Privacy Policy - Oskar Frech GmbH + Co. KG

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Oskar Frech GmbH + Co. KG Schorndorf Str. 32
73614 Schorndorf
Email: info@frech.com

Data protection officer

Oskar Frech GmbH + Co. KG Company data protection officer 73614 Schorndorf
Germany

Email: datenschutz@frech.com

February 2023

We are pleased about your visit to the Oskar Frech GmbH + Co. KG website and your interest in our company and our products. In respect of data protection law, Oskar Frech GmbH + Co. KG (Oskar Frech) is the data controller responsible for processing your data when using this website. The protection of your privacy during your visit to our website is of utmost importance to us. We have therefore created a Privacy Policy in which we explain the handling of your personal data. We reserve the right to adjust the content of this Privacy Policy from time to time. It is therefore recommended that you re-read the Privacy Policy at regular intervals.

For what purposes do we process your personal data? What is the legal basis for this pro- cessing when using our website?

We process personal data for set purposes which we will explain in detail below for your information. To what extent and in what manner your data is specifically processed depends in particular on which services, functions and offers you use on our website. In particular, we process data to ensure...

You can view and visit our website and we can protect our website and other systems from security risks;
Customers can enrol on our seminars online;
You can apply to us online;
You can contact us (via contact form/email enquiries); and
We can optimise our website content as well as configure it to be user-friendly and in line with demand.

Further processing of your personal data beyond that which is stated in this Privacy Policy only occurs in cases in which a legal provision entitles or obligates us to do so, or you have explicitly consented to data processing. We will inform you about any changes in purpose, in due consider- ation of legal requirements.

(1) Viewing and visiting our website

You can visit our website purely for informational purposes without sharing data about yourself personally. In this case, only the technical access data transmitted by your browser regarding your visit to our website is automatically stored i.e. the name of your Internet service provider, the page from which you visit us, date and time of your visit and the identification data of the browser/operating system used. In doing so, the web server will also need to also store your IP address, which may enable an assignment to you personally under additional circumstances if applicable. Additionally, we use cookies to optimise our website for you even for purely informational use and to be able to provide what is needed (for related details and your respective configuration options, see the “Use of cookies and associated functions/technologies” section). The access data is not merged with other data sources.

The storage of the aforementioned access data on our web server takes place in the context of so- called server log files and is required for technical reasons to provide a functional website and protect system security. Beyond the aforementioned purposes, we use access data exclusively for needs-based configuration and optimisation of our Internet service on a purely statistical basis and without inference to you personally. The web analysis software “Webalizer”, for example, is used to create, based on the access data, web statistics on the use of our website that show anonymised access data.

Insofar as you visit our website to obtain information about or use our product offers and other services, the temporary storing of access data and log files takes place on the basis of Art. 6 para. 1 lit. b GDPR (legal basis), in particular in order to execute the user contract. In addition, Art. 6 para. 1 lit. f GDPR currently serves as a legal basis for the temporary storing of access data and log files. Our legitimate interest consists of being able to provide you with a technically functioning and user-friendly designed website, as well as to ensure the security of our systems.

The access data collected as part of using our website is only retained for the time period that the data is necessary to achieve the aforementioned purposes.

Your IP address is stored in an anonymised form. In the case of IPv4 addresses, the last block is changed to “.0”. In the case of IPv6 addresses, only the first two blocks are stored, whereas the last six blocks are changed to “::”.

(2) Contact form/requests

Personal data is collected and stored by us when you enter it into the contact form provided on our website and submit it to us or if you contact us in other ways (e.g. via email). You also have the possibility of sending us email enquiries in relation to our products or services. It is essentially your choice as to whether and what information you share with us in contact requests. If you contact us via email, we store the data that you have shared. By using the contact form on our website, we collect the following data: Company, first name and surname, email address and your individual message/enquiry. Aside from that, you have the option to voluntarily provide further personal data like your telephone number or your address for a call back or other type of contact. By using the contact form on our website, the following technical access data is stored in addition upon submission: Date and time of submitting your request as well as your IP address. We use the personal data shared with us due to use of the contact form or an email request exclusively for processing the respective message or request. For this purpose, this data is transmitted to the Oskar Frech company appropriate to you, if applicable.

