Privacy policy.
I. OUR WEBSITE IS CURRENTLY BEING REVISED
II. GENERAL INFORMATION
In accordance with Art. 13 DSGVO, we inform you below about the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behaviour.
The responsible party pursuant to Art. 4 (7) of the EU General Data Protection Regulation (DSGVO) is hmf GmbH, Rheinkaistr. 30, 68159 Mannheim, Germany.
https://www.hmf-group.com/de/impressum.
You can reach our data protection officer at: Bugl & Kollegen Gesellschaft für Datenschutz und Informationssicherheit mbH, Alexander Bugl, Sedanstraße 7, 93055 Regensburg, e-mail: kontakt@buglundkollegen.de
III. VISITING THE WEBSITE
In the case of purely informational use of the website, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request came
- Browser
- Operating system and its interface
- Language and version of the browser software
Under certain circumstances, we also use a further service provider in order to be able to display the data protection declaration. In this case, an embedding code is used, via which your IP address is transmitted to the said service provider. We process your data on the basis of our legitimate interest for a limited period of time, in order to initiate a derivation to personal data in the event of unauthorised access or attempted access to local servers and in order to be able to properly present the data protection declaration (Art. 6 Para. 1 lit. f DSGVO).
IV. HOSTING
The hosting services used by us serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services, which we use for the purpose of operating this online offer.
In doing so, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta data and communication data of customers, interested parties and visitors of this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer pursuant to Art. 6 (1) lit. f DSGVO in conjunction with Art. 28 DSGVO (conclusion of a contract). Art. 28 DSGVO (conclusion of order processing agreement).
V. CONTACT
a. Type and purpose of processing
On our website, we provide contact details such as addresses, telephone numbers and e-mail addresses to enable you to contact us quickly and communicate directly with us and the contact persons working for us. When you contact us, we process the personal data you provide us with depending on the means of communication you choose. This may include your full name, address, the telephone number used, the e-mail address used and other personal data that you provide to us in the course of the communication.
b. Legal basis of the processing
The processing of your personal data is based on a legitimate interest (Art 6(1)(f) DSGVO). By providing the contact details, we would like to enable you to contact us in an uncomplicated manner. The information you provide will be stored for the purpose of processing the enquiry and for possible follow-up questions. If you contact us to request a quotation, the data provided will be processed to carry out pre-contractual measures (Art 6 (1) (b) DSGVO).
c. Data categories
E-mail address, telephone number, surname, first name, address, your message.
d. Recipients
Recipients of the data are internal employees of hmf GmbH.
e. Storage periods
Data will be deleted at the latest 6 months after the enquiry has been processed. If a contractual relationship arises, we are subject to the statutory retention periods according to the German Commercial Code (HGB) and will delete your data after these periods have expired.
f. Legal / contractual requirement
The provision of your personal data is voluntary. However, we can only process your request if you provide us with your name, e-mail address and the reason for the request.
g. Third country transfer
Processing will not take place outside the European Union (EU) or the European Economic Area (EEA).
h. Option to object
You have the option to object to the processing of your personal data at any time. You can notify us of your revocation at any time using the contact option provided at the beginning of this privacy notice.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision making or profiling in this data processing.
VI. YOUR RIGHTS
If personal data is processed by you as a user, you are considered a data subject in accordance with the GDPR. Data subjects are entitled to the following rights vis-à-vis the controller:
- Right to information (Art. 15 DSGVO).
- Right to rectification or erasure of personal data (Art. 16, 17 DSGVO)
- Right to restriction of processing (Art. 18 DSGVO)
- Right to communication in connection with the rectification or erasure of your personal data or the restriction of processing (Art. 19 DSGVO)
- Right to data portability (Art. 20 DSGVO)
- Right to object (Art. 21 DSGVO)
- Right to revoke declarations of consent given. The lawfulness of the data processing carried out until the revocation remains unaffected due to the consent valid to date. (Art. 7 para. 3 DSGVO)
- Right to complain to the supervisory authority (Art. 77 DSGVO)
Contact details of the supervisory authorities in the individual countries
VII. USE OF COOKIES
In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive in relation to the browser you are using and which provide the party setting the cookie (in this case, us) with certain information. They are used to make the website as a whole more user-friendly and effective.
