) You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. Please note that you may then not be able to use all the features of our websites.
2.1.4. Google Analytics
a) These websites use Google Analytics, a web analytics service provided by Google Inc. (“Google”). Based on your consent in the cookie consent dialogue, Google Analytics uses “statistical cookies” (see section 2.3 above). These are small text files stored on your computer that enable an analysis of your use of the websites. The information generated by the cookie regarding your use of these websites is usually transmitted to a Google server in the USA and stored there. However, your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area by default. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage to the website operator.
b) The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
c) You can prevent the storage of cookies either by rejecting the “statistics cookies” in the cookie consent dialogue or by adjusting your browser settings accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and relating to your use of the websites (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de .
d) We use Google Analytics to analyse and regularly improve the use of our websites. The statistics obtained enable us to improve our offering and make it more interesting for you as a user. In the exceptional cases where personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework (DPF) and the Standard Contractual Clauses of the European Commission (https://policies.google.com/privacy/frameworks?hl=de ). Through these regulations, Google Inc. contractually undertakes to comply with the data protection standards of the EU General Data Protection Regulation. The legal basis for the use of Google Analytics is your consent in the cookie consent dialogue (see section 2.3 above) in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR.
e) Information from the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: http://www.google.com/analytics/terms/de.html, privacy overview: http://www.google.com/intl/de/analytics/learn/privacy.html, and the privacy policy: https://www.google.de/intl/de/policies/privacy .
2.1.5 Google Tag Manager
These websites use ‘Google Tag Manager’. Google Tag Manager is a tool for managing website tags. The tool is a cookie-free domain and does not collect any personal data. The tool triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in effect for all tracking tags implemented with Google Tag Manager (https://www.google.de/intl/de/policies/privacy ).
2.1.6 Google Ads
We use the services of Google Ads for internet-based advertising; the service is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
The purpose of Google Ads is to promote our websites by displaying interest-based advertising on third-party websites and in Google search results. If a data subject accesses our websites via a Google ad, Google places a so-called conversion cookie on the data subject’s IT system. A conversion cookie expires after 30 days and is not used to identify the data subject. The data and information collected through the use of the conversion cookie is used by Google to compile visitor statistics for our websites. We use these visitor statistics to evaluate the success of Google Ads. Neither our company nor other Google Ads advertisers receive information from Google that could be used to identify the data subject.
The conversion cookie is used to store personal information, such as the web pages visited by the data subject. The information generated by the cookie is transmitted to Google in the United States of America and stored there.
You can prevent the setting of cookies by adjusting the settings of the web browser you are using, thereby permanently objecting to the setting of cookies. Such a setting in the web browser would also prevent Google from setting a conversion cookie. Furthermore, a cookie already set by Google Ads can be deleted at any time via the web browser or other software programmes.
Furthermore, the data subject has the option to object to interest-based advertising by Google. To do so, the data subject must access the link www.google.de/settings/ads from each of the web browsers they use and make the desired settings there.
Further information and Google’s applicable privacy policy can be found at https://www.google.de/intl/de/policies/privacy/ .
2.1.7 Embedding of YouTube videos
a) We have embedded YouTube videos in our online offering which are stored at www.YouTube.com and can be played directly from our websites.
b) When you visit our websites, YouTube receives the information that you have accessed the relevant subpage of our websites. In addition, the data mentioned in section 2.1.1 of this policy is transmitted. This occurs regardless of whether you are logged in via a YouTube user account or do not have a user account. If you are logged in to Google, your data will be directly associated with your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the customisation of its websites. Such analysis is carried out in particular (even for users who are not logged in) to provide tailored advertising and to inform other users of the social network about your activities on our websites. You have the right to object to the creation of these user profiles, in which case you must contact YouTube to exercise this right.
c) Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and settings options for protecting your privacy: www.google.de/intl/de/policies/privacy . Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework .
2.1.8 Contact enquiries and newsletters
a) If you wish to use certain features of our websites, such as our contact forms, you must provide the personal data requested there, for example:
b) Newsletter
When contacting us as described in point a), you have the option to subscribe to our newsletter, which contains up-to-date information about our company and our range of services. Subscribing to our newsletter is voluntary. You may contact us to request further information without subscribing to the newsletter. Once you have registered for the newsletter, we carry out the so-called “double opt-in procedure”, as described above under point b). If you have registered for the newsletter, you also confirm your consent to receive the newsletter through the double opt-in procedure. For the newsletter, we process only your email address, your name and the name of the company you work for (if provided), so that we can send you the newsletter and address you personally. The legal basis for this processing of your personal data is Article 6(1)(a) of the GDPR. You may withdraw your consent to receive the newsletter at any time and unsubscribe from it. You can withdraw your consent via the “Unsubscribe” link in our newsletter, by emailing info@tox-de.com , or by sending a message to the contact details provided in the legal notice.