Insofar as you contact us within the scope of an existing contractual relationship or contact us beforehand for information about our range of products or our other services, the data communicated by you and information for the purpose of processing and answering your request is pro- cessed in accordance with Art. 6 para. 1 lit. b GDPR (legal basis). The storing of technical access data collected during the sending procedure takes place for the technical purpose of providing the option of the form of contact (Art. 6 para. 1 lit. b GDPR (legal basis)) and to safeguard our legitimate interests in maintaining system security (Art. 6 para. 1 lit. f GDPR (legal basis)).

We save the personal data collected in connection with your request for the purpose and duration of processing your enquiry. This data is erased after the final resolution of your request. The technical access data stored in this context is only retained for the time period in which this data is required for technical reasons, in particular for the functional provision of options of forms of con- tact, as well as to ensure system security.

(3) Online application

You have the option of obtaining information about us as an employer and about current vacancies on our website. In addition, you can apply to us directly online via our website for open positions, training and internship places. In order to process your online application, we collect and use the personal data shared by you in this context (e.g. name, address, email address, education, details of your subject-specific qualification etc.). However, we only use your data and documents as far as this is required for deciding whether to establish an employment or training relationship in con- nection with your specific application, in particular to contact you about your job application. Insofar as your application refers to a position at another company of the Frech Group, we will forward your application and the data shared by you for further processing there, where appropriate. Apart from that, disclosure to third parties only takes place if you have given us your express consent or there is an official court order. We will of course handle your data and documents with absolute confidentiality and they will only be retained for as long as this is required for reviewing and pro- cessing your application. After the conclusion of the application process, your data and documents are erased within the legal time limit. If you apply to us, the data and information shared by you is processed for the purpose of conducting the application process in accordance with Section 26 para. 1 of the German Federal Data Protection Act (BDSG) in conjunction with Art. 88 GDPR and in accordance with Art. 6 para. 1 lit. b GDPR (legal basis). The storing of technical access data gathered during the sending procedure takes place for the technical purpose of providing the option to apply online (Art. 6 para. 1 lit. b GDPR (legal basis)) and to safeguard our legitimate interests in maintaining system security (Art. 6 para. 1 lit. f GDPR (legal basis)).

(4) Online seminar enrolment

We provide our customers with a variety of possibilities for further training through our seminar programme. You can enrol yourself and/or your employees directly on the seminars, courses and workshops offered by us through our website. We collect and use the personal data communicated on the form provided (e.g. name, address, telephone number, email address of the seminar participant) to process your seminar enrolment. If you enrol one of your employees on our seminars, you are responsible for the legal admissibility of this registration. When you enrol on a seminar, the data and information that you share is processed for the purpose of preparing and conducting the seminar in accordance with Art. 6 para. 1 lit. b GDPR (legal basis). The storing of technical access data collected during the sending procedure takes place for the technical purpose of providing the option of online enrolment (Art. 6 para. 1 lit. b GDPR (legal basis)) and to safeguard our legitimate interests in maintaining system security (Art. 6 para. 1 lit. f GDPR (legal basis)).

We store personal data collected in connection with your enrolment for the purpose of processing your enrolment and conducting the seminar. After final completion, this data is erased. The technical access data stored in this context is only retained for the time period in which this data is required for technical reasons, in particular for the functional provision of options for enrolment as well as to ensure system security.

(5) Use of cookies and associated functions/technologies

In order to make our website attractive to visit and in order to enable the use of particular functions, we use “cookies” in some sections. Cookies are files that are stored on your hard drive or in the cache of your Internet browser when you visit our website. When we use the term “cookie” below, it may also include other technologies, such as web beacons, local storage objects and other, comparable storage or access technologies.

