Name and contact of the Controller pursuant to Art. 4(7) GDPR
HZG Management GmbH & Co. KG
Mauer 14
96450 Coburg
Germany
Phone: +49 (0)9561 745-910
E-Mail: info@hzg-group.com
Contact of Data Protection Officer: datenschutz@hzg-group.com
Security and protection of your Personal Data Our top priority is to ensure the confidentiality of the Personal Data you provided, and to protect these data from unauthorized access. For this reason, we make every effort and use the most state-of-the-art security standards to ensure maximum protection of your Personal Data.
As a company under private law we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the German Data Protection Act (Bundesdatenschutzgesetz – BDSG). We have taken all technical and organizational measures to make sure that all regulations regarding data protection are observed both by us and by our external service providers.
Definition of terms
The legislation requires Personal Data to be processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”). To ensure this, we inform you on the individual legal definitions of terms, which are also used in this Data Privacy Statement:
1. Personal Data
Personal Data means any information relating to an identified or identifiable natural person (hereinafter “Data Subject”); an identifiable person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of such a natural person.
2. Processing
Processing means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
3. Restriction of Processing
Restriction of Processing means the marking of stored Personal Data with the aim of limiting their Processing in future.
4. Profiling
Profiling means any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
5. Pseudonymization
Pseudonymization means the Processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.
6. Filing System
Filing System means any structured set of Personal Data which is accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.
7. Controller
Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data; where the purposes and means of Processing are determined by Union or Member State law, the Controller or the specific criteria for their nomination may be provided for by Union or Member State law.
8. Processor
Processor means a natural or legal person, public authority, agency, or any other body which processes Personal Data on behalf of the Controller.
9. Recipient
Recipient means a natural or legal person, public authority, agency, or any other body to whom Personal Data are disclosed, whether a Third Party or not. However, public authorities which may receive Personal Data in the course of a particular inquiry in accordance with Union or Member State law shall not be regarded as Recipients; the Processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the Processing.
10. Third Party
Third Party means a natural or legal person, public authority, agency, or body other than the Data Subject, Controller, Processor and persons who, under the direct authority of the Controller or Processor, are authorized to process Personal Data.
11. Consent
Consent is any freely given, specific, informed and unambiguous indication of a Data Subject’s wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.
Lawfulness of processing
The Processing of Personal Data will only be lawful if there is a legal basis for this Processing. The legal basis for Processing according to Article 6(1)(a–f) GDPR can be in particular:
a) the Data Subject has given Consent to the Processing of his or her Personal Data for one or more specific purposes;
b) Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;
c) Processing is necessary for compliance with a legal obligation to which the Controller is subject;
d) Processing is necessary in order to protect the vital interests of the Data Subject or of another natural person;
e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
f) Processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a Third Party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data, in particular where the Data Subject is a child.
Information regarding the collection of Personal Data
(1) In the following we are going to inform you about the collection of Personal Data when using our website. Personal Data include, for example, name, address, email addresses, user behavior.
(2) If you contact us via email or a contact form, we will save the data you provided to us (your email address; your name and telephone number (if available)) to respond to your inquiries. We will delete the data acquired in this context as soon as their storage is no longer required, or their Processing will be restricted if they are subject to legal retention obligations.
Collecting Personal Data during the visit of our website
f the website is used for information only, i.e., you neither register nor otherwise transmit information to us, we will collect only the Personal Data transmitted by your browser to our server. If you wish to view our website, we collect the following data technically required to display the website to you as well as to ensure stability and security (the legal basis is Art. 6(1)(1)(f) GDPR):
• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Access contents (concrete page)
• Access status/HTTP status code
• The respective data volume transmitted
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software
Purpose limitation of Personal Data Processing
(1) We process the data you provide in accordance with the principles of data minimization and purpose limitation. According to the principle of purpose limitation, Personal Data shall be collected for specified, explicit, and legitimate purposes and not be further processed in a manner that is incompatible with those purposes. Further Processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered to be incompatible with the initial purposes.
