A: Responsible entity
Vendana GmbH, Engelsstraße 6, 42283 Wuppertal, Germany is the entity responsible for the processing of your data (hereinafter: ‘Vendana’, ‘us’ or ‘we’).
B: Contacts regarding data protection
If you have any questions regarding data protection, please contact us at any time at the following email address: firstname.lastname@example.org. In addition, you can contact us at the above-mentioned business address with any data protection requests.
C: Types of data
We process the following categories of data:
This is data we process when you contact us. This may include your name, address and other data that you provide to us.
Data used for communication
Your e-mail address, phone number and mobile phone number, if you provide these to us.
This is data that is transmitted to us when you use our websites. This includes, for example, information about the internet browser you are using, your computer’s operating system, and the time of your page view. IP addresses are not stored by us and are only used by server logs and e-mail headers to prevent spam.
Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted after your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically. You can configure your browser so that you are informed about the inclusion of cookies. You can permit cookies only for individual cases, exclude the acceptance of cookies in certain cases or in general, and activate the automatic deletion of cookies when closing the browser. Disabling cookies may limit the functionality of this present website. For details, see E: Purposes of data processing below.
D: Legal basis for processing the data
- Art. 6 Para. 1 clause 1 (a) of the DSGVO for data processing that is based on your consent.
- Art. 6 Para. 1 clause 1 (b) of the DSGVO for data processing for the purpose of fulfilling the contracts concluded with you and, in the case of contact by you, for the implementation, where appropriate, of pre-contractual measures carried out at your request.
- Art. 6 Para. 1 clause 1 (c) of the DSGVO for data processing that is necessary for the fulfillment of a legal obligation to which we are subject, e.g. in the case of data storage obligations due to commercial and tax regulations.
- Art. 6 Para. 1 clause 1 (f) of the DSGVO for data processing necessary for the protection of our legitimate interests, except where your own interests or fundamental rights and freedoms, which require the protection of your personal data, prevail.
- § 26 of the BDSG (Bundesdatenschutzgesetz) [Federal Data Protection Act] for data processing that is necessary for decisions concerning the establishment of an employment relationship or, after the employment relationship has been established, for its continuation or termination.
E: Purposes of data processing
1.Enquiries and pre-contract activities
If you contact us via our website and, in this connection, provide us with master data or data used for communication (see C: Types of data above), we will process this data only in order to answer your enquiry.
Incoming emails are stored on a web server in Germany rented by us, and are made available to all members of our customer service team via a central email inbox. All personal data contained in the email will be used exclusively to process your described request and, if you so wish, to contact you to process your request. We do not intend that your data be transferred or merged with other sources and it will not be passed on without your consent.
As part of the processing of your request, if a specific enquiry is made in connection with a service offered by us, your relevant data from the email will also be stored in a customer database, to which our customer service staff have access. Relevant data usually consists of your name, your company, at least one contact option (telephone, email or fax), as well as your address (required when we send out a contract).
Once the email has been received and processed, it is saved by means of a read-only email archiving process.
The legal basis for this data processing is Art. 6 para. 1 clause 1 (a) and (c) of the DSGVO.
2. Employment applications
We offer you the opportunity to submit job applications to us (e.g. by email, mail or online application form). Regarding this, we process master data and communication data, as well as any other data that you provide to us in the context of your application, for the purpose of carrying out the application procedure. If your application for employment is successful, we will continue to process your data for the purpose of carrying out the employment relationship.
The legal basis for these data processing operations is Art. 6 para. 1 clause 1 (c) of the DSGVO and § 26 of the BDSG.
3. Technical data
We process technical data in order to provide and operate our websites without errors. We also use this data to optimise our websites. For this purpose, we may also include cookies that are required for technical purposes.
The legal basis for this data processing is Art. 6 para. 1 clause 1 (f) DSGVO, because it is in our legitimate interest to offer you error-free, well-functioning and technically optimised websites.
4. Chat - tawk.to
As an alternative contact method to email, our contact form and telephone, we provide the chat service run by the provider tawk.to Inc. from the USA. In the provider's back end processes, during the session customer advisors can track which pages the visitor is looking at and from which country. In addition, the IP address is displayed and the approximate location of the visitor can be determined. The chat history is also saved.