We use cookies to store session-relevant information within the website. These cookies expire at the end of the session / browser session (so-called transient cookies) and are not stored for the long-term. Other cookies remain on your device beyond the respective session / browser session and enable us to recognise your device on your next visit (so-called persistent / permanent cookies). Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the type of cookie.

In particular, cookies can be classified into the following categories / cookie types:

Essential cookies	Cookies necessary to the performance of specific website functions
Video-service cookies	Cookies that serve to enable playback of videos
Analysis/Marketing cookies	Cookies performing analyses of data regarding location, interests of visitors and the like, in order to obtain information about website visitors and content that is requested and, if necessary, use such information across websites.

Of course, you can visit our website without using cookies. There is an option to deactivate the use of cookies on your computer by changing the browser settings for cookies. This would include all cookies. You can usually find the procedure for deactivating cookies in the “Help” function of your Internet browser. Please note however that these settings may potentially impair the full availability and functioning of our website.

We use a consent manager on our website. A consent manager is a plug-in that can be used to obtain consent for the use of cookies and/or comparable technologies. Via the consent manager, you can, at any time, change the settings you have selected and revoke your consent to the use of non-essential cookies and technologies, as well as to the further processing of the personal data collected via those non-essential cookies and technologies, at any time with effect for the future. The consent manager can be opened via the following link, or via the “Cookie Settings” button in the footer of each subpage of our website:

Change Cookie Settings / Revoke Consent Cookie-Settings

Some of the cookies we use on our website come from third parties that help us analyse the impact of our website content and our visitors’ interests, measure the performance of our website, place customised ads and other content on our website or other websites, or communicate with you. As part of our website, we use both first-party cookies (only visible from the domain you are visiting) and third-party cookies (visible across domains and regularly set by third parties). In detail:

↓ Website information

Cookie type	Cookie name	Description / comments	Validity
Essential cookies	csrf_https- con- tao_csrf_to- ken	This cookie is used to protect against cross-site request forgery attacks.	Session
Essential cookies	user_ privacy_ settings	This cookie stores whether a user has consented to the use of cookies.	30 days
Essential cookies	PHPSESSID	This cookie assigns an ID (session ID) to your browser for the duration of your visit to be able to bundle together several related requests to the server and as- sign them to a session.	Session
Video- service cookies	CONSENT	This cookie is set and used by YouTube to determine whether the visitor has accepted the marketing category in the cookie banner.	1 year
Video-service cookies	YSC	With this cookie, YouTube registers a unique ID to keep statistics of the YouTube videos watched by the user.	Session
Analysis/ Marketing cookies	CONSENT	This cookie is set and used by Google to determine whether the visitor has accepted the marketing category in the cookie banner.	1 year
Analysis/ Marketing cookies	SOCS	This cookie is set and used by Google to store the user’s cookie selection.	1 year
Analysis/ Marketing cookies	DV	Set by Google, this cookie is used to store the user’s preferences and other in- formation about the user. This includes, in particular, the preferred language, the number of search results to be displayed on the page and the decision whether or not to activate Google’s SafeSearch filter.	7 minutes
Analysis/ Marketing cookies	_ga	This cookie is set by the third-party provider Google for the Google Analytics service. It contains a randomly generated user ID. Based on this ID, Google Analytics can recognise users returning to this website and merge the data from previous visits.	2 years
Analysis/ Marketing cookies	gid	This cookie is set by the third-party provider Google for the Google Analytics service. It contains a randomly generated user ID. Based on this ID, Google Analytics can recognise users returning to this website and merge the data from previous visits.	24 hours

The storage of information on your device (e.g. PC, smartphone) and, if applicable, access to in- formation stored on your device take place on the basis of § 25 of the German Telecommunications Telemedia Data Protection Act (TTDSG). Insofar as the processing of the information is absolutely necessary to enable the use of our website as expressly requested by you, such storage and/or access takes place on the basis of § 25 para. 2 no. 2 of the German Telecommunications Tele- media Data Protection Act (TTDSG). Any storage of information on your device beyond this scope will take place on the basis of your consent, in accordance with § 25 para. 1 of the German Tele- communications Telemedia Data Protection Act (TTDSG). The legal bases of the General Data Protection Regulation (GDPR) mentioned in this Privacy Policy apply to the further processing of the personal data thereby obtained.

