We are pleased to welcome you to our website. As the protection of your personal data is particularly important to us, we provide you with comprehensive information below about the data processing that takes place in connection with our website vacupress.de/en/.

As a private company, we are subject to the provisions of the European General Data Protection Regulation (GDPR), the regulations of the Federal Data Protection Act (BDSG), and the Act on Data Protection and Privacy in Telecommunications and Telemedia (TTDSG). We have implemented technical and organizational measures to ensure that data protection regulations are observed by both us and our external service providers.

The legislator requires that personal data be processed in a lawful, fair, and transparent manner (‘lawfulness, fairness, and transparency’). To ensure this, we first inform you in this section about the individual legal definitions that are also used in this privacy policy:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

‘Restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future.

‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

‘Pseudonymization’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

‘Filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis.

‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

‘Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

A ‘third party’ is a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

The processing of personal data is only lawful if there is a legal basis for the processing. According to Art. 6 para. 1 s. 1 lit. a) to f) GDPR, the legal basis for processing may in particular be:

1. The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. Processing is necessary for compliance with a legal obligation to which the controller is subject;
4. Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

In this section, we inform you about what data we process when you use our website for purely informational purposes, i.e., when you do not actively transmit data to us during your visit to our website.

When you view our website, we collect the following data in so-called log files, which are technically necessary for us to display our website to you and to ensure stability and security:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software
• Name of your access provider

We are entitled to collect and store this data pursuant to Art. 6 para. 1 s. 1 lit. f) GDPR, as we have a legitimate interest in the security and stability of our website. They are automatically deleted after seven days at the latest, unless there is a justified suspicion of unlawful action.

In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your end device and through which certain information flows to the party that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They serve to make the Internet offer as a whole more user-friendly and effective.

We use only cookies that are necessary to enable certain functions of our website, to make your visit here as pleasant as possible. These include in particular the so-called session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the common session. This allows your end device to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

We are entitled to use these cookies pursuant to Art. 6 para. 1 s. 1 lit. f) EU-GDPR, as we have a legitimate interest in the functionality and correct display of our website.

Cookies are stored on the user’s computer and transmitted from there to our site. Therefore, as a user, you also have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically.

Of course, you can also access our website without cookies. However, if you want to use our website fully or comfortably, you should accept cookies. Most web browsers are preset to accept cookies by default. However, you have the option to set your browser to display cookies before they are stored, to accept or reject only certain cookies, or to reject cookies generally. Please note that setting changes always only affect the respective browser. If you use different browsers or change the end device, you must make the settings again. In addition, you can delete cookies from your storage medium at any time. Information on cookie settings, how to change them and how to delete cookies can be found in the help section of your web browser.

If you wish to contact us via our contact form, we ask for your explicit consent to process your email address and other data you provide. We are then authorized to process this data according to Art. 6 Para. 1 S. 1 Letter a) GDPR. Of course, your data will be used strictly for the purpose of processing and responding to your inquiry and will be deleted immediately after final processing.

Cloudflare Turnstile (a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) is an automated detection service that helps us verify whether a request was sent by a human or a bot. This detection is necessary to prevent spam messages.

We use Turnstile to ensure the secure use of the contact form. The legal basis for this type of data processing is our legitimate interest in the secure operation of the contact form, Art. 6 Para. 1 lit. f) GDPR.

During this verification query, Cloudflare processes your IP address on Cloudflare servers. Cloudflare processes the data on our behalf based on a data processing agreement between us and Cloudflare. This ensures that the data processing on our behalf is in accordance with the General Data Protection Regulation, guaranteeing the protection of the rights of the data subjects. It may happen that the IP address is transferred to Cloudflare’s American servers. In this case, the standard contractual clauses agreed between us and Cloudflare also apply to safeguard your rights.

Cloudflare has submitted to the Privacy Shield agreement between the European Union and the USA and has been certified. Thereby, Cloudflare commits to comply with the standards and regulations of European data protection law.

For more information on the third-party provider’s privacy policy, please refer to the following website: https://www.cloudflare.com/privacypolicy/

If you contact us by mail, email, telephone, or fax, your inquiry, including all resulting personal data, will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. The processing of this data is based on Art. 6 Para. 1 S. 1 Letter b) GDPR, insofar as your request is related to the fulfillment of a contract concluded with us or is necessary for the implementation of pre-contractual measures. Otherwise, the processing is based on Art. 6 Para. 1 S. 1 Letter f) GDPR, as we have a legitimate interest in the effective processing of requests addressed to us. In addition, we may also be authorized to process the mentioned data according to Art. 6 Para. 1 S. 1 Letter c) GDPR, as we are legally obliged to enable fast electronic contact and immediate communication to or with us.

