1. Introduction

We are pleased that you are interested in our company.

Personal data is any information relating to an identified or identifiable person. Pseudonymous data that we cannot directly associate with you, for example through a name or email address, is also personal data.

Because protecting your personal data is very important to us, this privacy policy explains the nature, scope and purpose of the personal data we process and your rights as a data subject.

Explanations of the terms used are provided in the Definitions section at the end of this privacy policy.

The controller responsible for processing personal data is:

Krückemeyer GmbH

Dortmunder Straße 4

57234 Wilnsdorf

Germany

Tel.: +49 (0) 27 39 / 8 01 - 0

Email: info@krueckemeyer.de

The external company data protection officer is:

dokuworks GmbH

Mr Markus Weber

Essener Straße 1

57234 Wilnsdorf

Tel.: +49 271 77237-60

Email: datenschutz@doku.works

If you have questions or suggestions about data protection, you can contact us as the controller or our data protection officer at any time.

2. Rights of data subjects

You can exercise the following rights concerning your personal data against us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

If you request access, we will tell you whether and what data we have collected about you in accordance with data protection requirements. We aim to keep the data we collect up to date and accurate. If any information is nevertheless incorrect, we will correct it promptly following a corresponding request.

Please send your request to: info@krueckemeyer.de

In addition to exercising your rights against us, you have the right to lodge a complaint with a supervisory authority if you suspect a breach of data protection rules (Art. 77 GDPR).

3. Transfer of data to third countries

We transfer or process data in countries outside the scope of the GDPR (so-called third countries) only if you consent to this processing or another legal permission applies. This applies in particular where processing is required by law or necessary to fulfil a contractual relationship, and in every case only to the extent generally permitted.

Where data is processed outside the EU/EEA and the level of data protection does not meet the European standard, we conclude EU Standard Contractual Clauses with the relevant service providers, together with a Transfer Impact Assessment (TIA), to establish an appropriate level of protection.

For transfers of data to US companies, the transatlantic data protection agreement known as the Data Privacy Framework came into force on 10 July 2023; it is also known as “Privacy Shield 2.0”. Under certain conditions, this once again permits the use of tracking, analytics and marketing tools that transfer data to the USA. To be regarded as a safe recipient of data and comply with the Data Privacy Framework, a US company must undergo a self-certification procedure with the US Department of Commerce (DoC). For this self-certification, the company must submit a series of documents. If they are complete, the organisation is entered on the DPF list (Data Privacy Framework) and is considered self-certified under the new data protection framework.

Processing by US services that are not active participants in the EU-US Data Privacy Framework may result in data being processed and stored without anonymisation. US government authorities may also gain access to individual data. Data collected may also be linked to data from other services of the same provider if you have a corresponding user account. Where available, we try to use server locations within the EU.

4. Privacy notice for business partners

We are pleased that you are interested in us and are getting in touch.

Protecting your data is very important to us. This privacy notice provides the following information under Art. 13 GDPR about processing your personal data in connection with our business relationship.

Further information about our company, its authorised representatives and ways to contact us is available at https://www.krueckemeyer.de/impressum/

What data do we process, and for what purposes?
We process only personal data that we have received from you in the course of our business relationship or, where applicable, from publicly accessible sources.

Personal data within the meaning of Art. 4(1) GDPR may include names, telecommunications data and address data. We also process quotation, enquiry and order data, data arising from the performance of our contractual obligations, product data, documentation data and other data comparable to these categories.

Providing your personal data is necessary to initiate, perform and manage the contractual relationship. Without it, we cannot contact you to clarify pre-contractual or contractual matters.

What is the legal basis for processing your personal data?
Your personal data is processed in accordance with the GDPR and the German Federal Data Protection Act (BDSG) to perform contractual obligations or take steps to enter into a contract (Art. 6(1), first sentence, point (b) GDPR). We may also use this data for additional purposes within our business relationship.

How long is the data stored?
We process and store your personal data for the duration of our business relationship and at least for the statutory retention periods, such as those under the German Commercial Code or Fiscal Code.

To whom is the data disclosed, and where is it processed?
We use the personal data only for our own purposes in the course of the business relationship.

5. Privacy notice for applicants

The controller collects and processes applicants' personal data in order to handle the application process. Processing may also take place electronically, in particular if an applicant sends application documents to the controller electronically, for example by email or via a web form on the website. If the controller enters into an employment contract with an applicant, the data submitted is stored to manage the employment relationship in accordance with legal requirements.

The legal basis for this processing is Section 26(1), first sentence, BDSG in conjunction with Art. 88(1) GDPR.

If the controller does not enter into an employment contract with the applicant, the application documents are automatically deleted six months after the rejection decision is communicated, unless other legitimate interests of the controller prevent deletion. Such an interest may, for example, be a duty to provide evidence in proceedings under the German General Equal Treatment Act (AGG).

In this case, the legal basis is Art. 6(1)(f) GDPR and Section 24(1) No. 2 BDSG. Our legitimate interest is to defend or assert legal claims.

We publish vacancies through the Karriere Südwestfalen platforms and give applicants the opportunity to apply. You can enter relevant data in an input form. The providers do not store this data; they transfer it directly to us. We conclude a data processing agreement with each provider to meet data protection requirements.

