Information on data protection at MAE

MAE takes very seriously the protection of your personal data. These we treat confidentially and in compliance with the statutory data protection regulations and the information provided herein.

1 Responsibilities and competences for data protection

1.1 Responsibility

The responsibility for data processing lies with:

MAE Maschinen- und Apparatebau Götzen GmbH
Steinhof 65, 40699 Erkrath
P.O. Box 1362, 40673 Erkrath
Tel: +49 211 89093-0
Fax: +49 211 89093-52
E-mail: datenschutz@mae-group.com

1.2 Data protection officer

We have designated the following data protection officer:

Boris Nicolaj Willm
Resilien[i]T GmbH
Monschauer Straße 12
40549 Düsseldorf
Tel: +49 211 695289 92
E-Mail: dsb.mae-group@resilienit.de

1.3 Competent supervisory authorityc

We have been assigned the following supervisory authority:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Tel.: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de

2 General information on data protection

2.1 What data do we process from you?

Depending on the specific processing situation and necessity, we collect and process different types of personal data. We provide detailed information on this in this and / or separate data protection information or as part of the data collection to the respective data subjects.

2.2 For what purposes do we process your data and on what legal basis?

We collect and process various personal data depending on the specific processing situation. The processing is always carried out in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) or other legal requirements The legal bases relevant to us result from Art. 6 para. 1 as follows:

2.2.1 On the basis of your consent

If you have given us your consent for the specific processing of your personal data, we will process your personal data on this basis. Consent may, for example, relate to the transfer of data to partner companies, the evaluation of your data for targeted advertising measures or the sending of newsletters.
Consent is always voluntary. Refusing or withdrawing consent will not have any negative consequences for you.

2.2.2 For the fulfillment of contractual obligations

We process your personal data to fulfill contractual or quasi-contractual obligations or to establish a contract, for example for existing customer support or to answer questions from a prospective customer.
If you apply to us by post or electronically and provide us with personal data, we process this data exclusively for the purpose of initiating a future employment relationship.

2.2.3 Due to legal obligations

As part of our legal obligations, we process your personal data if this is provided for or required by law. This may include, for example, the disclosure of your data to government authorities in the context of tax or criminal prosecution proceedings, the evaluation of your data to comply with regulatory requirements, sanctions list checks or the provision of certain information to statutory bodies.
The processing of your data on this basis is always necessary. The legal obligation to which we are subject as an organization cannot be affected by any refusal or restriction on your part. We assure you that your personal data will be processed in accordance with the law and that it will be comprehensively protected.

2.2.4 Due to legitimate interests

We also process your personal data to protect our legitimate interests, unless your interests or fundamental rights and freedoms, which require the protection of your personal data, prevail.
Subject to a balancing decision to be made in individual cases, we regularly assume that our legitimate interests prevail in the context of the following listed processing situations:

• for existing customer support;
• to inform you about offers for services and products if we have received your name, e-mail address or postal address from you in connection with the provision of our services and/or the sale of our products;
• to process your request after you have contacted us;
• Optimization of our processes (e.g. to identify sources of error), offers and services;
• Maintaining a customer database in our group of companies to improve customer service;
• in the context of legal prosecution in the event of suspicion or a criminal offense;
• to ensure the security, confidentiality and integrity of our IT systems (e.g. through security and effectiveness tests);
• to process your data in order to test IT systems and software products and to carry out migrations. As well as to ensure the functionality of new products and the correctness and completeness of migrations;
• In the event of a security incident involving your data, we are obliged under Art. 33 GDPR to report this immediately to the competent data protection supervisory authority. In our legitimate interest in complying with this legal obligation as quickly as possible, it may be necessary to process your personal data as part of the investigation of the incident. However, no personal data of yours will be transmitted to the data protection supervisory authority in the reports;
• to carry out internal audits, internal reviews and other control measures (e.g. reviews by the data protection or information security officer) in order to comply with legal requirements, ensure transparency in our business processes and continuously improve them. In doing so, it may be necessary to process documents or files that contain your personal data;
• for corporate management and compliance with our financial and tax obligations (e.g. reporting, audits, internal audits, tax consultants, auditors and other control measures, e.g. by tax authorities and commissioned auditors);
• to maintain a blacklist in order to implement the objection to processing pursuant to Art. 21 GDPR.