(2) We generally process your Personal Data for the purpose of replying to your requests, processing your orders, or providing access to certain information or offers. To maintain customer relationships it may also be necessary for us or a service provider commissioned by us to use these data to inform you about product offers or to conduct online surveys in order to better fulfill our customers' tasks and requests.
(3) We will only use the Personal Data you provide online for the purposes we informed you about. Your Personal Data will not be forwarded to Third Parties unless you have expressly given your Consent. Personal Data are collected and transferred to the respective entitled national institutions and authorities in strict accordance with the relevant legislation and/or as per court order.
(4) If you choose not to have your data used to support our customer relationship (especially direct marketing or market research), we will, of course, respect your choice. We shall neither sell your Personal Data to Third Parties nor shall we otherwise market them, unless you have granted us your Consent to do so.
Data erasure and storage
(1) Your data will only be stored until the purpose for which they were collected has been achieved and they are not subject to any other legal retention obligations (e.g., retention obligations relating to tax and commercial law).
(2) If you have granted us your Consent, we will store your data until you revoke your Consent, provided that there is no other legal basis for the Processing of your data, and no statutory retention periods stand in the way of the erasure.
(3) Moreover, a longer retention may be necessary in individual cases, e.g., for evidential purposes for the defense against/enforcement of claims under civil or public law.
Use of cookies
(1) In addition to the above mentioned data, cookies will be stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive allocated to the browser you use, and with the help of which the body that places the cookie obtains certain information. Cookies cannot run programs or deliver viruses to your computer. They are aimed at making the website generally more user-friendly and more efficient.
(2) This website uses the following types of cookies; their scope and function will be explained in the following:
Transient cookies (see a.)
Persistent cookies (see b.).
a) Transient cookies will be deleted automatically as soon as you close your browser. This group includes session cookies in particular. They store a so-called session ID that allows for the allocation of different requests from your browser to the common session. Due to this, your computer can be recognized when you return to our website. The session cookies will be deleted as soon as you log out or close your browser.
b) Persistent cookies will be deleted automatically after a specified period that can differ depending on the cookie. You can delete the cookies at any time in the security settings of your browser.
c) You can configure your browser settings as desired, i.e., to block third-party cookies. “Third-party cookies” are cookies that have been placed by a Third Party, i.e., not by the website you are actually visiting. Please note that if you disable cookies, you may no longer be able to use all of the features of this website to their full extent.
d) We use cookies to be able to identify you during subsequent visits if you have an account on our website. Otherwise, you will have to log in again for every visit.
Other functions and offers of our website
1) Along with the use of our website for information purposes only, you have a number of different services at your disposal. If you wish to make use of these, you normally have to indicate additional Personal Data that will be used to provide the respective service and that will be treated in accordance with the previously specified principles of data Processing.
(2) We partly use external service providers for Processing your data. These service providers have been carefully selected and commissioned, are bound by our instructions, and are subject to regular checks.
(3) Furthermore, we can pass on your Personal Data to Third Parties if campaigns, sweepstakes, contract conclusions, or similar activities are provided by us jointly with our partners. You will obtain further relevant information when you submit your Personal Data or in the description of the offer below.
(4) If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you about the consequences of this circumstance in the description of the offer.
YouTube videos
Our websites contain so-called embeddings of YouTube videos. However, they only allow the connection to YouTube. YouTube is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; in the European Economic Area and in Switzerland, the service is provided by Google Ireland Limited based in Gordon House, Barrow Street, Dublin 4, Ireland (in the following referred to as “Google”).
In this context, we use the “extended data protection mode” option provided by YouTube.
f you access an embedded video, a connection will be established to the YouTube servers and, in doing so, the contents will be displayed on the website via the notification to your browser.
According to YouTube, if the “extended data protection mode” is used, your data (e.g., IP address) will be transmitted to the YouTube server in the USA only if you watch the video. By clicking on the video, you give your Consent to such transmission.
If you are logged into YouTube at the same time, this information can be associated with your YouTube member account. You can prevent this by logging out of your YouTube account before accessing our website.
By embedding YouTube, we aim to show you different videos that you can watch directly on our website.