If you expressly consent to longer storage of your data, for example for inclusion in an applicant or candidate database, the data will continue to be processed on the basis of your consent. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time under Art. 7(3) GDPR by notifying us, with effect for the future.

6. Data protection when visiting our website

Nature and purpose of processing:
When you access our website without registering or otherwise submitting information, general information is collected automatically. These server log files may include the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and similar information.

The information is processed in particular for the following purposes:

• ensuring that a connection to the website can be established without problems,
• ensuring smooth use of our website,
• evaluating system security and stability, and
• optimising our website.

We do not use your data to draw conclusions about you as a person. Where applicable, we evaluate information of this kind in anonymised form for statistical purposes to optimise our website and its underlying technology.

Legal basis and legitimate interest:
Processing is based on our legitimate interest in improving the stability and functionality of our website under Art. 6(1)(f) GDPR.

Recipients:
Recipients of the data may include technical service providers acting as processors for the operation and maintenance of our website.

Retention period:
The data is deleted as soon as it is no longer needed for the purpose for which it was collected. For data used to provide the website, this is generally when the respective session ends.

If data is stored in log files, it is deleted after no more than 14 days. Longer storage is possible. In that case, users' IP addresses are anonymised so that the client accessing the website can no longer be identified.

Whether provision is mandatory or required:
Providing the personal data described above is neither legally nor contractually required. Without an IP address, however, the service and functionality of our website cannot be ensured. Individual services and features may also be unavailable or restricted. For this reason, objection is excluded.

7. Hosting

We host our website content with the following provider:

Tom Ludwig
An der Alche 5
57072 Siegen

Email: mail@hello.tl

For details, see the provider's privacy policy:
Hello.tl privacy policy

Use of the provider is based on Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. Where consent has been requested, processing is based exclusively on Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device, such as device fingerprinting, within the meaning of the TDDDG. Consent can be withdrawn at any time.

8. Callback service

You can use our callback service so that we can deal with your enquiry as quickly and satisfactorily as possible. To respond, we collect your first and last name, company name and telephone number.

We process your personal data in order to receive and handle your enquiry (see Art. 6(1)(b) GDPR). We delete your data once we have answered your enquiry to your satisfaction, unless other retention periods, such as those under tax or commercial law, apply.

9. Requesting a quotation

We offer you the option of requesting quotations for products through a form on our website. Your company name and email address are required so that we can handle your enquiry. You may also provide your first and last name, telephone number and a specific question about the product or department. This is based on taking pre-contractual steps or on your consent under Art. 6(1)(a) or (b) GDPR. The data is stored for as long as necessary to fulfil the purposes stated above and, where applicable, longer to comply with statutory retention periods, such as those under tax or commercial law. 

10. Use of analytics and tracking tools

Cookies are small text files placed on your device. They collect data that can later be read by a web server belonging to the domain that placed the cookie.

Our website uses cookies and similar technologies to provide users with a more user-friendly service, analyse the performance of our products and fulfil other legitimate purposes.

You can prevent our website from setting cookies at any time by changing the settings of the browser you use, thereby permanently objecting to their use. Cookies that have already been set can also be deleted at any time using a browser or other software. This is possible in all common browsers. If you disable cookies in your browser, some functions of our website may not be fully available.

The following types of cookies can be distinguished:

10.1   Strictly necessary cookies

Strictly necessary cookies secure the website's basic functions and make its operation possible. This concerns technical necessity only, not economic considerations.

The legal basis is our legitimate interest in providing a functional website under Art. 6(1)(f) GDPR or compliance with a legal obligation under Art. 6(1)(c) GDPR.

10.2   Statistics and marketing cookies

Statistics cookies help website operators understand how visitors interact with websites by collecting and reporting information anonymously.

Marketing cookies store user information relating to the website visited. This data is used, for example, to display advertisements tailored to user interests, optimise offers, recognise users or simplify use of the website.

The legal basis is your consent under Art. 6(1)(a) GDPR.

For these purposes, we use the services of the third parties listed below, who are responsible under Art. 4(7) GDPR for processing that takes place through their respective services. Further information about processing by these providers and your rights as a data subject is available in the providers' privacy policies linked below:

• Matomo

We use Matomo for statistical analysis of website use. Matomo runs on servers in Germany. Analysis takes place without cookies or fingerprinting. IP addresses are anonymised before storage. No data is passed on to third parties. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

11. Social media

11.1   Integration of a social media button

The controller has integrated social media components into this website. For this purpose, we use the services of the third-party providers listed below. Under Art. 4(7) GDPR, they are responsible for data processing through their respective services. The providers collect personal data from you only when you click the button and are redirected to the relevant site. Further information about processing by these providers and your rights as a data subject is available in their privacy policies listed below:

The legal basis for processing is our legitimate interest in offering and promoting our products and services on social media under Art. 6(1)(f) GDPR.