2.3 From whom do we receive your data?

In principle, we process your personal data that you have provided yourself or that has been collected from you. If necessary, we collect personal data from external sources (see point 2.4); we may refer you to other sources separately. Processing only takes place on the basis of a valid legal basis.

2.4 Who do we share your data with?

2.4.1 Companies, agencies and partners of the MAE Group

When necessary for the establishment, implementation, or termination of an actual or quasi contract, we basically transmit your personal data to our affiliated companies or partners and representatives. Specifically, these partners and representatives are independent sales agents marketing our commodities and services both at home and abroad. For example, when you contact us, we share the information you provide with the MAE Group company responsible for your region so that they can offer you our products and services depending on your needs and the region of your request.

The MAE Group companies include:

• MAE Eitel Inc (USA)
• MAE Machine (Beijing) Co (China)

2.4.2 Processors and third parties

On our instructions, your personal data may be processed by processors if their involvement is necessary for processing. In these cases, we ensure that your personal data is processed in accordance with the provisions of the GDPR. Processors in this case are, for example, IT service providers, waste disposal companies, etc. In addition, these processors are contractually obliged to either delete or return the data to us in accordance with the legal requirements when their services are terminated.
Your data will only be transferred and passed on to external recipients if this is permitted or required by law.

Your data may be passed on to the following recipients:

• Public bodies and institutions and law enforcement agencies that receive data due to legal regulations (e.g. tax office, tax auditors, courts, employment agency, customs, etc.);
• In the event of a legal dispute or suspicion of a criminal offense (e.g. courts, opposing lawyers, authorities, contractual partners, consultants, business partners, opposing parties, insofar as necessary to protect our rights);
• Tax consultants, accountants, auditors, data protection officers, information security officers or legal advisors;
• Payment service provider, for processing a payment transaction (e.g. financial institutions, payment services);
• Collection service providers or credit agencies, insofar as this is necessary to exercise our rights;
• IT and other service providers (e.g. for IT maintenance, cloud services, applications, website support, advertising agency, destruction of files and data carriers, credit checks, sanctions list checks, as well as protection and security services, caterers, call centers);
• Printing and logistics companies, telecommunications service providers, delivery services, e-mail providers of the recipient, data carrier disposal service providers;

2.5 Information on the transfer of data to third countries

In our organization, we use services from providers based in countries outside the European Economic Area where there is no level of data protection comparable to that in the EU. When using these services, your personal data may be transferred to these countries and processed there. We guarantee that this transfer will only take place within the framework of compliance with Art. 44 et seq. of the General Data Protection Regulation (GDPR) in order to ensure an adequate level of protection for your data.

2.6 Storage period

If no explicit or statutory storage period is specified at the time of collection, your personal data will be deleted as soon as it is no longer required to fulfill the purpose of storage and there are no statutory retention obligations or statutory justifications for storage.
If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place after these reasons no longer apply.

3 Your rights as a data subject

In accordance with the provisions of data protection law, we would like to inform you of your rights as a data subject. These rights are essential components of data protection and guarantee you control over your personal data. It is important to us that you are aware of your rights and understand how you can exercise them to protect your privacy and the integrity of your data. Below you will find a detailed breakdown of your rights and how you can exercise them if necessary.

3.1 Information, correction and deletion

You have the right to obtain information about your personal data processed by us. This includes information about the source of the data, the recipients and the purpose of processing. You also have the right to have this data corrected or deleted if necessary.

3.2 Right to restriction of processing

You have the right to restrict the processing of your personal data. This right is applicable under the following conditions:

• Accuracy of the data: If you dispute the accuracy of your personal data and verification is required.
• Unlawful processing: If the processing is unlawful, but you refuse to have it erased and instead request that its use be restricted.
• The purpose of processing no longer applies but is required for legal claims: If the controller no longer needs the data for the purposes of processing, but you need them to assert, exercise or defend legal claims.
• Objection to processing: If you have objected to processing pursuant to Art. 21 (1) GDPR and it is still being examined whether the legitimate reasons of the controller outweigh your reasons.