2.1.9 Analysis using Salesforce Marketing Cloud Account Engagement
We use the analytics tool Salesforce Marketing Cloud Account Engagement (formerly Pardot) on our website, provided by Salesforce Inc., Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States. The tool records website visitors’ use of our website and analyses this data. If you have given your consent to cookies within the meaning of Article 6(1)(a) of the GDPR when visiting our website, the tool uses cookies set in your browser to record your click path and creates an individual pseudonymous user profile from this data. Please note that if you enter personal data into an input field on our website, this data will be merged with the usage profile created by the tool. The tool then performs a comparison with our CRM system, Salesforce, and, if a data record exists, adds the user profile to the customer record, or creates a new data record for prospective customers. The tool processes any personal data collected exclusively on our behalf and in accordance with our instructions within the framework of a data processing agreement (‘Data Processing Addendum’),‘Salesforce’s EU Processor Binding Corporate Rules’ and the Data Privacy Framework between the EU and the USA (‘Salesforce’s Notice of Data Privacy Framework Certification’ ); These contractual texts, including their assurances regarding compliance with the data protection standards of the GDPR, are available on the Salesforce website at https://www.salesforce.com/company/legal/privacy/ .
You may withdraw your consent at any time with future effect. To do so, please contact the controller referred to in section 1.2. Furthermore, you may disable the creation of pseudonymised user profiles at any time by configuring your internet browser so that cookies from the domain“pardot.com” are not accepted. However, this may lead to certain restrictions on the functionality and user-friendliness of our service.
2.1.10 Newsletter distribution and performance measurement using Salesforce Marketing Cloud Account Engagement
The Salesforce Marketing Cloud Account Engagement tool (formerly Pardot) (see section 2.9 above) is also used for sending and measuring the success of our newsletter. The legal basis is Article 6(1)(a) of the GDPR. We use the so-called “double opt-in” procedure in accordance with section 2.8(b) (above) for newsletter subscriptions. Please note that we analyse your user behaviour when sending the newsletter. We use the Salesforce Marketing Cloud Account Engagement tool (formerly Pardot) for this purpose. The analysis is carried out via so-called “web beacons” in the newsletter emails sent. Web beacons are small graphics in the email that enable log file recording and log file analysis when the email is opened. In doing so, the tool links the data relating to your subscription to the email newsletter with the information from the “web beacons”, your email address and a unique ID for the purposes of analysis. The analyses serve to identify our users’ reading habits and to send content tailored to their interests. You may withdraw your consent to receive the newsletter at any time. You can do so by clicking on the link provided in every newsletter email, or by contacting the controller named in section 1.2. The data you provide will not be passed on to third parties other than Salesforce Inc. (see section 2.9 above).
2.1.11 Microsoft Clarity
We use the web analytics service Microsoft Clarity on our website, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 6399, USA.
Microsoft Clarity enables us to analyse user behaviour on our website and thus improve the user-friendliness and functionality of our online offering. To this end, pseudonymised usage information is processed, in particular mouse movements, clicks, scrolling behaviour and technical information regarding the device, operating system and browser.
Entries in form fields are automatically masked by Microsoft Clarity, so that content such as names, email addresses or telephone numbers is not recorded.
Microsoft Clarity is integrated via Google Tag Manager, which is used exclusively for the technical deployment of tracking scripts and does not itself pursue any analytical purposes.
Data processing takes place exclusively on the basis of your voluntary consent in accordance with Article 6(1)(a) of the GDPR via our consent management tool. Microsoft Clarity will not be loaded without your consent.
Consent once given may be withdrawn at any time with effect for the future.
It cannot be ruled out that personal data may be transferred to servers of Microsoft Corporation in the USA. Microsoft is certified under the EU-US Data Privacy Framework. Nevertheless, a residual risk cannot be completely ruled out in the case of data transfers to third countries.
Further information on data protection at Microsoft Clarity can be found at: https://clarity.microsoft.com/privacy
2.1.12 Use of Call-Tracking Technologies
We use call-tracking technologies on some of our websites to analyze the source of incoming phone calls and optimize our marketing efforts. This technology is currently used exclusively on our U.S. website.
