PRIVACY POLICY

INTRODUCTION

Thank you very much for visiting our website. We take data protection very seriously and are committed to protecting your personal data in connection with our website. By ‘personal data’, we mean all data relating to the personal and factual circumstances of a natural person. Personal data collected on our website is used exclusively for our own purposes.

Data controller and data protection contact

The data controller within the meaning of Article 4(7) of the GDPR is

Top-Werk GmbH
Freier-Grund-Straße 123
57299 Burbach-Wahlbach, Germany
Phone: +49 2736 4976 0
Fax: +49 2736 4976 620
Email: info@topwerk.com

Legal representative
Robert Gruss, Jens Müller

Data Protection Officer
Oliver Gönner
Rochusstraße 198
53123 Bonn
Tel: 0228 / 28614060
Mail: [dsb@sicoda.de]

Legal basis for data processing

The legal basis for data processing under the EU General Data Protection Regulation (GDPR) is set out in Article 6 of the GDPR. Depending on the specific situation in which we process your data, different legal bases may apply.
 

Consent
Where your consent has been obtained for the processing of personal data, Article 6(1)(a) of the GDPR forms the legal basis for the data processing. Consent that has been given may be withdrawn at any time with effect for the future.

Contract
Where personal data is processed that has been collected for the purpose of performing a contract to which you are a party, Article 6(1)(b) of the GDPR forms the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

Legal obligation
Where the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.

Vital interests
Where the processing of personal data is necessary to protect your vital interests or those of another natural person, Article 6(1)(d) of the GDPR provides the legal basis.

Legitimate interest
Where processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing. Our company’s legitimate interest lies in the conduct of our business activities.

Employment relationship
In accordance with Article 88 of the General Data Protection Regulation (GDPR) in conjunction with Section 26 of the Federal Data Protection Act (BDSG), personal data of employees will be processed for the purposes of the employment relationship, where this is necessary for a decision on the establishment of an employment relationship or, following the establishment of the employment relationship, for its performance or termination, or for the exercise or fulfilment of the rights and obligations of employee representation arising from a law or collective agreement, a works agreement or a service agreement (collective agreement).

Rights of those affected

As part of our data processing activities, we process your personal data. You are entitled to the rights set out in Chapter III of the GDPR in relation to our company.

You have the right to:
• Access
• Rectification
• Erasure
• Restriction of processing
• Notification regarding rectification, erasure or restriction of processing
• Data portability
• Objection

You also have the right to lodge a complaint with the relevant data protection supervisory authority.

Web server logs

When you use our website, connection information is stored in the server log files.

This information includes:
• The IP address of the accessing system
• Browser information, such as the operating system used and screen resolution
• The webpage accessed
• The referring webpage
• The time of access

The web server logs are processed exclusively for security purposes. We use the log data solely for statistical analysis for the purposes of operating, securing and optimising the website. However, we reserve the right to review the log data retrospectively if there are concrete grounds for a reasonable suspicion of unlawful use.
The legal basis for the processing is our legitimate interest in accordance with Article 6(1)(f) of the GDPR.

Contact form

You have the option of sending us any information you wish via the contact form. The data is forwarded by our web server via email to our company’s email inbox. Please note that communication via the contact form is not encrypted. In your own interests, please use a secure communication channel for confidential communication.
We use your personal data solely to respond to your enquiry. The legal basis for processing your personal data via the contact form is Article 6(1)(b) of the GDPR, insofar as your enquiry relates to the performance or negotiation of a contract with us. For all other enquiries, the legal basis is your consent in accordance with Article 6(1)(b) of the GDPR. Where the legal basis for processing is your consent in accordance with Article 6(1)(a) of the GDPR, you have the right to withdraw this consent at any time, with future effect, without giving any reason. Please note that in this case we will no longer be able to process your enquiry further.

