Data privacy policy

I Name and address of the controller

The controller in the sense of the General Data Protection Regulation and other national data protection laws of the member states and other data protection regulations is:

 

TIS Technische Informationssysteme GmbH
Müller-Armack-Str. 8
46397 Bocholt
Telephone: +49 2871 2722-0
E-Mail: kontakt@tis-gmbh.de

 

II Name and address of the data protection officer

The controller’s data protection officer is:

André Korte
DSB Münster GmbH
Martin-Luther-King-Weg 42-44
48155 Münster
Tel.: +40 251 7187-110
datenschutz@dsb-ms.de

 

III General information about data processing

1. Scope of processing personal data

We generally only process personal data if this is necessary to provide a functioning website as well as our contents and services. Personal data will only be processed with the user’s consent or in cases where prior consent cannot be obtained for practical reasons and where data processing is permitted by law.

 

2. Legal basis for processing personal data

If we obtain the consent of the data subject for processing personal data, Art. 6 Abs. 1 lit. a EU General Data Protection Regulations (GDPR) serves as the legal basis.

When processing personal data required for the performance of a contract to which the data subject is a party, Art. 6 Abs. 1 lit.  b serves as the legal basis. This also applies to processing required for executing precontractual measures.

If processing personal data is required to fulfil a legal obligation to which our company is subject,  Art. 6 Abs. 1 lit. c GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 Abs. 1 lit. f GDPR serves as the legal basis for processing.

 

3. Data deletion and storage duration

The personal data of the data subject is deleted or blocked as soon as the purpose for storage ceases to exist. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

 

IV Provision of the website and creation of log files

1. Description and scope of data processing

On every visit to our website, our system automatically collects data and information from the computer system of the computer being used.

 

The following data is collected:

1.1. browser type and version

1.2. the operating system used

1.3. the user’s Internet service provider

1.4. the IP address

1.5. data and time of access

1.6. websites from which the user’s system reaches our website

1.7. websites accessed by the user’s system via our website

 

The data is also stored in the log files of our system. The IP addresses of the user or other data that enables the assignment of the data to a user are not affected by this. Storage of this data together with other data of the user does not take place.

 

2. Legal basis for data processing

The legal basis for the temporary storage of the data and log files is Art. 6 Abs. 1 lit. f GDPR.

 

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. The user’s IP address must be stored for the duration of the session for this purpose.

 

Data is stored in log files to ensure the functionality of the website. The data also helps us to optimise the website and to ensure the security of our information technology systems. An analysis of the data for marketing purposes does not take place in this context.

 

Our legitimate interest in data processing in accordance with  Art. 6 Abs. 1 lit. f GDPR so lies in these purposes.

 

4. Storage duration

The data is deleted as soon as it is no longer necessary for achieving the purpose of its collection. In the case of data collection for the provision of the website, this is the case when the respective session has ended.

 

In the case of data being stored in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the user’s IP address is deleted or distorted so that the assignment of the client is no longer possible.

 

5. Objection or removal option

The collection of the data for website provision and data storage in log files is necessary for operating the website. As a result, there is no objection option for the user.

 

V Operating a Facebook page

We operate a page about our company on the Facebook platform.

 

1. Data subject categories

Website visitors

 

2. Data categories

Master data (e.g. names, addresses, dates of birth)

Contact data (e.g. email addresses, telephone numbers, messenger services)

Content data (e.g. entered texts, photos, videos, contents of documents/files)

Usage data (e.g. history on our website, use of certain contents, times of access, contact history and purchasing history)

Connection data (e.g. device information, IP addresses, URL referrer)

Position data (e.g. GPS data, IP geo-localisation, points of access)

 

3. Purpose of data processing

The purpose of operating this website is to present our company, provide information about offers and events and communicate with partners and interested parties.

 

4. Legal basis

The legal basis for processing users’ personal data is  Art. 6 para. 1 lit. a GDPR.

 

5. Data erasure and storage duration

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected or, in the case of consent, when consent is withdrawn.

 

6. Data recipients

Facebook is a service of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We have concluded an order processing contract with this IT service provider.

 

7. Intended transfer to third countries

It cannot be ruled out that the information will be transmitted to a server in a third country. In the event of such a transfer, this will be based on standard data protection clauses and adequacy decisions.

 

8. Objection or removal option

Consent can be revoked at any time.

 

VI Operating a Instagram page

We operate a page about our company on the Instagram platform.