For call tracking, we use the CallRail service provided by CallRail, Inc., 100 Peachtree St NW, Suite 2600, Atlanta, GA 30303, USA.
Data is processed for marketing attribution, campaign analysis and optimization, as well as for measuring conversions and attributing phone calls to marketing sources.
When using CallRail, the following personal data, in particular, may be processed:
The caller’s phone number
The caller’s name (if available via caller ID)
The date, time, and duration of the call
Marketing and referral data (e.g., campaign, keyword, referrer)
Call recordings and transcripts, if applicable (provided this feature is enabled)
CallRail uses various cookies and similar technologies that may remain active for up to one year. These are used primarily to recognize users, track sessions, and correctly attribute calls to marketing sources.
Data processing is based on Article 6(1)(f) of the GDPR (legitimate interest), and our legitimate interest lies in analyzing and optimizing our marketing activities and measuring the success of our campaigns.
The data collected by CallRail is processed on servers in the United States. This is a third country outside the European Union. The transfer is based on appropriate safeguards in accordance with Art. 44 et seq. of the GDPR, in particular through the conclusion of a data processing agreement (Data Processing Addendum). CallRail is not currently listed as a certified participant in the EU-U.S. Data Privacy Framework.
The retention period for the data depends on the settings and the plan you have subscribed to. Communication data is generally stored for up to 25 months and then automatically deleted, unless it is manually deleted beforehand.
The recipient of the data is CallRail, Inc. Data is only shared with other third parties if the corresponding integrations (e.g., with advertising or CRM systems) are enabled.
Data subjects have the rights provided by law to access, rectify, erase, restrict the processing of, and object to the processing of their personal data. Requests to exercise these rights may be submitted to us as the data controller; CallRail cannot process such requests directly.
2.1.13 Our social media presence
a) We maintain a presence for our company on the following social networks for the following purposes:
aa) LinkedIn
Provider:
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (https://de.linkedin.com/legal/impressum?src=direct%2Fnone&veh=direct%2Fnone&trk=homepage-basic_footer-about ).
Purpose:
LinkedIn is used to connect with existing and potential customers, provide information about products and services, and present the company as an attractive employer.
bb) Instagram
Provider:
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (https://help.instagram.com/581066165581870/ )
Purpose:
Instagram is used for employer branding to present the company as an attractive employer and attract potential applicants. It is also used for marketing to increase brand awareness and interact with the target audience through visual content. Furthermore, Instagram is used to strengthen the brand image and establish a personal connection with followers.
cc) YouTube
Provider:
Google Ireland Limited (Registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (https://www.youtube.com/t/terms )
Purpose:
YouTube is used for product demonstrations to showcase products and how they work. Tutorials help customers use our products. The platform also serves as a brand showcase to present the company and its values. Furthermore, YouTube is used for employer branding to present the company as an attractive employer and attract potential applicants.
dd) Xing
Provider
New Work SE, Am Strandkai 1, 20457 Hamburg, Germany (https://www.xing.com/legalnotice?nwt_nav=footer )
Purpose:
XING is used for customer communication to connect with existing and potential customers and to provide information about products and services. XING is also used for employer branding to present the company as an attractive employer and to attract potential applicants.
ee) kununu
Provider:
kununu GmbH, Arabellastraße 23, 81925 Munich, Germany
Purpose:
kununu is used for employer branding to present the company as an attractive employer and attract potential applicants. Furthermore, kununu serves as a review platform where users can rate the company.
b) Your visit to these sites triggers a variety of data processing operations. You are not obliged to provide us with your personal data. However, this may be necessary for certain features of our social media profiles. These features will not be available to you, or will only be available to a limited extent, if you do not provide us with your personal data.
Specifically, we process the following personal data:
all data visible to us on your profile on the respective social media platform, e.g. name, age, address, photos, email addresses, and possibly also IP addresses
all information that you provide to us as part of communication on social media platforms
device information (including for unregistered users), for example computer, operating system, device ID, activity on the device,
IP address,
cookies.
We process your data for the purposes set out in point (a) and for the duration necessary to fulfil that purpose. The legal basis for this is Article 6(1)(f) of the GDPR.
c) In addition, the providers of the social media platforms provide us with anonymous usage statistics, which we use to improve the user experience when visiting our social media pages. We do not have access to the usage data that the providers of the social media platforms collect to compile these statistics. The providers of the social media platforms have undertaken to us to assume primary responsibility under the GDPR for the processing of this data, to fulfil all obligations under the GDPR with regard to this data, and to make the essential details of this undertaking available to the data subjects. This data processing serves our (and your) legitimate interest in improving the user experience when visiting our fan page in a manner tailored to the target group. The legal basis for this data processing is therefore Article 6(1)(f) of the GDPR.