The further processing of the personal data obtained via cookies is carried out on the basis of Art. 6 para. 1 lit. c GDPR (legal basis), for compliance by us with our legal obligations, in particular to provide you with a simple and documented option for granting or not granting your cookie consent. In addition, further data processing is carried out on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR (legal basis). Another possible legal basis for further processing is Art. 6 para. 1 lit. f GDPR, i.e. the safeguarding of our legitimate interests. Our legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR consist in particular of being able to provide you with a technically optimised and user-friendly website designed in line with demand and of safeguarding the security of our systems.

(6) YouTube

We use plug-ins from the YouTube video platform to integrate videos and be able to play them directly on this website. The operator of the video platform is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”). YouTube is a company affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

The integration of YouTube videos takes place in the “extended data protection mode”, which, according to the provider, only triggers the storage of user information when a video is played. However, the transfer of data to YouTube partners is not necessarily excluded by the extended data protection mode. When you activate embedded videos on our website, a connection to YouTube’s servers is established and data starts to be transferred. We have no influence on the scope and content of the data which, by activating the plug-in, is transferred to YouTube and, if applicable, further partners of YouTube. The YouTube server is informed about which of our pages you have visited, among other things. According to YouTube, this information is used to, among other things, collect video statistics, improve user-friendliness and prevent abusive behaviour. To this end, YouTube uses cookies to collect information about user behaviour, provided you have consented to the use of these cookies. When you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account before activating the play button.

The information generated by the YouTube cookies about your use of our website is usually transferred to a YouTube server in the USA and stored there. Information on data protection at YouTube can be found under the following link: https://policies.google.com/privacy?hl=en&gl=de.

(7) Google Analytics

We use the Google Analytics service of Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). The responsible entity for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google uses the cookies mentioned in section (5) above for this purpose, provided you have given your consent.

The information generated by Google Analytics cookies about the use of the website by a user is usually transferred to a Google server in the USA and stored there. After 14 months, the data collected in this way by the cookies is automatically deleted once a month. Google uses this information on our behalf to evaluate your use of our online offer, compile reports on the activities within this online offer and provide us with further services related to the use of this online offer and the Internet. Within this context, pseudonymous user profiles can be created from the processed data. We use Google Analytics with IP anonymisation activated. This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.

Google may also combine the above-mentioned information with information from other sources. For further information, see Google’s Privacy Policy at https://policies.google.com/privacy?hl=en.

Who receives your data and is your data transferred to a third country or an international organisation?

Initially, in principle, only our employees gain knowledge of your personal data which relates to technical, commercial or editorial support. For these purposes, your data is also conveyed to employees of other Frech Group companies if necessary, insofar as this is required for the appropriate support (e.g. for answering your enquiries). If you as a customer are supported by another company for example, a relevant request via our contact form would be forwarded to this company for processing and response.

In addition, we use external service providers or commission them for appropriate services where necessary as part of the data processing explained above. If service providers obtain your personal data as a processor that has been commissioned, they are strictly bound by our directives when dealing with your personal data. In the following, we will cite the categories of external recipients in detail:

IT service providers, e.g. for the purposes of administration and hosting our website and other services/functionalities for the provision of our website.

If you have consented to the use of YouTube and Google cookies, your personal data may be transferred to the USA. The respective data transfer will be based on what is referred to as EU Standard Contractual Clauses. Should the EU issue an adequacy decision based on the US Privacy Shield programme, US data transfers may also take place on this basis in the future. Apart from that, we do not transfer your personal data to countries outside the EU or the EEA or to international organisations within the meaning of Art. 4 no. 26 GDPR.