Contact us by email or telephone

If you contact us by email or telephone, we will use the personal data you provide to us in connection with your enquiry solely for the purpose of responding to your enquiry. The legal basis for the processing of your personal data via the contact form is Article 6(1)(b) of the GDPR, insofar as your enquiry relates to the performance or negotiation of a contract with us. For all other enquiries, the legal basis is your consent in accordance with Article 6(1)(b) of the GDPR. Where the legal basis for processing is your consent in accordance with Article 6(1)(a) of the GDPR, you have the right to withdraw this consent at any time, with future effect, without giving any reason. Please note that, in this case, we will no longer be able to process your enquiry further.

Log-In

A login is required for certain sections of our Virtual Topwerk.

To log in to certain sections that require a login, you must first register for the relevant section.

To register, we require the following details from you:
• Title
• Surname
• First name
• Company name
• Job title
• Email address

You also have the option to voluntarily share further details with us, such as your telephone number or your academic qualification.
This data is processed exclusively for the purposes of registration and user login. Where data is collected as part of a user login, it is used solely to provide the relevant service. Analysis is carried out only to ensure the smooth and secure operation of the system. The legal basis for the processing is our legitimate interest in accordance with Article 6(1)(f) of the GDPR.

Newsletters and invitations to events

Where you have provided your personal data, such as your surname, first name, email address, etc., to receive our newsletters or invitations to events, we use this data to send you information in accordance with your registration. The legal basis for processing in this case is your consent in accordance with Article 6(1)(a) of the GDPR.
When you sign up or register, we store your IP address and the date of registration. This information is stored as evidence in the event that a third party misuses an email address and registers without the authorised person’s knowledge. You can unsubscribe from the newsletter at any time free of charge by using the unsubscribe link provided, which we include in every newsletter.
When sending the newsletter, we analyse your user behaviour. For the purposes of this analysis, the emails sent contain so-called ‘web beacons’. These are pixel-sized files that are retrieved from our service provider’s server when the newsletter is opened. For the purposes of this analysis, the access data mentioned above and the ‘web beacons’ are linked to your email address and a unique ID.

The following data is collected in the process:
• Email address
• Opening of the newsletter
• Time at which the newsletter was opened
• Clicking on links provided in the newsletter

If you have voluntarily provided us with further data when subscribing to our newsletter or by other means, this data will also be processed alongside the data mentioned above.
• Title
• First name
• Surname
• Company name
• Telephone number
• IP address
• Time of registration and confirmation
• Location

By subscribing to our newsletter, you consent to the processing of your personal data as described above. Please note that we can only send you our newsletter and invitations to events with your express consent. If you do not agree to the processing of your data to the extent set out in the privacy policy and do not give your consent, we will unfortunately be unable to send you our newsletter and invitations to events.

Applications

You have the option to apply online for advertised vacancies. In this context, we process the personal data you provide as part of your online application. The legal basis for this processing is Article 88 of the GDPR in conjunction with Section 26 of the BDSG. Please note: When you click on the job description, you will be redirected to our careers page. You can find all further information regarding the processing of your personal data on our careers page or at: recruitingapp-5620.de.umantis.com/Vacancies/459/DataProtection/1. As part of our careers management, we work with a service provider. We have concluded a supplementary agreement with this provider regarding data processing in accordance with Article 28 of the GDPR.

Video conferences and digital events

We use video conferencing services in connection with certain events and/or other services that we offer.
In this context, personal data relating to you is also processed. The legal basis for the processing of personal data in this case is the participant’s consent in accordance with Article 6(1)(a) of the GDPR.