During the restriction period, your data, apart from being stored, may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

3.3 Right to data portability

You have the right to receive your personal data that you have provided to us in a structured, widely used and machine-readable format in accordance with the existing legal provisions. This right also enables you to have this data transferred directly from one controller to another, where technically feasible. This applies in cases where the processing is based on consent or a contract and is automated.

3.4 Right to object to the collection of data in special cases

You have the right to object at any time to the processing of your personal data if it is based on Article 6(1)(f). This provision permits data processing on the basis of the legitimate interests of the controller or a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail.
You have the unrestricted right to object at any time to the processing of your personal data for advertising purposes. This includes direct marketing. As soon as you object, the processing of your data for these purposes will cease. This right is absolute and will result in the immediate cessation of the relevant data processing.
Individuals have the right not to be subject to decisions based solely on automated processing which produces legal effects concerning them or similarly significantly affects them.
The right to object also extends to profiling to the extent that it is related to direct marketing.

3.5 Revocation of your consent to data processing

You have the right to revoke processing based on your explicit consent at any time for the future. However, this revocation does not affect the legality of the data processing that took place before your revocation.

3.6 Contact option for exercising your rights as a data subject

You may declare the exercise of your rights and may file your objections in an informal communication sent by post or email to:

MAE Maschinen- und Apparatebau Götzen GmbH
Area: Data protection
Steinhof 65, 40699 Erkrath
P.O. Box 1362, 40673 Erkrath
E-mail: datenschutz@mae-group.com

3.7 Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 (1) GDPR.

4 Data processing on this website

4.1 General information on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, insofar as special categories of data are processed in accordance with Art. 9 para. 1 GDPR. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 para. 1 lit. a GDPR. If you have consented to the storage of cookies or access to information in your end device (e.g. via device fingerprinting), data processing is also carried out on the basis of Section 25 (1) TDDDG. This consent you may revoke at any time. If your data is required to fulfill the contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Furthermore, we process your data if this is necessary to fulfill a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR. Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this privacy policy.

4.2 External hosting (Mittwald)

Our website is hosted near Espelkamp-Mittwald. The provider is Mittwald CM Service GmbH & Co KG, Königsberger Straße 4-6, 32339 Espelkamp (hereinafter Mittwald).
Details can be found in Mittwald’s data protection information: https://www.mittwald.de/datenschutz.
Mittwald is used on the basis of Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in the highest possible availability of our website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
We have concluded an order processing contract (AVV) with the above-mentioned provider. This is an agreement stipulated under the data protection laws to safeguard the processing of personal data provided by our website visitors only in accordance with our instructions and in compliance with the GDPR.

4.3 SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, we use SSL or TLS encryption for our website(s). You can recognize an encrypted connection by the fact that the web address begins with “https://” and a lock symbol is displayed in your browser. When SSL or TLS encryption is enabled, the data you submit to us cannot be read by third parties.

4.4 Cookies

Our Internet pages use so-called “cookies”. Cookies are small data packets and do not cause any damage to your end device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser.
Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g. cookies for processing payment services).
Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies can be used to evaluate user behavior or for advertising purposes.
Cookies that are required to carry out the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimized provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, the processing takes place exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG); the consent can be revoked at any time.
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.
You can find out which cookies and services are used on this website in this data protection information.

4.5 Consent (Borlabs Cookie)

Our website makes use of Borlabs Cookie Consent Technology, which retrieves your consent to the storage of particular cookies in your browser or to the use of certain technologies and to document these in compliance with data protection. This technology is provided by Borlabs GmbH at Rübenkamp 32 in 22305 Hamburg (referred to hereinafter as “Borlabs”).
When you enter our website, your browser accepts a Borlabs Cookie that lists the consents you have granted or the revocation thereof. This data is not passed on to the provider of Borlabs Cookie.
The data collected is stored until you ask us to delete it or delete the Borlabs cookie yourself or until the purpose for data storage no longer applies. This does not affect the mandatory legal retention periods. Details on the data processing of Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.
Borlabs cookie consent technology is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR.