We distinguish between two categories of cookies: (a) essential cookies, without which the functionality of our website would be limited and (b) optional cookies for the purposes of website analysis and marketing.
The use of optional cookies is based on your consent (Art. 6 para. 1 lit. a DSGVO).
VIII. GOOGLE TAG MANAGER
a. Type and purpose of processing
Use of Google Tag Manager: Google Tag Manager is a solution that allows marketers to manage website tags through one interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager: http://www.google.de/tagmanager/use-policy.html.
b. Legal basis of the processing
The processing of the entered data is based on the user’s consent (Art. 6 para. 1 lit. a DSGVO).
c. Data categories
IP address, device-related data
d. Recipients
The recipients of the data are internal employees of hmf GmbH and Google as an order processor. We have concluded the corresponding order processing contract with Google for this purpose.
e. Storage periods
Data is only processed in this context as long as the corresponding consent has been given. Afterwards, they will be deleted, provided that there are no legal storage obligations to the contrary. To contact us in this context, please use the contact details provided at the beginning of this privacy policy.
f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.
g. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google.
h. Revocation of consent
You can revoke your consent to the storage of your personal data at any time with effect for the future. You can notify us of your revocation at any time using the contact option provided at the beginning of this privacy notice.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.
i. Profiling
The Google Tag Manager tool can be used to evaluate the behaviour of visitors to the website and analyse their interests.
IX. GOOGLE ANALYTICS
a. Nature and purpose of processing
This website uses Google Analytics, a web analytics service provided by Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. However, due to the activation of IP anonymisation on these websites, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The purpose of the data processing is to evaluate the use of the website and to compile reports on activities on the website. Further associated services are then to be provided on the basis of the use of the website and the internet.
b. Legal basis of the processing
The processing of the entered data is based on the user’s consent (Art. 6 para. 1 lit. a DSGVO).
c. Data categories
IP address (shortened/anonymised)
Device-related data
d. Recipients
Employees of the IT and marketing department of the own company
Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland
e. Storage periods
Data will only be processed in this context as long as the relevant consent has been given. Afterwards, they will be deleted, unless there is a legal obligation to retain them. To contact us in this context, please use the contact details provided at the beginning of this privacy policy.
f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.
g. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google (Analytics).
h. Revocation of consent
You can revoke your consent to the storage of your personal data at any time with effect for the future. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. In addition, you can prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) to Google as well as the processing of this data by Google by downloading and installing the available browser plugin: “Browser Add On to deactivate Google Analytics”.
i. Automatic decision-making and profiling
The tracking tool Google Analytics can be used to evaluate the behaviour of visitors to the website and analyse their interests. For this purpose, we create a pseudonymous user profile.
X. GOOGLE ADSENSE
a. Nature and purpose of the processing
Our website markets space for third-party ads and ad networks through Google AdSense. These ads are displayed to you in various places on this website. As part of the integration of Google AdSense, the so-called DoubleClick cookie is set by Google. This enables the display of interest-based advertising by automatically assigning a pseudonymous UserID, which is used to determine interests based on visits to this and other websites.
b. Legal basis of the processing
The processing of the entered data is based on the user’s consent (Art. 6 para. 1 lit. a DSGVO).
c. Data categories
IP address, device-related data
d. Recipients
Recipients of the data are internal employees of hmf GmbH and Google as an order processor.
e. Storage periods
After the end of the purpose and the end of the use of Google AdSense by us, the data collected in this context will be deleted.
f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. Without the provision of your personal data, we cannot grant you access to our offered content and services.
g. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google.
h. Revocation of consent
You can revoke your consent at any time with effect for the future by deactivating the DoubleClick cookie via this link (https://adssettings.google.com/anonymous?hl=de&sig=ACi0TCiQj7_kyeO4KdQrjW2uJ2rjXLgQyh-Ls2YBTbtD82FXxsoTg62miEXjsSuE0z2Lq9vX4KSi1WF-QHZiA8vm20KdjCt_jA). You can revoke your consent to the storage of your personal data at any time with effect for the future by changing the settings in the cookie banner.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.