To use a video conferencing service, we rely on solutions provided by an external provider. We have entered into a GDPR-compliant data processing agreement with this provider. In this context, we have also stipulated that the data collected directly during online meetings (such as video, audio and conversation content) is processed within the EU. Insofar as any additional data is processed in the USA, we cannot rule out the possibility that US intelligence agencies may access this data within the scope of their legal powers. Insofar as you give us your consent to the processing of your personal data in the context of video conferences and/or digital events, you also consent to any potential access to this data by US intelligence agencies. As a participant in a video conference, you can decide for yourself to what extent your audio and video data is processed. If you do not wish this to happen, please disable the camera and microphone functions on the device you are using to take part. You can also prevent your real name from being processed by using a pseudonym. Unless you take these measures, when you take part in a video conference, the data you provide – such as your surname, first name, the email address you have provided, your company, a login password, and, if dialling in by telephone, your telephone number, video, audio and text data (if using the chat function), the start, duration and end of the meeting, the date and time of the meeting, and the IP address of the participating device – will generally be processed. Where we process personal data in the context of events, this processing may also be based on Article 6(1)(f) of the GDPR. This applies, for example, when we analyse participation in our events with regard to the use of our services.

Cookies

This website and all its subpages use cookies and other similar tracking technologies, such as web beacons or Local Storage Objects (LSOs).
Cookies are text files that are stored on your device. When you visit the website, cookies may be read, transmitted and modified by the website.
We use both ‘first-party cookies’ – i.e. cookies controlled by the company that operates the domain on which the cookies are set – and ‘third-party cookies’. The latter are controlled by third parties and help us to analyse the impact of our website content and the interests of our visitors, to measure the performance of our website, or to display targeted advertising and other content on our website or other websites.

Most of the cookies we use are known as ‘session cookies’. They are automatically deleted at the end of your visit or your browser session (so-called transient cookies). Other cookies remain stored on your device for a specified period, or until you delete them (so-called persistent cookies). These cookies enable us to recognise your browser the next time you visit. We only use cookies with random, pseudonymous identification numbers. These identification numbers are used to analyse your usage behaviour on our website. At no point is the usage profile linked to the name of a natural person. If you use specific features of our website (such as the shopping basket or ‘stay logged in’), cookies are also used for these features. Tracking pixels are tiny image files used to retrieve data from your device, such as your device type, operating system, IP address or the time of your visit. Local Storage Objects (LSOs) work in a similar way to cookies. However, the information is stored locally within the browser. Insofar as the cookies and other technologies are technically necessary for the operation of the website, the legal basis for their use and the associated processing of your personal data is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interests in this regard lie, in particular, in being able to provide you with a technically optimised, user-friendly and needs-based website, as well as in ensuring the security of our systems. The use of cookies and other technologies that are not technically necessary for the operation of the website and which primarily serve analytical and marketing purposes, as well as the associated processing of your personal data, takes place in accordance with Article 6(1)(a) of the GDPR only if you have given us your explicit consent. The first time you visit our website or one of its subpages, a so-called cookie banner will inform you about the cookies and other technologies used on the website, and you will be given the opportunity to choose for yourself which of the cookies and other technologies requiring consent you wish to give your consent to. Via the cookie banner, you can also find out about the individual functions of the cookies at any time or view our detailed privacy policy by clicking the ‘Privacy Policy’ button. You may withdraw your consent at any time.

Consent Management

On our website, we use the consent management tool provided by iubenda s.r.l., Via San Raffaele, 1 – 20121 Milan, Italy, to inform you about the cookies and third-party services used on our website and to fulfil our legal obligation to obtain your consent to the use of cookies and third-party services that are not necessary for the operation of the website.

As part of the process of recording the consents you have given, the following data is collected and transmitted to iubenda:
• anonymised IP address
• date and time of the visit
• device and browser information
• information regarding the consent preferences you have selected.

The legal basis for the processing of your personal data in the context of consent management is, in accordance with Article 6(1)(c) of the GDPR, our legal obligation to obtain your consent to the use of cookies and third-party services that are not necessary for the operation of the website.
Iubenda processes your data on our instructions as part of a data processing arrangement. We have concluded a supplementary agreement with Iubenda regarding data processing in accordance with Article 28 of the GDPR.

Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Inc. (‘Google’). Google Analytics uses so-called ‘cookies’, which are text files stored on your computer that enable an analysis of your use of the website. The cookies contain information regarding interactions that are tracked whilst you are using the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. US intelligence agencies may gain access to this data within the scope of their extensive, statutory surveillance powers. According to Google, your IP address is to be truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area by means of automatic IP anonymisation before it is processed in the USA. However, your full IP address may also be transmitted to a Google server in the USA, meaning that US intelligence agencies may gain access to this data.

On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet usage. In addition, Google carries out its own processing – the nature of which is not specified by Google – for the purpose of providing and safeguarding the Analytics service. However, we have not shared any data with Google for its own processing purposes, in accordance with the data sharing settings.

We track the following events if you have consented to the use of Google Analytics:
• first visit
• start of a session,
• user engagement (the website is in focus for at least one second)
• bounces
The following parameters are recorded by default for each event:
• language,
• page_location,
• page_referrer,
• page_title and
• screen_resolution.

You can prevent cookies from being stored by adjusting the settings in your browser; however, please note that, in this case, you may not be able to make full use of all the features of this website. You can also disable Google Analytics via the cookie settings.
The legal basis for our data collection using Google Analytics is your consent in accordance with Article 6(1)(a) of the GDPR, which you may withdraw at any time with future effect using the procedure described above. Your data will be automatically deleted after 12 months. Data that has reached the end of its retention period is automatically deleted once a month.

Further information on Google Analytics and data protection is available on the website: policies.google.com/privacy

Google Maps

To provide a clearer illustration, we embed a map on our website which is provided by Google Inc. via the Google Maps API. When you view the map, a connection is established with the Google server, during which, amongst other things, your IP address is transmitted to Google. Google may analyse how website visitors use the Google Maps function. Furthermore, Google has the ability to set and read cookies. These cookies may be Google user cookies that are directly linked to you as an individual.
The legal basis for the use of Google Maps is your consent, in accordance with Article 6(1)(a) of the GDPR.

Further information on Google Maps can be found in Google’s Privacy Policy and Terms of Service: policies.google.com/privacy

Youtube

The website uses videos and plug-ins provided by the service provider YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is legally represented by Google Inc., with its registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. As soon as a video is displayed on our website – even if only as a still image – a connection is established with the YouTube server, through which the service receives various data. This data includes your computer’s IP address, any cookies already stored on your computer, and information stored during previous interactions with YouTube. If no data has yet been stored, the service will store cookies on your computer for the first time. When contacting YouTube, the service also receives information about any user account you may have with YouTube. Further information relating to your interaction with the video, such as clicking the play, pause or stop buttons, is also transmitted to the provider. You can stop data processing by visiting a page without a video and deleting all cookies from your computer.
The legal basis for the use of YouTube videos is your consent, in accordance with Article 6(1)(a) of the GDPR.

Further information on data processing and YouTube’s privacy policy can be found at policies.google.com/privacy

Hubspot Analytics

We use HubSpot Analytics Tracking on our website, an analytics service provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA. HubSpot Analytics Tracking utilises what is known as a tracking pixel. The information generated by the tracking pixel regarding the use of our website is generally transmitted to a HubSpot server in the USA and stored there. The data is transferred to HubSpot in order to gather insights into our advertising campaigns, so that we can measure the effectiveness of our adverts and continuously improve the website’s content and technical features in line with user needs. The legal basis for the use of HubSpot Analytics Tracking is your consent, in accordance with Article 6(1)(a) of the GDPR. You may withdraw this consent at any time with future effect.

Further information on data protection and cookies from HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, can be found at: legal.hubspot.com/privacy-policy

Zreality Analytics

As part of Virtual Topwerk, we use the service provided by Zreality Analytics GmbH, Zollamtstr. 11, 67663 Kaiserslautern, based on the open-source software tool Matomo, to analyse our users’ browsing behaviour. If you are simply visiting our website and not using Virtual Topwerk, you are not affected by this data processing.