 

1. Data subject categories

Website visitors

 

2. Data categories

Master data (e.g. names, addresses, dates of birth)

Contact data (e.g. email addresses, telephone numbers, messenger services)

Content data (e.g. entered texts, photos, videos, contents of documents/files)

Usage data (e.g. history on our website, use of certain contents, times of access, contact history and purchasing history)

Connection data (e.g. device information, IP addresses, URL referrer)

Position data (e.g. GPS data, IP geo-localisation, points of access)

 

3. Purpose of data processing

The purpose of operating this website is to present our company, provide information about offers and events and communicate with partners and interested parties.

 

4. Legal basis

The legal basis for processing users’ personal data is  Art. 6 para. 1 lit. a GDPR.

 

5. Data erasure and storage duration

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected or, in the case of consent, when consent is withdrawn.

 

6. Data recipients

Instagram is a service of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We have concluded an order processing contract with this IT service provider.

 

7. Intended transfer to third countries

It cannot be ruled out that the information will be transmitted to a server in a third country. In the event of such a transfer, this will be based on standard data protection clauses and adequacy decisions.

 

8. Objection or removal option

Consent can be revoked at any time.

 

VII Operating a Xing page

1. Description and scope of data processing

When you visit our Xing page two companies collect personal data, that is us and Xing, which is operated in Europe by XING SE, Dammtorstraße 30, 20354 Hamburg. Xing and we are jointly responsible for collecting personal data from visitors to our page.  Xing uses this data in accordance with its own data protection declaration, including for analysis services that are made available to us, so-called page insights. Such data collection by Xing can also take place from visitors to the Xing who are not logged in or registered with Xing. Visitors can find information about data collection and further processing by Xing in Xing data protection information.

We cannot understand which user data Xing collects. We also do not have full access to the recorded data or profile data. We can only see the public information of the profiles. Individuals registered with Xing decide which these are in their respective Xing settings.

We receive anonymous statistics on the use and usage of the page from Xing. The following information is provided here, for example:

 

1.1. Number of people who follow us - including growth and development over a defined time frame.

1.2. Number of people who see a post. Number of interactions on a post. From this it can be deduced, for example, which content is better received than others.

1.3. When advertisements are placed, we receive evaluations of the advertisements.

1.4. Demographic characteristics related to the average age of visitors, gender, place of residence, language.

 

We also receive personal data via Xing if users use a form with fields filled out in advance with data from their profile to transmit the data to us and actively send the data to us by clicking on a button.

Finally, we receive personal data when users comment on or share our posts.

 

2. Legal basis for data processing

The legal basis for processing personal data using cookies is  Art. 6 Abs. 1 lit. f GDPR.

 

3. Purpose of data processing

We use the statistics, from which we cannot draw any conclusions about individual users, to continuously improve our online offer on Xing and to better respond to the interests of our visitors. We cannot link the statistical data with the profile data of our fans. People registered with Xing can use their Xing settings to decide in which form targeted advertising is shown to them.

We use the data when using the chat function to answer the request. The sales and customer care information collected in this way are used to establish contact in order to submit the desired information and offers.

 

4. Storage duration, objection or removal option

Cookies are stored on the user's computer and transmitted from there to Xing. Therefore, users also have full control over the use of cookies. By changing the settings in the Internet browser, users can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for Xing, it is possible that not all functions of the website can be used to their full extent.

 

VIII Operating a LinkedIN page

We operate a page about our company on the LinkedIN platform.

 

1. Data subject categories

Website visitors

 

2. Data categories

Master data (e.g. names, addresses, dates of birth)

Contact data (e.g. email addresses, telephone numbers, messenger services)

Content data (e.g. entered texts, photos, videos, contents of documents/files)

Usage data (e.g. history on our website, use of certain contents, times of access, contact history and purchasing history)

Connection data (e.g. device information, IP addresses, URL referrer)

Position data (e.g. GPS data, IP geo-localisation, points of access)

 

3. Purpose of data processing

The purpose of operating this website is to present our company, provide information about offers and events and communicate with partners and interested parties.

 

4. Legal basis

The legal basis for processing users’ personal data is  Art. 6 para. 1 lit. a GDPR.

 

5. Data erasure and storage duration

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected or, in the case of consent, when consent is withdrawn.

 

6. Data recipients

LinkedIN is a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. We have concluded an order processing contract with this IT service provider.

 

7. Intended transfer to third countries

It cannot be ruled out that the information will be transmitted to a server in a third country. In the event of such a transfer, this will be based on standard data protection clauses and adequacy decisions.

 

8. Objection or removal option

Consent can be revoked at any time.

 

IX Operating a YouTube page

We operate a page about our company on the YouTube platform.