XI. GOOGLE MAPS
a. Type and purpose of processing
On this website, we use the Google Maps service. Google Maps is operated by Google Cloud EMEA ltd,. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently. You can find more information about data processing by Google in the Google privacy policy. There you can also change your personal data protection settings in the data protection centre. When you visit the website, Google receives information that you have accessed the corresponding sub-page of our website. This occurs regardless of whether Google provides a user account via which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not want your data to be assigned to your Google profile, you must log out of Google before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or tailoring its website to your needs. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.
b. Legal basis of the processing
The legal basis for the integration of Google Maps and the associated data transfer to Google is your consent (Art. 6 para. 1 lit. a DSGVO).
c. Data categories
IP address, device-related data
d. Recipients
Recipients of the data are internal employees of hmf GmbH and Google as an order processor.
e. Storage periods
Data is only processed in this context as long as the corresponding consent exists. Afterwards, they will be deleted, insofar as there are no legal storage obligations to the contrary. To contact us in this context, please use the contact details provided at the beginning of this data protection declaration.
f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.
g. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google.
h. Withdrawal of consent
If you do not wish Google to collect, process or use data about you via our website, you can deactivate JavaScript in your browser settings. In this case, however, you will not be able to use our website, or only to a limited extent. You can revoke your consent to the storage of your personal data at any time with effect for the future.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.
XII. YOUTUBE VIDEOS
a. Nature and purpose of the processing
We embed YouTube videos on some of our websites. The operator of the corresponding plugins is YouTube, Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. When you visit a page with the YouTube plugin, a connection to YouTube servers is established. This tells YouTube which pages you are visiting. If you are logged into your YouTube account, YouTube can assign your surfing behaviour to you personally. You can prevent this by logging out of your YouTube account first. If a YouTube video is started, the provider uses cookies that collect information about user behaviour. Further information on the purpose and scope of data collection and processing by YouTube can be found in the provider’s data protection declarations, where you will also find further information on your rights in this regard and setting options for protecting your privacy (https://policies.google.com/privacy).
b. Legal basis for processing
The legal basis for the integration of YouTube and the associated data transfer to Google is your consent (Art. 6 para. 1 lit. a DSGVO).
c. Data categories
IP address, device-related data
d. Recipients
Recipients of the data are internal employees of hmf GmbH and YouTube as service provider.
e. Storage periods
Anyone who has deactivated the storage of cookies for the Google Ad programme will not have to expect any such cookies when watching YouTube videos. However, YouTube also stores non-personal usage information in other cookies. If you would like to prevent this, you must block the storage of cookies in your browser. Further information on data protection at “YouTube” can be found in the provider’s data protection declaration at:https://www.google.de/intl/de/policies/privacy/.
f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.
g. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google.
h. Revocation of consent
You can revoke your consent to the storage of your personal data at any time with effect for the future.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.
XIII. ONLINE PRESENCE SOCIAL MEDIA FACEBOOK AND INSTAGRAM
We maintain online presences within social networks in order to inform users active there about our services and to communicate directly via the platforms in case of interest. We are currently represented in the following networks:
https://de-de.facebook.com/hmf.group
https://www.youtube.com/channel/UCxdstEUi_PUN-lsAQSGtp5Q/featured
https://www.instagram.com/hellomyfriend_hmf/?hl=de
All our social media channels can only be accessed by visitors to the website via an external link. We do not use any plugins or other interfaces on our website that the respective networks offer for embedding the offers on websites.
We have no influence on the collection of data and its further use by the social networks. Thus, we have no knowledge of the extent to which, where and for how long the data is stored, to what extent the networks comply with existing deletion obligations, what evaluations and links are made with the data and to whom the data is passed on. We therefore expressly draw attention to the fact that user data (e.g. personal information, IP address) is stored by the operators of the networks in accordance with their data usage guidelines and used for business purposes.
We process the data of users in the social media presences insofar as they contact and communicate with us via comments or direct messages, for example.
The legal basis for the processing of the user’s data is Art. 6 para. 1 lit. b and f DSGVO.
XIV. FACEBOOK FANPAGE
hmf GmbH operates an online presence on Facebook, a so-called Facebook Fanpage. The following additional information on data processing applies to visits to our fan page. Information on data protection on Facebook in general can be found here (https://www.facebook.com/about/privacy/).
