Skip to main content

Data protection

Privacy statement

Welcome to our website. Below you will find our privacy policy:

I General information

1. Contact details of the data controller

HAMMERSEN ELEMENTBAU GMBH & CO. KG
Chemnitzer Straße 3
49078 Osnabrück

Phone: +49 (0)5405/ 9333-0
Fax: +49 (0)5405/ 9333-99
E-Mail: info@hammersen.de

2. Contact details of our data protection officer

DSO Datenschutz Osnabrück GmbH, RA Stephan Beume
Brückenstr. 3
49090 Osnabrück

Phone: +49 (0)541/60081631
Email: info@dso-datenschutz.de

II. Specific information on the collection of personal data

1. Visiting the website

a) Purpose of data processing

Each time a user goes to a page on our website and each time a file stored on our website is accessed, access data relating to this process is stored in a log file. Each record consists of:

(1) the page from which the file was requested,

(2) the name of the file,

(3) the date and time of the request,

(4) the amount of data transferred,

(5) the access status (file transferred, file not found, etc.),

(6) a description of the type of operating system and web browser used,

(7) host name of the accessing computer,

(8) the client IP address.

We use this data to operate our website, in particular to observe the capacity utilisation of the website as well as malfunctions of the website and to make adjustments or improvements. The client IP address is used for the purpose of

transmitting the requested data: it is anonymised by deleting the last numerical block (Ipv4) or the last octet (Ipv6) after the technical requirement has ceased to apply.

(b) Duration of storage

The data is stored each time a user accesses a page on our website and each time the website is entered and is deleted as soon as it is no longer necessary for the purpose of collection, which at the latest is the case three months after visiting the website.

(c) Legal basis

The temporary storage of the aforementioned data takes place on the legal basis of Art. 6 Para. 1 (f) of the EU General Data Protection Regulation (hereinafter "GDPR"). The legitimate interest lies in the provision of our website and the checking against misuse.

(d) Option to object and remove

By waiving the use of our website, the data subject can object to the processing and, subject to the conditions described in more detail in the "Rights" section below, ask for the data collected from him/her in this way to be removed by submitting an informal declaration.

2. Cookies

a) Purpose of data processing

In order to technically facilitate visits to our website and the ordering process, we send so-called cookies to the data subject's end device. Cookies are small text files that can be used to identify the data subject's end device usually by recording the name of the domain from which the cookie data was sent, information about the age of the cookie and an alphanumeric identifier. By placing the cookie on the end device used –without interfering with the operating system – it will be recognised and will allow us to make any default settings available immediately. We use this information in order to adapt our website and the services we offer to your needs and to speed up access to our website.

(b) Duration of storage

The storage period of the various cookies varies, but is no longer than two years. They are stored on your local device, not on our server, so the actual deletion time will depend on how your browser software is configured. Please refer to the operating instructions of your browser software for information on how to delete cookies set by us automatically or for specific reasons.

(c) Legal basis

The storage of the aforementioned data takes place on the legal basis of Art. 6 Para. 1 (f) of the GDPR. The justified interest for the setting of cookies is, on the one hand, to be able to optimise the quality of our website by means of an analysis and on the other hand to make it possible to visit our website; in particular, some functions on our website cannot be used without cookies, because otherwise the user and the settings the user has already made would not be recognised when changing pages, language settings would be lost and searches could not be performed. Furthermore the storage takes place on the legal basis of Art. 6 Para. 1 (b) of the GDPR for the performance of the contract.

(d) Option to object and remove

The data subject can block the use of cookies in the end device used or delete them after use. Under certain circumstances, however, it may be not possible then to use individual functions of our website. How cookies can be blocked and already stored cookies deleted, can be found in the instructions of the browser software.

3) Making contact

a) Purpose of data processing

A user may contact us by email, contact form, messaging our social network accounts, fax or telephone. We store the data transmitted to us and provided by the data subject for processing the

enquiry. These data are name, address, email address, telephone and/or fax number, date and time of the enquiry and the description of the request, if necessary contract data, if the enquiry is made as part of preparing or processing a contract. The data is not passed on to third parties. They are used to process the data subject's contact request.

(b) Duration of storage

As soon as the data are no longer necessary to achieve the purpose, they are deleted, which is the case when the conversation has been completed and the facts of the case have been clarified and no contractual or tax law retention periods are opposed to this. This period is five years for personal data subject to § 147 AO (German Fiscal Code) and ten years for personal data subject to § 257 HGB (German Commercial Code). The periods commence at the end of the calendar year in which the data was collected.