You can have the chat history sent to you via the chat window and can also save this. Should a specific request arise from the chat, the chat history or a summary of this, as well as the personal data provided – usually your name, and at least one contact method – will be created in our customer database and used exclusively to process your request.
The legal basis for these data processing operations is Art. 6 para.1 clause 1 (b) of the DSGVO.
5. Other cookies
This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.
We have activated the IP anonymisation function on this website. This will truncate your Google IP address within European Union Member States, or in other states that are parties to the Agreement for the European Economic Area, before being sent to the United States. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide further services to the website operator regarding website use and internet use. The IP address provided by your browser as part of Google Analytics will not be merged with other Google data.
Demographic characteristics in Google Analytics
This site uses the ‘demographics and interests’ feature of Google Analytics. This enables reports to be generated that contain information about the age, gender and interests of visitors to the website. This data comes from Google advertising based on users’ interests and visitor data from third-party providers. This data cannot be related back to a specific person. You can disable this feature at any time via the ad settings in your Google account or generally prevent the collection of your data by Google Analytics as described in the Opting out of Google data collection section.
Google Analytics remarketing
This site uses the functions of Google Analytics remarketing in conjunction with the cross-device features of Google Ads and Google DoubleClick. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.
This feature allows the advertising target groups created with Google Analytics remarketing to be linked to the cross-device features of Google Ads and Google DoubleClick. In this way, targeted advertising messages related to your interests, which have been personalised for you based on your previous usage and browsing behaviour on a particular device (e.g. mobile phone), can also be displayed on another of your devices (e.g. tablet or PC).
If you have given your consent to this, Google will link your web and app browsing history to your Google account for this purpose. Thus, the same personalised advertising messages can be posted on any device on which you log in with your Google account.
To support this feature, Google Analytics collects Google-authenticated user IDs that are temporarily linked to our Google Analytics data to define and create target groups for cross-device advertising.
You can permanently opt out of cross-device remarketing/targeting by disabling personalised advertising – just follow this link: https://www.google.com/settings/ads/onweb/.
Google Ads and Google Conversion Tracking
This site uses Google Ads. Google Ads is an online advertising programme. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.
As part of the Google Ads service we use conversion tracking. When you click on an ad placed by Google, a cookie is installed for conversion tracking. Cookies are small text files that the Internet browser places on the user's computer. These cookies lose their validity after 30 days and are not used to identify individual users. If a user visits certain pages of this website and the cookie has not yet expired, both Google and ourselves can see that the user has clicked on the ad and has been redirected to this page.
Each Google Ads customer receives a different cookie. Cookies cannot be tracked through the websites belonging to Google Ads customers. The information collected using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. Customers are informed of the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they will not receive any information that identifies individual users. If you do not wish to participate in this conversion tracking, it is easy to opt out by disabling the Google conversion tracking cookie via your internet browser under User Settings. In this way, you will not be included in the conversion tracking statistics.
Opting out of Google data collection
You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie is set which prevents the collection of your data when you visit this website in the future: Disable Google Analytics.
For more information on how Google Analytics handles user data, see Google's privacy statement: https://support.google.com/analytics/answer/6004245?hl=en.
This website incorporates videos from the YouTube website. The website operator is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.
When you visit one of our websites that includes embedded YouTube content, a connection to YouTube's servers is established. The YouTube server will be informed which of our site pages you have visited.
YouTube can also store various cookies on your device. These cookies enable YouTube to receive information about visitors to this site. This information is used, among other things, to collect video statistics, improve usability and prevent fraud. The cookies remain on your device until you delete them.
If you are logged into your YouTube account, you allow YouTube to map your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.
For more information on how user data is handled, please refer to YouTube's privacy statement at: https://policies.google.com/privacy?hl=en.
The legal basis for the aforementioned Google data processing is your consent in accordance with Art. 6 Para. 1 clause 1 (a) of the DSGVO.
F: Categories of recipients of your data
As far as data collection by Google Ireland Limited is concerned, this data may be transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, a company certified in accordance with the EU-US Privacy Shield.