1. joint responsibility, contact details, company data protection officer:
We are jointly responsible with Facebook for the operation of our Facebook Fanpage in accordance with Art. 26 DSGVO. To this end, we have entered into an agreement with Facebook to determine who fulfils which obligations with regard to data protection. This agreement can be found here (https://www.facebook.com/legal/terms/page_controller_addendum). Accordingly, Facebook is primarily responsible for providing the data subject with information about the joint processing and enabling him or her to exercise his or her data protection rights. Notwithstanding the above, we hereby inform you about your visit to our Fanpage.
Our contact details are:
hmf GmbH
Rheinkaistr. 30, 68159 Mannheim, Germany
info@hmf-group.de
You can reach Facebook at:
Meta Platforms Ireland Ltd.
4 Grand Canal Square,
Grand Canal Harbour,
Dublin 2, Ireland
You can reach Facebook online here (https://www.facebook.com/help/contact/2061665240770586)
You can reach our company data protection officer at:
Bugl & Kollegen Gesellschaft für Datenschutz und Informationssicherheit mbH
Alexander Bugl
Sedanstraße 7
93055 Regensburg
E-mail: kontakt@buglundkollegen.de
You can reach Facebook’s data protection officer at
https://www.facebook.com/help/contact/540977946302970.
2. collection and storage of personal data as well as type and purpose and use thereof:
a) Data collected by Facebook:
If you are a Facebook user, Facebook collects the data described in the Facebook Data Policy under “What types of information do we collect?”. If you are not a Facebook user, cookies with identifiers, small text files, may still be stored in your browser, which enable so-called tracking of your user behaviour.
As a rule, the user data when visiting Facebook is also processed by Facebook for market research and advertising purposes. Based on user behaviour (including when visiting our fan page), complex user profiles are created which Facebook can use to play personalised advertisements to the visitor within and outside of Facebook. More information on this can also be found in the Facebook data policy.
If you do not agree to this, you can object here (opt-out).
b) Data used by us (“Page Insights”) and legal basis:
Facebook provides us with statistics and usage data that we can use to analyse the use of our Fanpage (so-called “Page Insights”). This enables us to continuously improve our offer on Facebook. As the operator, we do not make any decisions regarding the processing of insights data and all other information resulting from Art. 13 of the GDPR, such as the storage period of cookies on user devices. The primary responsibility under the GDPR for the processing of Insights Data lies with Facebook and Facebook fulfils all obligations under the GDPR with regard to the processing of Insights Data.
As the site administrator, we have no other possibility, not even via user tracking, to evaluate user behaviour on our fan page. It is also fundamentally not possible for us to identify the visitor to the fan page on the basis of the page insights. In particular, we have no right under the agreement to demand that Facebook disclose individual visitor data. Identification is only possible for us if we are able to assign individual profile pictures to “Like” Page Views; however, this is only possible to the extent that our Fanpage has been marked with “Like” by the corresponding visitor and the “Like” Page Views is set to “public”.
You can find out what information Facebook uses to create page insights here.
The operation of the Faceboook fan page and the use of the page insights serves our legitimate interest in effective external presentation and efficient communication with our customers and interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of Facebook users and in relation to visitors to our fan page who do not have a Facebook account. Accordingly, the legal basis is Art. 6 para. 1 lit. f) DSGVO.
3. transfer of data to third parties:
Data collected by Facebook is exchanged and processed within the entire Facebook group. The Facebook group also includes, for example, Instagram, WhatsApp and Oculus. For example, information collected via Facebook is used to display personalised advertising to the user on Instagram, or information from WhatsApp is used to take action on Facebook against accounts that send spam via WhatsApp. This information can be found in the Facebook Data Policy under “How do Facebook companies work together?”.
The processing of data by Facebook may involve the transfer of user data outside the European Economic Area (EEA), in particular the USA.
4. right to object:
Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) DSGVO, you have the right to object to the processing of your personal data pursuant to Art. 21 DSGVO, insofar as there are grounds for doing so that arise from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right of objection, which is implemented by us without specifying a particular situation. If you would like to make use of your right of revocation or objection, it is sufficient to send an e-mail to info@hmf-group.de.