How do we protect your data?

We make provisions to ensure the security of your personal data and to protect our website and other systems through suitable technical and organisational measures. Your data is protected in particular against loss, destruction, falsification, manipulation and amendment by unauthorised persons as well as against unauthorised access and unauthorised disclosure or distribution. In addition, data that you share on our website is transmitted using SSL encryption.

Which regulations apply to links?

Some sections of our website contain links to websites of third-party providers. These websites are subject to their own data protection principles. We are not responsible for their operation, including data management. If you send information to or through such third-party websites, you should check the Privacy Policies of these websites before you give them information that can be assigned to you personally.

What applies for the erasure of my personal data?

The erasure of stored personal data takes place subject to legal retention periods if you revoke the consent that you had previous given to us for storage, if knowledge of it is no longer required to fulfil the purposed pursued by storage, or if its storage is impermissible for other legal reasons.

Your rights

As the person affected, you have various rights with regard to your personal data and our pro- cessing of this data.

Right to information

If you have questions and comments regarding the collection, processing and use of your personal data, you can contact us at the address given above. We will gladly share with you upon request whether and what personal data is stored with us about you.

Right of rectification

Furthermore, you have the right to request from us a rectification of incorrect personal data con- cerning you.

Right of revocation

You have the right to revoke the consent that you have previously granted to us at any time by sending us a message regarding this. Please note that your revocation does not affect the legality of the processing carried out on the basis of consent up until revocation.

Erasure obligation/ Right to restrict processing (blocking)

Under the legal stipulations, you have the right to request from us an erasure of the personal data concerning you when the legal basis for processing ceases to apply. In addition, in particular cases, you can request that we restrict data processing, for the duration of a review if you have contested the accuracy of the data or if data cannot be erased, for example.

Right to object

You have the right to lodge an objection against the processing of the personal data concerning you insofar as we base specific processing on legitimate interests at any time. Upon your objection, we will no longer process your personal data unless there are compelling legitimate grounds for processing, or processing serves the establishment, exercise or defence of legal claims.

Right to data portability

In addition, under the legal stipulations, you have the right to request from us the issuance of such personal data that you have provided to us, where appropriate, in a generally conventional, ma- chine-readable format. If we process such data on the basis of your consent, in this context, you can request from us that we transfer your data to another provider, for example.

Right to complain

If you are of the view that in processing your personal data there is grounds for complaint, you can contact our data protection officer with the aforementioned contact details. In addition, you can also file a complaint with our competent supervisory authority, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Representative for Data Protection and Freedom of Information for Baden-Württemberg), Königstrasse 10a, 70173 Stuttgart, or another competent supervisory authority.

Is there an obligation to provide data?

To be able to make our website available to you and enable use of the relevant services/functionalities (such as the contact form etc.), it is necessary that you provide the personal data required. Without this data, it is not possible to access the content of our website or to use the relevant services/functionalities.

Will your data be used for automated decision-making/profiling purposes?

Fundamentally, you have the right to not be subject to a decision based exclusively on automated processing – including profiling – that has a legal effect for you or substantially affects you in a similar manner, except for decisions about the conclusion or fulfilment of contracts. In particular, these decisions may not consistently depend on particular categories of personal data according to Art. 9 para. 1 GDPR. We do not use such decision-making processes for the purposes of our website and the associated data processing.

Could this Privacy Policy change?

The further development of the Internet and our website can affect our Privacy Policy. We reserve the right to alter this website-specific Privacy Policy in the future so that it complies with the current legal requirements or reflects expansions or modifications to our website. The current version of the existing Privacy Policy applies for your visit. You can access this on every subpage under the link “Data Protection”.

How do we handle customer data in other cases?

In addition to this website-specific Privacy Policy, we refer to our general “Privacy notice for customers and business partners”, which governs the processing of personal data of customers and business partners in other cases and can also be accessed digitally via the following link: Please click here.