(c) Legal basis

The storage of the aforementioned data takes place on the legal basis of Art. 6 Para. 1 (b) of the GDPR as part of the initiation or performance of a contract or pursuant to Art. 6 Para. 1 (f) of the GDPR. The legitimate interest of the data controller is being able to process the contact request and prevent misuse of the contact request.

(d) Option to object and remove

The data subject has the option to object to storage at any time. The data stored for the procedure will then be deleted. If a contract has been concluded, the above remarks apply as far as the conclusion of a contract is concerned.

4. Google Analytics

a) Purpose of data processing

The client IP address is recorded for the use of the Google Analytics service. This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on the end device of the data subject and which enable the use of the website to be analysed. The information generated by the cookie about the use of the website is usually transmitted to a Google server in the United States, where it is stored. However, due to the activation of IP anonymisation on this website, the IP address of the data subject is abbreviated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and abbreviated there. On behalf of the operator of this website, Google will use this information to evaluate the use of the website, to compile reports about the web activities and to provide further services to the website operator connected with the use of the website and the Internet. The IP address transmitted by your browser within the framework of Google Analytics is not combined with other Google data.

(b) Duration of storage

As soon as the data are no longer necessary to achieve the purpose, they are erased, which is the case when the anonymisation carried out within the European Union has been completed. This takes less than a second. The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month. Further information can be found at www.google.com/analytics/terms/de.html and policies.google.com.

(c) Legal basis

The storage of the aforementioned data takes place on the legal basis of Art. 6 Para. 1 (f) of the GDPR. The legitimate interest lies in the fact that an analysis of the use of the website by all users in its entirety without conclusions about the behaviour of identifiable individuals is possible; we can thereby improve our website and our services.

(d) Option to object and remove

The data subject can prevent the storage of cookies by setting the browser software accordingly; however, we would like to point out to the data subject that in this case it may not be possible to use all this website's functions to the full extent. The data subject may also prevent Google from collecting the data generated by the cookie and relating to the use of the website (including the IP address) as well as from processing this data by downloading and installing the browser plugin available under the following link [http://tools.google.com/dlpage/gaoptout?hl].

5) Xing buttons

a) Purpose of data processing

We do not collect any personal data through the Xing button. Nevertheless, for the sake of completeness, we explain the technical background. We only use the deactivated Xing button provided by XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; website: www.xing.de). This means that no data is transmitted to this network. The data subject decides to activate it by clicking on the button and thus establishing a connection to the Xing server and to thus transmit data to Xing's servers in accordance with the agreement concluded between the data subject and Xing. The activation leads to the access of Xing contents. The type, purpose and scope of data collection and use of this data can be found in Xing's privacy policy: privacy.xing.com/de/datenschutzerklaerung.

(b) Duration of storage

The duration of the storage depends on the specifications set by Xing.

(c) Legal basis

Xing provides information on the legal basis.

(d) Option to object and remove

Xing informs about the objection and removal options.

6. Applications

a) Purpose of data collection and processing

We process the data provided to us from applications only for the purpose of the application and an application procedure.

(b) Duration of storage

In the event of a successful application, the data of applicants can be further processed by us for the purposes of the employment relationship. If the application is unsuccessful, the data of the applicants will be deleted after completion of the application process, unless we are entitled for a period of six months to store the data for answering any follow-up questions regarding the application and for fulfilling any obligations to provide evidence arising from the Equal Treatment Act. If an applicant withdraws his application, the data will also be deleted.

c) Legal basis

The aforementioned data is stored in order to fulfil our pre-contractual obligations within the framework of the application procedure in accordance with Art. 6 Para. 1 (b) and (f) of the GDPR and, if applicable, for the purposes of the employment relationship pursuant to § 26 BDSG (Federal Data Protection Act). As far as special categories of personal data is shared voluntarily in accordance with Art. 9 Para. 1 of the GDPR, they shall also be processed in accordance with Art. 9 Para. 2 (b) of the GDPR (e.g. health data such as severe disability). Insofar as special categories of personal data are requested from applicants in accordance with Art. 9 Para. 1 of the GDPR, they shall also be processed in accordance with Art. 9 Para. 2 (a) of the GDPR (e.g. health data if required for the professional activity).

d) Option to object and remove

The data subject has the option to object to storage at any time. The data stored for the procedure will then be deleted. This does not apply if an employment contract has been concluded and the storage period is still running.