5. data subject rights:
You have the right to revoke your consent to us at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future. In addition, you have the right to information according to Art. 15 DSGVO, the right to correction according to Art. 16 DSGVO, the right to deletion according to Art. 17 DSGVO, the right to restriction of processing according to Art. 18 DSGVO, as well as the right to data portability according to Art. 21 DSGVO. Furthermore, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 DSGVO).
In principle, you can assert your data subject rights against Facebook as well as against us. Since only Facebook has direct access to your user data, you can most effectively assert your data protection rights against Facebook.
XV. FACEBOOK DATA POLICY
hmf GmbH operates an online presence on Facebook, a so-called Facebook Fanpage. The following additional information on data processing applies to visits to our fan page. Information on data protection on Facebook in general can be found here (https://www.facebook.com/about/privacy/).
1. joint responsibility, contact details, company data protection officer:
We are jointly responsible with Facebook for the operation of our Facebook Fanpage in accordance with Art. 26 DSGVO. To this end, we have entered into an agreement with Facebook to determine who fulfils which obligations with regard to data protection. This agreement can be found here (https://www.facebook.com/legal/terms/page_controller_addendum). Accordingly, Facebook is primarily responsible for providing the data subject with information about the joint processing and enabling him or her to exercise his or her data protection rights. Notwithstanding the above, we hereby inform you about your visit to our Fanpage.
Our contact details are:
hmf GmbH
Rheinkaistr. 30, 68159 Mannheim, Germany
info@hmf-group.de
You can reach Facebook at:
Meta Platforms Ireland Ltd.
4 Grand Canal Square,
Grand Canal Harbour,
Dublin 2, Ireland
You can reach Facebook online here (https://www.facebook.com/help/contact/2061665240770586)
You can reach our company data protection officer at:
Bugl & Kollegen Gesellschaft für Datenschutz und Informationssicherheit mbH
Alexander Bugl
Sedanstraße 7
93055 Regensburg
E-mail: kontakt@buglundkollegen.de
You can reach Facebook’s data protection officer at
https://www.facebook.com/help/contact/540977946302970.
2. collection and storage of personal data as well as type and purpose and use thereof:
a) Data collected by Facebook:
If you are a Facebook user, Facebook collects the data described in the Facebook Data Policy under “What types of information do we collect?”. If you are not a Facebook user, cookies with identifiers, small text files, may still be stored in your browser, which enable so-called tracking of your user behaviour.
As a rule, the user data when visiting Facebook is also processed by Facebook for market research and advertising purposes. Based on user behaviour (including when visiting our fan page), complex user profiles are created which Facebook can use to play personalised advertisements to the visitor within and outside of Facebook. More information on this can also be found in the Facebook data policy.
If you do not agree to this, you can object here (opt-out).
b) Data used by us (“Page Insights”) and legal basis:
Facebook provides us with statistics and usage data that we can use to analyse the use of our Fanpage (so-called “Page Insights”). This enables us to continuously improve our offer on Facebook. As the operator, we do not make any decisions regarding the processing of insights data and all other information resulting from Art. 13 of the GDPR, such as the storage period of cookies on user devices. The primary responsibility under the GDPR for the processing of Insights Data lies with Facebook and Facebook fulfils all obligations under the GDPR with regard to the processing of Insights Data.
As the site administrator, we have no other possibility, not even via user tracking, to evaluate user behaviour on our fan page. It is also fundamentally not possible for us to identify the visitor to the fan page on the basis of the page insights. In particular, we have no right under the agreement to demand that Facebook disclose individual visitor data. Identification is only possible for us if we are able to assign individual profile pictures to “Like” Page Views; however, this is only possible to the extent that our Fanpage has been marked with “Like” by the corresponding visitor and the “Like” Page Views is set to “public”.
You can find out what information Facebook uses to create page insights here.
The operation of the Faceboook fan page and the use of the page insights serves our legitimate interest in effective external presentation and efficient communication with our customers and interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of Facebook users and in relation to visitors to our fan page who do not have a Facebook account. Accordingly, the legal basis is Art. 6 para. 1 lit. f) DSGVO.