4.6 Server log files

The site provider collects and stores automatically in so called server logfiles the information your browser transmits to us automatically. This includes:

• browser type and version
• active operating system
• referrer URL
• host name of the accessing computer
• time when the server request was sent
• IP address

This data is not merged with other data sources.
This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The site operator has a legitimate interest in the error-free presentation and the optimisation of its website – and server logfiles are needed for this purpose.

4.7 Contact form

When you use our contact form to submit a request, all the entries you make, including your contact details, are extracted from the form and stored on our systems for the purpose of handling your request and generating any follow-up questions. We do not pass on this data without your consent.
This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; the consent can be revoked at any time.
The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies (e.g. after your inquiry has been processed). This does not affect the mandatory legal provisions, specifically the retention periods.

4.8 Analysis tools and advertising (Google Tag Manager)

We make use of Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager is a tool that we can use to integrate tracking or statistical tools and other technologies on our website. Google Tag Manager itself does not generate user profiles, nor does it accept cookies or perform any analyses. It serves solely to manage and control the tools linked with it. However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States.
Google Tag Manager is used on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG, insofar as the consent includes the storage of cookies or access to information in the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. This consent you may revoke at any time.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

4.9 Analysis tools and advertising (Google Analytics)

This website applies functions provided by Google Analytics. The provider is Google Google Analytics, which enables the website operator to analyze the behavior of website visitors. The website operator receives various usage data, such as page views, length of visit, operating systems used and origin of the user. These data are assigned to the user’s calling terminal. There is no assignment to a user ID. There is no assignment to a user ID.
Furthermore, we can use Google Analytics to record your mouse and scroll movements and clicks, among other things. Google Analytics also uses various modeling approaches to supplement the collected data sets and uses machine learning technologies for data analysis.
Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to a Google server in the USA and stored there.
The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found at https://privacy.google.com/businesses/controllerterms/mccs/.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

IP anonymization
Google Analytics IP anonymization is activated. As a result, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Browser plugin
You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

You can find more information on how Google Analytics handles user data in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Google signals
We use Google signals. When you visit our website, Google Analytics records your location, search history and YouTube history as well as demographic data (visitor data), among other things. This data can be used for personalized advertising with the help of Google Signal. If you have a Google account, the visitor data from Google Signal is linked to your Google account and used for personalized advertising messages. The data is also used to compile anonymous statistics on the user behavior of our users.

Order processing
We have concluded an order processing contract with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

4.10 Web analysis tool (Mouseflow)

This website applies Mouseflow, a web analytics tool provided by Mouseflow ApS of Flæsketorvet 68 in 1711 København, Denmark. Data processing assists in the analysis of this website and its visitors. It involves collecting and storing data for marketing and optimisation purposes. These data may be used to generate user profiles under a pseudonym. Cookies may be used as well. The web analytics tool Mouseflow is designed to record single visits (exclusively with anonymised IP address) on a random basis. This gives rise to a record of mouse movements and clicks intended to reenact on a random basis specific visits to the website and to derive potential improvements from these. Without the consent granted specifically by the data subject, the data collected via Mouseflow are not used to identify the person of the visitor to this website, nor are they collated with the personal data carried in the pseudonym. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. This consent you may revoke at any time.

You can also deactivate recording on all websites that use Mouseflow globally for the browser you are currently using at the following link: https://mouseflow.de/opt-out/
Order processing: We have concluded an order processing contract with Mouseflow ApS.