 

1. Data subject categories

Website visitors

 

2. Data categories

Master data (e.g. names, addresses, dates of birth)

Contact data (e.g. email addresses, telephone numbers, messenger services)

Content data (e.g. entered texts, photos, videos, contents of documents/files)

Usage data (e.g. history on our website, use of certain contents, times of access, contact history and purchasing history)

Connection data (e.g. device information, IP addresses, URL referrer)

Position data (e.g. GPS data, IP geo-localisation, points of access)

 

3. Purpose of data processing

The purpose of operating this website is to present our company, provide information about offers and events and communicate with partners and interested parties.

 

4. Legal basis

The legal basis for processing users’ personal data is  Art. 6 para. 1 lit. a GDPR.

 

5. Data erasure and storage duration

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected or, in the case of consent, when consent is withdrawn.

 

6. Data recipients

YouTube is a service of Google Ireland Limited ("Google"), Gordan House, Barrow Street Dublin 4, Ireland. We have concluded an order processing contract with this IT service provider.

 

7. Intended transfer to third countries

It cannot be ruled out that the information will be transmitted to a server in a third country. In the event of such a transfer, this will be based on standard data protection clauses and adequacy decisions.

 

8. Objection or removal option

Consent can be revoked at any time.

 

X Rights of the data subject

If users’ personal data is processed, they are the data subject within the meaning of the GDPR and they are entitled to the following rights from the controller, whereby the following list includes all of their rights, not just the rights arising from the use of our services:

 

1. Right to information

Users can ask the controller to confirm whether personal data concerning you will be processed by us.

 

If processing has taken place, users can request the following information from the controller:

 

1.1. the purposes for which personal data is being processed;

1.2. the category of personal data being processed;

1.3. the recipient or categories of recipients to whom the personal data concerning you has been or is still being disclosed;

1.4. the planned storage duration of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period;

1.5. the existence of a right to have the personal data concerning you corrected or deleted, a right to have processing restricted by the controller or a right to object to this kind of processing;

1.6. the existence of a right to complain to a supervisory authority;

1.7. all available information regarding the origin of the data if the personal data is not collected from the data subject;

1.8. the existence of automated decision-making, including profiling in accordance with Art. 22 Abs. 1 and 4 GDPR and – at least in these cases – significant information on the logic involved and the scope and intended effects of this kind of processing for the data subject.

 

Users have the right to request information as to whether the personal data concerning them is transferred to a third country or to an international organisation. In this context, they can request to be informed of the appropriate guarantees according to Art. 46  GDPR in connection with the transmission.

 

2. Right to correction

Users have a right to the correction and/or completion by the controller if the personal data processed concerning them is incorrect or incomplete. The controller must make the correction without delay.

 

3. Right to restrict processing

Users may request that the processing of personal data concerning them be restricted under the following conditions:

 

3.1. if users dispute the accuracy of the personal data concerning them for a period of time that enables the controller to verify the accuracy of the personal data;

3.2. processing is unlawful and users refuse the deletion of the personal data and instead request that the use of the personal data be restricted;

3.3. the controller no longer needs the personal data for processing purposes but users need it to assert, exercise or defend legal claims, or

3.4. if users have filed an objection to the processing according to  Art. 21 Abs. 1 GDPR and it has not yet been determined whether the legitimate reasons of the controller outweigh their reasons.

 

If the processing of personal data concerning users has been restricted, this data may only be processed – aside from being stored – with their consent or for the purpose of asserting, exercising or defending rights or for protecting the rights of another natural or legal person or on grounds of important public interest of the European Union or a member state.

 

If the processing restriction has been restricted in accordance with the aforementioned conditions, users will be informed by the controller before the restriction is lifted.

 

4. Right to deletion

 

4.1. Deletion obligation

Users can request that the controller delete the personal data concerning them without delay and the controller is obliged to delete this data without delay if one of the following reasons applies:

 

4.1.1. The personal data concerning users is no longer necessary for the purposes for which it was collected or otherwise processed.

4.1.2. Users revoke their consent on which the processing was based according to  Art. 6 Abs. 1 lit. a or Art. 9 Abs. 2 lit. a GDPR and there is no other legal basis for processing.

4.1.3. Users file an objection against processing according to  Art. 21 Abs. 1 GDPR and there are no overriding legitimate reasons for processing or they file an objection against processing according to Art. 21 Abs. 2 GDPR.

4.1.4. The personal data concerning the users has been unlawfully processed.

4.1.5. The deletion of personal data concerning the users is necessary to fulfil a legal obligation under EU law or the member state law to which the controller is subject.