• LinkedIn (LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland), responsible.

de.linkedin.com/legal/privacy-policy

• X (Twitter International Unlimited Company, Attn: Data Protection Officer, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, IRELAND)

twitter.com/de/privacy

• YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

support.google.com/youtube/answer/7671399

• Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)

www.facebook.com/about/privacy/

11.2   Use of social media profiles

To display our content on a social media profile, we use the technical platform and services of the respective social media provider.

As the operator of the social media profile, we, Krückemeyer GmbH, are jointly responsible with the operator of the social network within the meaning of Art. 4(7) GDPR. When you visit our social media profile, the controllers process personal data. Below we explain what data this involves, how it is processed and what rights you have in this regard.

Please note that you use this website and its functions at your own responsibility. This applies in particular to interactive functions such as commenting, sharing and rating. We may respond to your comments and ratings with our own comments. Our legal basis for doing so is our legitimate interest in interacting with active users of our profile (Art. 6(1)(f) GDPR).

For questions of any kind, you may be able to contact us through private messages. Your username may be passed to us automatically. You may provide further details voluntarily, in particular other ways to contact you outside social media. Processing for the purpose of contacting us is based on your voluntary consent under Art. 6(1), first sentence, point (a) GDPR. Personal data that we process to contact you is automatically deleted once your enquiry has been dealt with, unless statutory retention obligations prevent this, for example because your enquiry has led to a contractual relationship between us.

When you visit our social media profile, the provider collects your IP address and other information stored in cookies on your computer. This information is used to give us, as the profile operator, statistical information about use of the website.

The providers process data collected about you in this context and may transfer it to countries outside the European Union. The provider's general data use policies describe what information it receives and how it uses that information. They also explain how to contact the provider and adjust advertising settings.

The social media providers do not state clearly and conclusively how they use data from visits to social media profiles for their own purposes, how far website activity is assigned to individual users, how long the data is stored or whether it is passed to third parties. We do not know these details. When you access a social media profile, the IP address assigned to your device is transmitted to the provider. The provider may therefore be able to link IP addresses to individual users. If you are logged in to a social media provider, a cookie containing your identifier is stored on your device. This allows the provider to establish that you visited the page and how you used it. To avoid this, you should log out of the respective social media provider or disable its “stay logged in” function, delete the cookies on your device, and close and restart your browser.

Further information about your rights as a data subject under the GDPR is available in section 2, Rights of data subjects.

The provider supplies further information at the following links:

• Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)

www.facebook.com/about/privacy/

• LinkedIn (LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland),

de.linkedin.com/legal/privacy-policy

• Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland)

www.instagram.com/legal/privacy/

• X (Twitter International Unlimited Company, Attn: Data Protection Officer, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, IRELAND)

twitter.com/de/privacy

• YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

support.google.com/youtube/answer/7671399

12. Contact

When you contact us, for example by contact form, chat or email, we process the information you provide to handle your enquiry and any follow-up questions.

Where the data is processed to take pre-contractual steps at your request or, if you are already a customer, to perform the contract, the legal basis is Art. 6(1), first sentence, point (b) GDPR.

13. Retention period

Unless stated otherwise, we store personal data only for as long as necessary to fulfil the purposes pursued.

In some cases, the law requires personal data to be retained, for example under tax or commercial law. In these cases, we continue to store the data solely for these statutory purposes, do not process it for other purposes, and delete it when the statutory retention period expires.

14. Definitions

This privacy policy is based on the terminology used by the European legislator in the General Data Protection Regulation (GDPR). We aim to make it easy for the public as well as our customers and business partners to read and understand. To this end, we explain the terms used below.

Personal data
Personal data is any information relating to an identified or identifiable natural person (referred to below as the “data subject”). A natural person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.

Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

Processing
Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other means of making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting its processing in the future.

Profiling
Profiling is any form of automated processing of personal data in which the data is used to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation
Pseudonymisation is the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without additional information, provided that the additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data cannot be attributed to an identified or identifiable natural person.

Controller or person responsible for processing
A controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor
A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

Recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. Public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.

Third party
A third party is a natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent
Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which the data subject, by a statement or another clear affirmative action, signifies agreement to the processing of personal data relating to them.

15. Disclosure of personal data to third parties

Your personal data will not be transferred to third parties for purposes other than those listed below. We disclose your personal data to third parties only if:

• you have given your express consent under Art. 6(1), first sentence, point (a) GDPR,
• disclosure is necessary to establish, exercise or defend legal claims under Art. 6(1), first sentence, point (f) GDPR and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
• disclosure is required by law under Art. 6(1), first sentence, point (c) GDPR, or
• disclosure is legally permitted and necessary under Art. 6(1), first sentence, point (b) GDPR to perform contractual relationships with you.

16. Data security

We make every effort to protect your data as far as possible within the limits of applicable data protection law and technical capabilities.

Your personal data is transmitted to us in encrypted form. This applies to your orders and customer login. We use SSL (Secure Socket Layer) encryption, but point out that data transmission over the internet, for example by email, may have security gaps. Complete protection against third-party access is not possible.

17. Currency and changes to this privacy policy

This privacy policy is currently valid and is dated July 2024. Changes to our website and the services offered through it, or changes in legal or regulatory requirements, may make it necessary to amend this privacy policy.