4.11 Fonts (Google Fonts)

This site applies a number of Google services that use so called Google Fonts, a set of typefaces provided by Google that present a consistent look. When you call up a page, your browser loads the required fonts into your browser cache in order to display texts and fonts correctly.
For this purpose, the browser you are using must connect to Google’s servers. Google then learns that this website has been called via your IP address. The use of Google Fonts is based on Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. You can revoke your consent at any time.
If your browser does not support Google Fonts, a standard font will be used by your computer.
Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google’s data protection information: https://policies.google.com/privacy?hl=de.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

4.12 Map service (Google Maps)

This site makes use of Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to save your IP address. This information is generally transmitted to a Google server sited in the USA where it is stored. The provider of this website has no control over this data transfer. When Google Maps is enabled, Google may apply Google Fonts for the consistent presentation of typefaces. When you call up Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.
Google Maps is used exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
You can find more information on the handling of user data in Google’s data protection information: https://policies.google.com/privacy?hl=de.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

4.13 hCaptcha

We use hCaptcha (hereinafter referred to as “hCaptcha”) on this website. The provider is Intuition Machines, Inc, 2211 Selig Drive, Los Angeles, CA 90026, USA (hereinafter “IMI”).
hCaptcha is used to check whether the data entry on this website (e.g. in a contact form) is made by a human or by an automated program. For this purpose, hCaptcha analyzes the behavior of the website visitor based on various characteristics.
This analysis begins automatically as soon as the website visitor enters a website with activated hCaptcha. The information analysed by hCaptcha includes e.g. IP address, session duration, and mouse movements. The data collected during this analysis are transmitted to IMI. When hCaptcha is running in invisible mode, the analyses are performed completely in the background. Website visitors are not informed that an analysis is taking place.
The data is stored and analyzed on the basis of Art. 6 para. 1 lit. f GDPR. The site operator has a legitimate interest in protecting its web services from malicious bots and SPAM. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
Data processing is based on standard contractual clauses contained in the Data Processing Addendum to IMI’s General Terms and Conditions or the data processing contracts.
For more information on hCaptcha, please refer to the privacy policy and terms of use at the following links: https://www.hcaptcha.com/privacy and https://hcaptcha.com/terms.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

5 Data processing of customers, service providers and suppliers

Your data are processed as follows:

5.1 Order-related communication

For the purpose of handling our business transactions, we process your name, contact details, company, and assigned responsibilities/post. The information will be passed on to our auditor or responsible supervisory authorities on request and deleted 10 years after the end of our business relationship.
The legal basis for this processing is Article 6(1)(b), (c) of the European General Data Protection Regulation (requirement to fulfill contractual or legal obligations).

5.2 Promotion of the business relationship

If you are employed by one of our business partners, we also process, for the purpose of promoting our business relations, your name, contact details, company, and assigned responsibilities/post and any communications on product details and invitations to customer/supplier satisfaction surveys and events as well as their implementation. We do not pass this data on to third parties and delete it 1 year after the end of our business relationship.
The legal basis for this processing is Article 6(1)(f) of the European General Data Protection Regulation (overriding legitimate interest); our interest lies in improving the customer relationship with you.

5.3 Sending newsletters to existing customers

If you order goods or services from us and provide us with your e-mail address, this e-mail address may subsequently be used by us to send you newsletters, provided we inform you of this in advance. In such a case, only direct advertising for our own similar goods or services will be sent via the newsletter. You can unsubscribe from this newsletter at any time. There is a corresponding link in every newsletter for this purpose. In this case, the legal basis for sending the newsletter is Art. 6 para. 1 lit. f GDPR in conjunction with Section 7 para. 3 UWG.

After you unsubscribe from the newsletter distribution list, we may store your e-mail address in a blacklist to prevent future mailings to you. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest

6 Data processing as part of the application process

We offer you the opportunity to apply via our application form on our careers page. The data transmitted as part of your digital application will be sent to us using TLS encryption.
An incorrect application may be processed, but we cannot guarantee that the documents will actually be deleted in full within the deadline.
To ensure a data protection-compliant application process, we therefore ask you to always apply using our application form on our careers page.