The following information is collected when using Zreality:
• approximate location
• operating system, browser
• number of visits
• which page was visited
• how long the visitor spent on that page
• what was clicked on the page.

The software runs exclusively on servers operated by our service provider, Zreality, within the European Union. This data is stored solely there and is not transferred to any other third parties. The software is configured so that IP addresses are not stored in full; instead, the last two bytes of the IP address are masked (e.g. 192.168.xxx.xxx). This means it is no longer possible to link the truncated IP address to the computer accessing the site. No other personal data is collected. Furthermore, no methods for recognising users (e.g. cookies) are used for analytical purposes. If, however, you do not agree to the use of this service, you can deactivate tracking via the following link: analytics.zreality.com/index.php (opt-out).

The legal basis for the use of Zreality is our legitimate interest, in accordance with Article 6(1)(f) of the GDPR.

Google Tagmanager

On this website, we use Google Tag Manager, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (‘Google’), to control which scripts are executed on our website. Google Tag Manager enables the management of website tags via a user interface; Google Tag Manager is used exclusively to implement tags without using cookies and without collecting personal data. Google Tag Manager triggers other tags that can be used to collect data, without Google Tag Manager itself accessing this data. To monitor the stability and performance of our system, Google Tag Manager collects some aggregated data on tag firing. However, this data does not contain users’ IP addresses or user-specific IDs, meaning it cannot be linked to a specific individual.
When using Google Tag Manager, personal data such as your IP address may, however, be transferred to Google in the USA. For this reason, we only use Google Tag Manager with your express consent. The legal basis for the processing of your personal data in connection with the use of Google Tag Manager is your consent, in accordance with Article 6(1)(a) of the GDPR. You have the right to withdraw your consent at any time, without giving reasons, with effect for the future.

For further information on Google Tag Manager, please visit www.google.com/intl/de/tagmanager/use-policy.html.

Social media profiles

As part of our social media presence, we maintain a company page on the following social media platforms:
• LinkedIn
 

If you visit our company page on the relevant social media platform, your personal data may be processed.
LinkedIn: For the processing of personal data in connection with our LinkedIn page, we are a joint controller with LinkedIn Ireland Unlimited Company (“LinkedIn”), Wilton Plaza, Gardner House 4, 5, 6, 2 Dublin, Ireland. If you visit our LinkedIn page and interact with our content, we may process your personal data – such as your username, the content you have published on LinkedIn, and your reactions to our company’s content – in order to respond to it or to mention your account or your content in content published by us. LinkedIn Ireland Unlimited Company (“LinkedIn”), Wilton Plaza, Gardner House 4, 5, 6, 2 Dublin, Ireland, is responsible for the further processing of personal data in connection with the use of LinkedIn. Among other things, LinkedIn processes the data you voluntarily provide whilst using your LinkedIn account, such as your name, username, email address and telephone number. If you post and share content on LinkedIn, LinkedIn may analyse this to identify the topics you are interested in, in order to provide you with information on similar content and, where applicable, advertising. In addition, LinkedIn also collects so-called log data, such as your IP address, your browser type, the operating system you use, information about the website you visited previously and the pages you have accessed, your location, your mobile network provider, the device you are using, the search terms you have used and cookie information. Please note that this data is processed by LinkedIn even if you do not have a LinkedIn account. If you do have a LinkedIn account, you may be able to restrict the processing of your personal data by LinkedIn via your LinkedIn account settings.
We have no knowledge of, nor any influence over, the scope and nature of the data processing, or the further processing and use of your personal data by LinkedIn.

Further information on data processing by LinkedIn can be found at: de.linkedin.com/legal/privacy-policy

We expressly draw your attention to the fact that, when using LinkedIn, personal data may be transferred to a country outside the EU/EEA – a so-called third country – where the level of protection provided by the GDPR with regard to personal data cannot be guaranteed.