Of course, your data will be used strictly for the purpose of processing and responding to your inquiry and will be deleted again after final processing, unless there are legal retention obligations for us.

As a matter of principle, we do not pass on your data to third parties without your express consent. We only pass on your personal data to third parties if

• you have given your express consent in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR,
• the disclosure is necessary for the assertion, exercise or defense of legal claims according to Art. 6 Para. 1 S. 1 lit. f GDPR and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data,
• in the event that there is a legal obligation for the transfer according to Art. 6 para. 1 s. 1 lit. c GDPR, as well as
• this is legally permissible and necessary according to Art. 6 para. 1 s. 1 lit. b GDPR for the processing of contractual relationships with you.

Recipients of the data are public authorities that receive data due to legal regulations (e.g., social security providers, tax authorities), internal departments involved in the execution of the respective business processes (human resources, accounting, banking institutions/payment service providers, invoicing, customer service, marketing, sales), for shipping products to the transport company/shipping company commissioned by us, contractual partners, business partners as far as required or permitted by legal provisions.

For this purpose, we work – like any modern company – with processors to provide you with uninterrupted and best possible service.

When we work with external service providers, processing is regularly carried out on the basis of Art. 28 GDPR. For this purpose, we conclude corresponding agreements with our partners to ensure the protection of your data. We only use carefully selected processors for processing your data. These are bound by our instructions and are regularly monitored by us. We only commission external service providers who have ensured that all data processing operations are carried out in accordance with data protection regulations.

The following types of processors may receive personal data:

Website service provider: blanq GmbH, blanq.agency

We currently use various links to different social media platforms, such as Facebook, Instagram and Twitter. These are not social media plugins, but merely links. If you click on one of the links, you will be directed to the respective provider’s website and your IP address will be transmitted. If you are simultaneously logged in to the respective social media account, additional data may be collected by the respective provider under certain circumstances.

On this website, we use the web analytics service Fathom to analyze and check the use of our website. Through the statistics obtained, we can improve our offer and make it more interesting for you as a user.

Fathom does not use cookies. Therefore, no Fathom cookies are stored on your computer for the purpose of web analysis. For the analysis of website usage, your IP address and information such as timestamp, visited web pages and your language settings are collected. The information collected in this way is stored by Fathom on EU servers if you access our site from the EU.

Fathom uses an anonymized evaluation of the data. This means that a SHA256 hash of the data sent by your browser is further processed and direct personal identification is excluded. The IP address transmitted by your browser via Fathom is not merged with other data collected by us. The legal basis for the use of Matomo is Art. 6 para. 1 s. 1 lit. f GDPR.

You can find information on the third-party provider’s privacy policy at https://usefathom.com/legal/privacy.

Our offer is primarily aimed at adults. Persons under 18 years of age should not transmit personal data to us without the consent of their parents or guardians.

There is no legal obligation to provide us with personal data.

Automated decision-making within the meaning of Art. 22 EU GDPR does not take place.

In this section, we inform you about the rights you have regarding your personal data.

If the processing of personal data is based on given consent, you have the right to withdraw this consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

You have the right to obtain confirmation from the controller as to whether we are processing personal data concerning you. You can request confirmation at any time using the contact details provided above.

If personal data is processed, you can request information about this personal data and about the following information at any time:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
4. If possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration;
5. The existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by the controller or a right to object to such processing;
6. The existence of a right to lodge a complaint with a supervisory authority;
7. Where the personal data are not collected from the data subject, any available information as to their source;
8. The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. We shall provide a copy of the personal data undergoing processing. For any further copies requested by you, we may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, and unless otherwise requested, the information shall be provided in a commonly used electronic form. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and we shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

1. The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
2. The data subject withdraws consent on which the processing is based according to point (a) of Article 6(1) or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing.
3. The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
4. The personal data have been unlawfully processed.
5. The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
6. The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

The right to erasure (‘right to be forgotten’) shall not apply to the extent that processing is necessary:

• For exercising the right of freedom of expression and information;
• For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• For reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) GDPR;
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• For the establishment, exercise or defense of legal claims.

You have the right to obtain from us restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims, or
• The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under the aforementioned conditions, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

1. The processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR; and
2. The processing is carried out by automated means.

In exercising your right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability shall be without prejudice to the right to erasure (‘right to be forgotten’). That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), you have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this Regulation.

WITZEL VACUPRESS e.K.
Owner Hendrik Witzel
Max Keith Straße 66
45136 Essen

If you have any questions about data protection or wish to exercise any of your rights, please contact us by post at the above address or by email at privacy@vacupress.de. We will endeavor to process your request as quickly as possible.

Due to the rapid development of the internet and data protection law, we expressly reserve the right to make changes to this privacy policy.