6.1 Scope and purpose of data collection

By sending us your application, you allow us to process the contained and related personal data (e.g. contact and communication details, application materials, notes taken during interviews, etc.) when these are needed for the decision in favour of your future employment with us. The legal basis for this is Art. 6 para. 1 lit. b GDPR (general contract initiation) in conjunction with Section 26 BDSG under German law (initiation of an employment relationship). If you claim reimbursement of travel expenses, we process your associated personal data (e.g. bank details, details of travel expenses claimed, etc.), the legal basis for this is Art. 6 para. 1 lit. c GDPR (fulfillment of legal obligations). If you have given us your consent – Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time for the future. Your personal data will only be passed on within our company to persons who are involved in processing your application.
If you provide links to your profiles in social networks in your application, we reserve the right to view these as part of the selection process.
If you provide us with information about your previous employers or name a reference person, we may contact them with your express consent (Art. 6 para. 1 lit. a GDPR) in order to obtain a recommendation or assessment of your person. This is done on the basis of our legitimate interest in including such references in the decision-making process (Art. 6 para. 1 lit. f GDPR).

6.2 Application portals, recruitment agencies and the Federal Employment Agency

In order to recruit employees, in certain cases we commission recruitment agencies or use application portals to advertise jobs or to approach applicants directly. It depends on the individual case or the respective channel whether the above-mentioned data is collected directly from you or via the respective intermediary and/or transmitted to us. In addition, we receive applicant profiles with contact data from the Federal Employment Agency in accordance with Section 38 (2) SGB III.

6.3 Job interviews

Our application procedure offers candidates an opportunity to take part in interviews via a video conferencing tool. This solution eliminates the physical contacts in a face to face situation and bridges the distances posed by differing geographical locations. Neither the video nor the audio data are recorded or stored at any time. Applicants may choose to activate or deactivate their webcams before or during the interview. Applicants need not justify their decision to decline participating in the video interview. In this case, a mutually acceptable alternative will be sought.
If a video conferencing tool is used, the transfer of data to a third country (in particular the USA) cannot be ruled out. The legal basis for processing is consent pursuant to Art. 6 para. 1 lit. a GDPR. This consent you may revoke at any time.

6.4 Data retention period

If we are unable to make you a job offer, you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) for up to 6 months after receipt. After this period, the data are erased or anonymised, and the physical application material destroyed. This retention period serves for verification purposes in the event of legal disputes. If it is evident that the data will be required after the expiry of the 6-month period (e.g. due to an impending or pending legal dispute), deletion will only take place when the purpose for further storage no longer applies.
Longer storage may also take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if statutory storage obligations prevent deletion.

6.5 Inclusion in the talent pool

In the event that we are unable to offer you a post, you may opt to be included in our talent pool. If you are accepted, all documents and information from the application will be transferred to the talent pool in order to contact you in the event of suitable vacancies.
The inclusion in the talent pool in order to identify any other interesting positions for you, this also applies, for example, to applications for an apprenticeship or internship, is based exclusively on your express consent (Art. 6 para. 1 lit. a GDPR). Your consent is voluntary and has no effect on the ongoing application procedure. Data subjects may revoke their consent at any time. In this case, the data from the talent pool will be irrevocably deleted, provided there are no legal grounds for retention.
The data from the talent pool will be irrevocably deleted no later than two years after consent has been granted.

7 Data processing in other cases

7.1 Request by e-mail, telephone or fax

When you contact us by email, phone, or fax, your request, including all personal data you provide with it (name, address), is committed to our storage systems and processed for handling purposes. We do not pass on this data without your consent.
This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; the consent can be revoked at any time.
The data you send to us via contact requests will remain with us until you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies (e.g. after your request has been processed). This does not affect the mandatory legal provisions, specifically the retention periods.

7.2 Data processing when conducting audio and video conferences

The solutions we use to communicate with our customers include online conferencing tools. These are listed below. If you communicate with us by video or audio conference via the internet, your personal data will be collected and processed by us and the provider of the respective conference tool.
The conference tools collect all data that you provide/enter to use the tools (e-mail address and/or your telephone number). In addition, the conferencing tools process the duration of the conference, the times you commence and end your participation in the conference, the number of participants, and other so called contextual information relating to the communication process (metadata).
Furthermore, the provider of the tool processes all technical data needed to handle the online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.
If content is exchanged, uploaded or otherwise provided within the tool, this is also stored on the servers of the tool providers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service.
Please note that we do not have full control over the data processing operations of the tools used. Our scope of action is defined to a large extent by the corporate policy pursued by each of these providers. Further information on how these conferencing tools process data can be taken from the respective privacy statements listed below this section.