III. Rights of the data subject

If personal data is processed by the user on our website, the affected person (data subject) has the following rights against the data controller according to GDPR.

a) Right of access according to Art. 15 of the GDPR

The data subject has the right to the following information:

(a) the processing purposes;

(b) the categories of personal data that are processed;

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) if possible, the planned period for which the personal data will be stored or, if not possible, the criteria for determining that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to their source;

(h) the existence of automated decision making, including profiling, in accordance with Art. 22 Para. 1 and 4 of the GDPR and – at least in these cases – meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

(i) Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Art. 46 of the GDPR relating to the transfer.

We shall provide the data subject with a copy of the personal data undergoing processing. For all further copies requested by the data subject, the data controller may charge an appropriate fee based on the administrative costs.

2. Right to rectification in accordance with Art. 16 of the GDPR

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. Right to erasure according to Art. 17 of the GDPR

The data subject shall have the right to obtain from the controller the erasure of personal data relating to him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent on which the processing is based pursuant to Art. 6 Para. 1 (a) or Art. 9 Para. 2 (a) of the GDPR and where there is no other legal ground for the processing;

(c) the data subject objects to the processing pursuant to Art. 21 Para. 1 of the GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 Para. 2 of the GDPR;

d) the personal data have been processed unlawfully;

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f) the personal data have been collected in relation to the offer of information society services referred to in Art. 8 Para. 1 of the GDPR.

4. Right to restriction of processing in accordance with Art. 18 of the GDPR

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,

(b) the processing is unlawful and the data subject opposes the erasure of personal data and requests the restriction of their use instead;

c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims, or

(d) the data subject has objected to processing pursuant to Art. 21 Para. 1 of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

5. Right to notification in accordance with Art. 19 of the GDPR

If the data subject has exercised its right to request the controller to rectify its personal data in accordance with Art. 16 of the GDPR, to erase it in accordance with Art. 17 Para. 1 of the GDPR or to restrict its processing in accordance with Art. 18 of the GDPR, and if the data controller has informed all recipients to whom the personal data of the data subject have been disclosed of the data subject's request (insofar as this was not impossible or entailed disproportionate effort), then the data subject has the right to be informed of the recipients by the data controller.

6. Right to data portability according to Art. 20 of the GDPR

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance by us, where

a) the processing is based on consent pursuant to Art. 6 Para. 1 (a) or Art. 9 Para. 2 (a) or on a contract pursuant to Art. 6 Para. 1 (b) of the GDPR and

b) the processing is carried out by automated means. The rights and freedoms of other persons shall not be affected thereby.

When exercising the right to data portability in accordance with paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of the right to data portability shall be without prejudice to the right to erasure according to Art. 17 of the GDPR. The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object in accordance with Art. 21 of the GDPR

The data subject has the right to object, for reasons related to his/her particular situation, at any time to the processing of personal data concerning him/her which is based on Art. 6 Para. 1 (e) or (f) of the GDPR; this also applies to profiling based on these provisions.

We shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing; this also applies to profiling in so far as it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for those purposes.

Consent given by the data subject can be revoked by him or her at any time. However, the collection and processing carried out up to that date remains lawful.

8. Automated, individual decision-making incl. profiling in accordance with Art. 22 of the GDPR

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

This shall not apply if the decision

a) is necessary for the conclusion or performance of a contract between the data subject and us,

b) is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests

or

c) is based on the data subject’s explicit consent.

These decisions must not be based on special categories of personal data as defined in Art. 9 Para. 1 of the GDPR, unless Art. 9 Para. 2 (a) or (g) of the GDPR applies and appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject have been taken.

In the cases referred to in a) and c) above, we shall take reasonable steps to safeguard the rights and freedoms and the legitimate interests of the data subject, including at least the right to obtain the intervention of a person on our side, to present our own position and to appeal the decision.

9. Right to lodge a complaint with a supervisory authority in accordance with Art. 77 of the GDPR

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his residence, place of work or place of alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.

10. Right to an effective judicial remedy in accordance with Art. 79 of the GDPR

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Art. 77 of the GDPR, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under the GDPR have been infringed as a result of the processing of his or her personal data in non-compliance with the GDPR.

Proceedings against us or a processor shall be brought before the courts of the Member State where we or the processor have an establishment. Alternatively, such proceedings may also be brought before the courts of the Member State where the data subject has his or her habitual residence, unless we or the processor is a public authority of a Member State acting in the exercise of its public powers.