4.1.6. The personal data concerning the users has been collected in relation to information society services offered according to  Art. 8 Abs. 1 GDPR.

 

4.2. Information to third parties

If the controller has made personal data concerning users public and is obliged to delete it according to Art. 17 Abs. 1 GDPR it shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform those responsible for data processing who process the personal data that you as the data subject have requested the deletion of all links to this personal data or of copies or replications of this personal data.

 

4.3. Exceptions

The right to deletion does not exist if processing is required

 

4.3.1. to exercise the right to freedom of expression and information;

4.3.2. to perform a legal obligation required for processing under EU law or member states’ law to which the controller is subject or to perform a task in the public interest or to exercise public authority that has been given to the controller;

4.3.3. for reasons of public interest in the field of public health according to  Art. 9 Abs. 2 lit. h and i such as Art. 9 Abs. 3 GDPR.

4.3.4. for archiving purposes in the public interest, academic or historical research purposes or for statistical purposes according to  Art. 89 Abs. 1 GDPR if the right referred to in a) is likely to make it impossible or seriously impair the attainment of the objectives of this processing or

4.3.5. for asserting, exercising or defending legal claims.

 

5. Right to notification

If users have exercised their right to have the controller correct, delete or limit processing, it is obliged to inform all recipients to whom the personal data concerning them has been disclosed of this correction or deletion of the data or processing restriction, unless this proves impossible or involves a disproportionate effort.

 

Users shall also have the right to be informed about these recipients by the controller.

 

6. Right to data transferability

Users have the right to receive the personal data concerning them that they have provided to the controller in a structured, common and machine-readable format. Furthermore, users have the right to transmit this data to another controller without any obstruction by the controller to whom the personal data was made available provided that

 

6.1. processing is based on consent according to Art. 6 Abs. 1 lit. a GDPR or Art. 9 Abs. 2 lit. a GDPR or on a contract according to  Art. 6 Abs. 1 lit. b GDPR and

6.2. processing is carried out using automated methods.

 

In exercising this right, users also have the right to affect that the personal data concerning them be transferred directly from one controller to another if this is technically feasible. Freedoms and rights of other people may not be affected because of this.

 

The right to data transferability does not apply to processing personal data necessary for performing a task in the public interest or in the exercise of public authority assigned to the controller.

 

7. Right to objection

Users have the right, for reasons arising from your particular situation, to object to the processing of personal data concerning you under  Art. 6 Abs. 1 lit e or f GDPR at any time; this also applies to profiling based on these provisions.

 

The controller no longer processes the personal data concerning users unless it can prove compelling legitimate reasons for the processing, which outweigh their interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

 

If the personal data concerning users is processed for direct marketing purposes, users have the right to object to the processing of personal data concerning them for the purpose of this kind of advertising at any time; this also applies to profiling if it is in connection with this kind of direct marketing.

 

If users object to the processing for direct marketing purposes, the personal data concerning them will no longer be processed for these purposes.

 

Users have the option of exercising their right of objection using automated procedures in which technical specifications are used, in connection with the use of information society services, notwithstanding Directive 2002/58/EC.

 

8. Right to revoking the declaration of consent relating to data privacy

Users have the right to revoke their declaration of consent relating to data privacy at any time. The revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until revocation.

 

9. Automated decision on a case-by-case basis, including profiling

Users have the right not to be subject to a decision based exclusively on automated processing, including profiling, that has legal effect against them or significantly impairs them in a similar manner. This does not apply if the decision

 

9.1. is necessary for concluding or fulling a contract between them and the controller,

9.2. is admissible due to EU law or the member state law to which the controller is subject and where this law contains appropriate measures to safeguard their rights, freedoms and legitimate interests or

9.3. takes place with their explicit consent.

 

However, these decisions may not be based on special categories of personal data according to  Art. 9 Abs. 1 GDPR unless Art. 9 Abs. 2 lit. a or g GDPR applies and appropriate measures have been taken to protect your rights, freedoms and legitimate interests.

 

In the cases referred to in 9.1 and 9.3, the controller shall take reasonable measures to safeguard their rights, freedoms and legitimate interests, including at least the right to obtain the intervention of a person by the controller, to state its own position and to challenge the decision.

 

10. Right to complain to a supervisory authority

Irrespective of any other administrative or judicial remedy, users have the right to complain to a supervisory authority, in particular in the member state in which they are residing, working or suspected of violation, if they believe that the processing of personal data concerning them is contrary to the GDPR.

 

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under  Art. 78 GDPR.