Purpose and legal basis
The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 para. 1 lit. b GDPR). In addition, these tools serve to simplify and accelerate the communication with us and our companies (legitimate interest as defined under point [f] of Art 6[1] GDPR). The tools are employed only when you grant your consent thereto. This consent you may revoke at any time.

Storage period
The data collected directly by us via the video and conference tools will be deleted from our systems as soon as you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Cookies stored on your terminal remain there until you erase them. Mandatory statutory retention periods remain unaffected.
We have no influence on the storage period of your data that is stored by the operators of the conference tools for their own purposes. For details please consult directly the information supplied by the providers of the conferencing tools.

7.2.1 Conference tool used – Microsoft Teams

We make use of Microsoft Teams. This is provided by Microsoft Ireland Operations Limited of One Microsoft Place, South County Business Park, Leopardstown in Dublin 18, Ireland. Details on data processing can be found in the Microsoft Teams data protection information: https://privacy.microsoft.com/de-de/privacystatement.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with EU data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzNaAAK&status=Active

We have concluded a data processing agreement (DPA) with the above provider of this service. This is an agreement stipulated under the data protection laws to safeguard the processing of personal data provided by our website visitors only in accordance with our instructions and in compliance with the GDPR.

7.3 Data processing in the context of video surveillance at the company headquarters

The company site in Erkrath is under video surveillance for the purpose of protecting MAE property, employees, customers, and suppliers; of preventing and investigating theft and vandalism; of identifying damage to property; and of regular inspections of operability. The duration of storage is 72 hours. Recordings required for the purpose of preserving evidence are stored for as long as is necessary for legal prosecution.
The recordings can be viewed by the service provider during maintenance of the system and may be forwarded to law enforcement authorities.
The legal basis for this processing is Article 6(1)(f) of the European General Data Protection Regulation (overriding legitimate interest). Insofar as special categories of personal data are processed, this is done on the basis of Art. 9 (2) (f) in conjunction with Art. 6 (1) (f) GDPR. Art. 6 para. 1 lit. f) GDPR. Our interest lies in improving the protection of the property of the company, customers, suppliers and its employees against burglary, theft, vandalism, to safeguard domiciliary rights and to assert claims against third parties.

8 Our social media presence

8.1 Data processing by social networks

We maintain publicly accessible profiles on social networks. The individual social networks we use can be found below.
Social networks can generally analyze your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations. In detail:

• If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies that are stored on your device or by recording your IP address.
• With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are logged in or have been logged in.
• Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

Legal basis
Our social media presences are intended to ensure the widest possible presence on the internet. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a GDPR).

Controller and assertion of rights
If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can generally assert your rights (information, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook).
Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our scope of action is defined to a large extent by the corporate policy pursued by each of these providers.

Storage period
The data collected directly by us via the social media presence will be deleted from our systems as soon as you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Cookies stored on your terminal remain there until you erase them. Mandatory statutory provisions – in particular retention periods – remain unaffected.
We have no influence on the storage period of your data that is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their data protection information, see below).

8.2 Social networks in detail

8.2.1 XING

We have a profile on XING. The provider is New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. Details on how they handle your personal data can be found in XING’s data protection information: https://privacy.xing.com/de/datenschutzerklaerung

8.2.2 LinkedIn

We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.
If you wish to deactivate LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs
Details on how they handle your personal data can be found in LinkedIn’s data protection information: https://www.linkedin.com/legal/privacy-policy

8.2.3 YouTube

We have a profile on YouTube. This is provided by Google Ireland Limited of Gordon House, Barrow Street in Dublin 4, Ireland. Details on how they handle your personal data can be found in YouTube’s data protection information: https://policies.google.com/privacy?hl=de
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active