The legal basis for the Processing of Personal Data as described here is Art. 6(1)(1)(f) GDPR. Our legitimate interest required in this regard consists in the significant benefit offered by YouTube. By embedding external videos, we reduce the load on our servers and can use the respective resources for other purposes. This can, among others, increase the stability of our servers. YouTube and/or Google additionally has a legitimate interest in the (Personal) data collected to improve its own services.
If a respective Consent to using and/or saving cookies has been requested and provided, the Processing will take place exclusively on the basis of Art. 6(1)(1)(a) GDPR. You can withdraw your Consent at any time with effect for the future by clicking on the cookie settings. In this case, an opt-out cookie that prevents the collection of your data during future visits of this website will be set.
For more information, please refer to the privacy policy of YouTube and Google, which you can find under this link: www.google.com/policies/privacy/
Notes on the privacy settings of Google are provided here: https://privacy.google.com/take-control.html?categories_activeEl=sign-in
Use of Matomo (formerly known as Piwik)
1) This website uses the web analytics service Matomo to analyze the use of our website and to regularly improve it. The statistics acquired help us to enhance our website and to make it more interesting for you as a user. The legal basis for the use of Matomo is Art. 6(1)(1)(f) GDPR.
(2) The cookies will be stored on your computer for this analysis. The Controller stores the information obtained this way only on their server in Europe. You can prevent the analysis by deleting the existing cookies and by blocking the saving of cookies. Please note that if you prevent the cookies from being stored, you may no longer be able to use this website to the full extent.
(3) This website uses Matomo with the “AnonymizeIP” extension. Due to this, the IP addresses are further processed in a shortened form; any direct reference to a person is thus no longer possible. The IP address transmitted by your browser by means of Matomo will not be merged with any other data we have collected.
(4) The Matomo program is an open-source project. Information of the third-party provider regarding data protection can be found at matomo.org/privacy-policy/.
Children
Our website is generally designed for an adult audience. Persons below the age of 16 should not transmit Personal Data to us without the Consent of their parents or legal guardians.
Rights of the Data Subject
1) Revocation of Consent
If the Processing of Personal Data is based on a Consent granted, you have the right to revoke your Consent at any time. The revocation of Consent does not affect the legality of Processing carried out until the revocation on the basis of the Consent granted.
To exercise the right of revocation, you can contact us under our postal address: HZG Management GmbH & Co. KG, Mauer 14, 96450 Coburg, Germany, or send us an email to datenschutz@hzg-group.com at any time.
(2) Right of confirmation
You have the right to obtain from the Controller confirmation as to whether or not Personal Data concerning you are being processed. You can request that confirmation at any time using the contact data specified above.
(3) Right of access
Pursuant to Art. 15 GDPR, if your Personal Data are being processed, you have the right to request information about these Personal Data and the following information at any time:
A) the purpose of the Processing ;
b) the categories of Personal Data concerned;
c) the Recipients or categories of Recipients to whom the Personal Data have been disclosed or will be disclosed, in particular Recipients in third countries or international organizations;
d) where possible, envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the Controller rectification or erasure of Personal Data or Restriction of Processing of Personal Data concerning the Data Subject or to object to such Processing;
f) the existence of the right to lodge a complaint with a supervisory authority;
g) where the Personal Data are not collected from the Data Subject, any available information as to their source;
h) the existence of automated decision-making, including Profiling, according to Art. 22(1, 4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject.
Where Personal Data are transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer. We will provide you a copy of the Personal Data undergoing Processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make your request by electronic means, and unless otherwise requested, the information shall be provided in a commonly used electronic format. The right to obtain a copy referred to in Paragraph 3 shall not adversely affect the rights and freedoms of others.
To exercise the right of access, you can contact us under our postal address: HZG Management GmbH & Co. KG, Mauer 14, 96450 Coburg, Germany, or send us an email to datenschutz@hzg-group.com at any time.
(4) Right to rectification
Pursuant to Art. 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate Personal Data concerning you. Taking into account the purposes of the Processing, you have the right to have incomplete Personal Data completed – including by means of providing a supplementary statement.
You can assert your right using the contact data specified above.