3. transfer of data to third parties:
Data collected by Facebook is exchanged and processed within the entire Facebook group. The Facebook group also includes, for example, Instagram, WhatsApp and Oculus. For example, information collected via Facebook is used to display personalised advertising to the user on Instagram, or information from WhatsApp is used to take action on Facebook against accounts that send spam via WhatsApp. This information can be found in the Facebook Data Policy under “How do Facebook companies work together?”.
The processing of data by Facebook may involve the transfer of user data outside the European Economic Area (EEA), in particular the USA.
4. right to object:
Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) DSGVO, you have the right to object to the processing of your personal data pursuant to Art. 21 DSGVO, insofar as there are grounds for doing so that arise from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right of objection, which is implemented by us without specifying a particular situation. If you would like to make use of your right of revocation or objection, it is sufficient to send an e-mail to info@hmf-group.de.
5. data subject rights:
You have the right to revoke your consent to us at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future. In addition, you have the right to information according to Art. 15 DSGVO, the right to correction according to Art. 16 DSGVO, the right to deletion according to Art. 17 DSGVO, the right to restriction of processing according to Art. 18 DSGVO, as well as the right to data portability according to Art. 21 DSGVO. Furthermore, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 DSGVO).
In principle, you can assert your data subject rights against Facebook as well as against us. Since only Facebook has direct access to your user data, you can most effectively assert your data protection rights against Facebook.
XVI. INFORMATION OBLIGATIONS IN THE APPLICATION PROCESS
a. Nature and purpose of processing
We process applicant data only for the purpose and within the scope of the application procedure in accordance with the legal requirements. Applicant data is processed for the purpose of fulfilling our (pre)contractual obligations in the application procedure, insofar as data processing becomes necessary for us, e.g. in the context of legal proceedings. The application procedure requires applicants to provide us with applicant data. The necessary applicant data are marked if we offer an online form, otherwise they result from the job descriptions and basically include personal details, postal and contact addresses and the documents belonging to the application, such as cover letter, CV and certificates. In addition, applicants may voluntarily provide us with additional information. By submitting an application to us, applicants consent to the processing of their data for the purposes of the application process in the manner and to the extent set out in this privacy policy. Where provided, applicants may submit their applications to us using an online form on our website. The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also send us their applications by e-mail to jobs@hmf-group.de. However, please note that e-mails are generally not encrypted and applicants must ensure that they are encrypted themselves. We cannot therefore accept any responsibility for the transmission path of the application between the sender and receipt on our server and therefore recommend rather using an online form or sending by post. The data provided by applicants may, in the event of a successful application, be further processed by us for the purposes of the employment relationship.
b. Legal basis for processing
The processing of your data primarily serves to establish the employment relationship in accordance with Art. 88 Para. 1 DS-GVO in conjunction with § 26 Para. 1 BDSG.
c. Data categories
Surname, first name, address, date of birth, place of birth, nationality, telephone number, e-mail address, marital status, curriculum vitae, photograph, references, certificates, documents that you send to us without being asked.
Insofar as special categories of personal data within the meaning of Art. 9 (1) DSGVO are voluntarily provided within the scope of the application procedure, their processing is additionally carried out in accordance with Art. 9 (2) lit. b DSGVO (e.g. health data, such as severely disabled status or ethnic origin).
d. Recipients
Recipients of the data are internal employees of the accounting department, the personnel department and the management.
e. Storage periods
Subject to a justified revocation by the applicant, the data will be deleted after the expiry of a period of 6 month(s) so that we can answer any follow-up questions regarding the application and meet our obligations to provide evidence under the Equal Treatment Act. Invoices for any reimbursement of travel expenses will be archived in accordance with tax law requirements.
f. Legal / contractual requirement
The provision of your personal data beyond the storage period, e.g. in order to be included in our applicant pool, is voluntary, based solely on your consent. You can revoke this consent to store your personal data at any time with effect for the future.
g. Third country transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).
h. Revocation of consent
Where an application for a vacancy is unsuccessful, applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. You can revoke your consent to the storage of your personal data, beyond the storage period, at any time with effect for the future. You can notify us of your revocation at any time using the contact option provided at the beginning of this privacy notice.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.