In addition, the providers of social media platforms use so-called cookies, which are stored on your device when you visit our social media pages, even if you do not have your own profile on the respective platform or are not logged into it whilst visiting our social media page. These cookies allow the providers of the social media platforms to create user profiles based on your preferences and interests and to display tailored advertising to you (both within and outside the respective social media platform). Cookies remain on your device until you delete them. Further details can be found in the privacy policies of the respective social media platform providers (see point e) below).
c) If you use our social media presence to contact us (e.g. by creating your own posts, reacting to one of our posts or sending us private messages), the data you provide to us will be processed by us solely for the purpose of contacting you. The legal basis for data collection is therefore Article 6(1)(a) and (b) of the GDPR. We will delete stored data as soon as its storage is no longer necessary or you request its deletion; in the event of statutory retention obligations, we will restrict the processing of the stored data accordingly.
d) When you visit our social media pages, your personal data is collected, used and stored not only by us but also by the respective providers (see point (a) above). This occurs even if you do not have a profile on the respective social network yourself. The specific data processing operations and their scope vary depending on the operator of the respective social network and are not necessarily transparent to us. For details regarding the collection and storage of your personal data, as well as the nature, scope and purpose of its use by the operator of the respective social network, please refer to the privacy policies of the respective provider:
aa) for LinkedIn:
https://de.linkedin.com/legal/privacy-policy?trk=d_checkpoint_lg_consumer_login_ft_privacy_policy
bb) for Instagram:
https://help.instagram.com/155833707900388
cc) for YouTube:
https://policies.google.com/privacy?hl=de
dd) for Xing: https://privacy.xing.com/de/datenschutzerklaerung?nwt_nav=footer
ee) for kununu
https://www.kununu.com/de/info/datenschutz
The controller within the meaning of Article 4(7) of the GDPR for the processing of your data in accordance with this point (d) is the respective provider of the relevant social media platform, as set out in point (a). The contact details of the respective data protection officers are set out in the privacy policies of the relevant social media providers in accordance with points (aa) to (ee), as are your rights vis-à-vis these providers.
2.2 PROCESSING OF PERSONAL DATA OF CUSTOMERS, SUPPLIERS, VISITORS AND OTHER COMMUNICATION PARTNERS
2.2.1 We process the following data from the contact persons at our customers, suppliers (or prospective suppliers), visitors to our business premises and grounds, and other communication partners (hereinafter also referred to as “data subjects”):
Title, first name and surname, as well as position (where applicable within the data subject’s company or at a public authority),
business or work-related contact details, comprising address, telephone number (landline/mobile) and email address,
all information required to handle the relevant communication, in particular project or contract data (especially for customers and suppliers), emails, appointments and meeting minutes,
for customer contacts: most recent contact,
for visitors: date of visit, arrival and departure from the premises, the visitor’s contact person within our company, registration number of the vehicle parked by the visitor on our premises.
2.2.2 We process the data referred to in section 2.2.1 for the following purposes and on the following legal bases:
for customer and supplier contacts: to ensure reliable communication when fulfilling our contracts with our customers and suppliers and (in the case of customers) to draw attention to our company’s services (advertising),
for visitors: to facilitate the visit and to exercise our right of access in the interests of our company’s security,
for all other communication partners: to handle the communication requested by the data subject in each case.
The legal basis in all cases is Article 6(1)(f) of the GDPR. Unless there is an ongoing contractual or other legal relationship with the company or the data subject’s authority, their personal data will only be processed or stored for the purpose of carrying out the specific task in question.
2.2.3 Furthermore, we also process the personal data of our customers or their contact persons (surname, first name, company and, in some cases, date of birth) in order to fulfil our public law obligations towards authorities, for example for tax and commercial law documentation as well as for export control. The legal basis for this is Article 6(1), first sentence, point (c) of the GDPR.
2.3 APPLICANT DATA
2.3.1 We process the following data from individuals who apply for employment with us via the application form on our websites or by other means:
First name, surname, email address, postal address, telephone number (if provided) and the application data submitted to us.
2.3.2 Subject to separately declared consent, we process the data solely for the purpose of conducting the recruitment process underlying the respective application; without consent, the data will not be stored after the end of the recruitment process and the relevant retention periods.