When using the provider ® tawk.to, the collected data will be transmitted to tawk.to Inc., 187 E Warm Springs Road, Suite B298, Las Vegas, Nevada 89119, USA, and stored there. tawk.to Inc. is a certified company under the EU-US Privacy Shield.
In addition, in the course of processing customer orders, we transmit your personal data to the service providers we use, e.g. for hosting this website.
G: Data transfer to third countries
Insofar as data is transferred from Google Ireland Limited to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, the data is transmitted to the USA. Google LLC is a certified company under the EU-US Privacy Shield.
The data we collect in connection with the service ® tawk.to is stored on the server of the provider tawk.to Inc. in the United States (USA). tawk.to Inc. is a certified company under the EU-US Privacy Shield.
Other than this, we do not transfer your personal data to third countries, i.e. to countries outside the European Union (EU) or the European Economic Area (EEA). If this is necessary, third country data transfers will only be carried out in compliance with the other requirements of Art. 44 et seq. of the DSGVO.
H: Duration of storage/criteria for storage duration
We will store your personal data until the purpose of processing the data (see → E: Purposes of data processing) is no longer applicable. If we are legally obliged to store personal data, this storage takes place for the duration of the legal obligation. For commercial documents, which include trading books and documents (including invoices), these can be stored for up to 10 years (§ 257 para. 4 of the German Commercial Code). Where appropriate, your data will be excluded from ongoing operations during this period, unless there is any other purpose for processing.
We delete data from applicants for employment six months after the end of the application procedure, provided that the application does not result in employment.
The data that is stored in connection with the use of the ® tawk.to service at tawk.to Inc. in the USA is deleted one week after collection, at the latest.
I: Rights of data subjects
Rights in accordance with Art. 15–18, 20 of the DSGVO (Datenschutz-Grundverordnung)
At reasonable intervals, you have the right to request information from us about the personal data we hold about you (Art. 15, DSGVO). Upon request, we will provide you with a copy of the data that is the subject of the data processing.
In addition, you have the right to ask us to correct any data we hold about you that is incorrect (Art. 16, DSGVO).
You also have the right to request that we delete your personal data (Art. 17, DSGVO). We are obliged to delete your data if your personal data is no longer required for the purposes for which it was collected or otherwise processed, if you have withdrawn a consent that you previously gave, or if the data has been collected or used unlawfully (other reasons may apply).
Under certain conditions, you have the right to restrict the processing of your personal data (Art. 18, DSGVO). This includes your right to challenge the accuracy of your personal data. In these circumstances we are obliged to review your objection. In this case, your data must not be processed by us any further (with the exception of storage) until the question of accuracy has been clarified.
You have the right to ask for a copy of the data you have provided to us on the basis of your consent or due to a contractual relationship with us. This will be provided in a machine-readable format to you, or – if you prefer – to a third party (right of data portability, Art. 20, DSGVO).
No contractual or legal obligation to provide the data/consequences of non-provision of data
You are not contractually or legally obliged to provide us with your personal data. Please note, however, that you may not be able to enter into contracts with us if we are not allowed to process the data we need for the purposes mentioned (see → E: Purposes of data processing).
Right to object at any time, pursuant to Art. 21, DSGVO
If the processing of your data by us is based on the performance of a task which is in the public interest, or if it is carried out under the exercise of official authority (Art. 6 para. 1 clause 1 (e) of the DSGVO) or if the data processing is based on legitimate interests on our part, you have the right to object at any time to the processing of your personal data, for reasons that arise from your particular situation. We will then stop processing your data unless we can prove compelling legitimate grounds for processing that outweigh your interests in terminating the processing.
You may object to the processing of your personal data for the purposes of direct marketing at any time, without any restrictions.
Right to withdraw consent at any time
If the data processing carried out by us is based on your consent, you have the right to withdraw your given consent at any time. The legality of the processing carried out on the basis of your consent until the time it is withdrawn remains unaffected by the withdrawal of consent.
Right to complain to a supervisory authority
You have the right to complain to the supervisory authority responsible for our company at the following address:
The State Commissioner for Data Protection, North Rhine-Westphalia
Status as at: April 2020