(5) Right to erasure (“right to be forgotten”)
Pursuant to Art. 17 GDPR, you have the right to obtain from the Controller the erasure of Personal Data concerning you without undue delay, and we shall have the obligation to erase Personal Data without undue delay where one of the following grounds applies:
a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the Data Subject withdraws Consent on which the Processing is based according to Art. 6(1)(a) or Art. 9(2)(a) GDPR and where there is no other legal ground for the Processing;
c) the Data Subject objects to the Processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the Processing, or the Data Subject objects to the processing pursuant to Art. 21(2) GDPR;
d) the Personal Data have been unlawfully processed;
e) the Personal Data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject;
f) the Personal Data have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.
Where the Controller has made the Personal Data public and is obliged pursuant to Paragraph 1 to erase the Personal Data, the Controller, taking into consideration available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform Controllers which are processing the Personal Data that the Data Subject has requested the erasure by such Controllers of any links to, or copy or replication of, those Personal Data.
The right to erasure (“right to be forgotten”) shall not apply to the extent that Processing is necessary:
• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires Processing by Union or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
• for reasons of public interest in the area of public health in accordance with Art. 9(2)(h, i) as well as Art. 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89(1) GDPR, in so far as the right referred to in Paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that Processing; or
• for the establishment, exercise, or defense of legal claims.
You can assert your right using the contact data specified above.
(6) Right to Restriction of Processing
Pursuant to Art. 18 GDPR, you have the right to obtain from us Restriction of Processing your Personal Data where one of the following applies:
a) the accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Personal Data;
b) the Processing is unlawful and the Data Subject opposes the erasure of the Personal Data and requests the restriction of their use instead
c) the Controller no longer needs the Personal Data for the purposes of the Processing, but they are required by the Data Subject for the establishment, exercise, or defense of legal claims; or
d) the Data Subject has objected to Processing pursuant to Art. 21(1) GDPR pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.
Where Processing has been restricted according to the above-mentioned requirements, such Personal Data shall – with the exception of storage – only be processed with the Data Subject’s Consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
To enforce the right to Restriction of Processing, the Data Subject can get in touch with us at any time using the contact data specified above.
You can assert your right using the contact data specified above.
(7) Right to data portability
Pursuant to Art. 20 GDPR, you have the right to receive the Personal Data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another Controller without hindrance from the Controller to which the Personal Data have been provided, where:
a) the Processing is based on Consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) or on a contract pursuant to Art. 6(1)(b) GDPR; and
b) the Processing is carried out by automated means.
In exercising the right to data portability pursuant to Paragraph 1, you have the right to have the Personal Data transmitted directly from one Controller to another, where technically feasible. The exercise of the right to data portability shall be without prejudice to the right to erasure (“right to be forgotten”). This right shall not apply to Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.
You can assert your right using the contact data specified above.
(8) Right to object
According to Art. 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of Personal Data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to Profiling based on those provisions. The Controller will no longer process the Personal Data unless they can demonstrate compelling legitimate grounds for Processing which override the interests, rights, and freedoms of the Data Subject or for the enforcement, exercise, or defense of legal claims.
Where Personal Data are processed for direct marketing purposes, you shall have the right to object at any time to Processing of Personal Data concerning you for such marketing, which includes Profiling to the extent that it is related to such direct marketing. If you object to Processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
Where Personal Data are processed for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1), you, on grounds relating to your particular situation, shall have the right to object to processing of Personal Data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
To exercise the right to object, you can contact the respective Controller at any time.
You can assert your right using the contact data specified above.
(9) Automated individual decision-making, including Profiling
We refrain from the use of automated individual decision-making, including Profiling.
(10) Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if the Data Subject considers that the Processing of Personal Data relating to him or her infringes this Regulation.
A list of supervisory authorities (for the non-public sector) including addresses is available at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
(11) Right to an effective judicial remedy
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under this Regulation have been infringed as a result of the Processing of your Personal Data in non-compliance with this Regulation.
Changes to our data privacy terms
We reserve the right to change our security and data protection measures where this becomes necessary due to technological development. In these cases, we will also adapt our data privacy information accordingly. Please always refer to the currently applicable version of our Data Privacy Statement. Current status: February 2021.
