Home Page » Data Protection

Data Protection

Data controller:

Name/Company:
KW automotive GmbH
Street No.:
Aspachweg 14
Postcode, Town, Country:
D-74427, Fichtenberg, Germany
Commercial Register/No.:
Registered at Stuttgart Local Court, HRB 571255
Managing Directors:
Klaus Wohlfarth, Jürgen Wohlfarth
Telephone number:
+49 7971 9630-0
Email address:
info@kwautomotive.de

Data Protection Officer:

Name:
Thomas Schuster
Street number:
Aspachweg 14
Postcode, Town, Country:
D-74427, Fichtenberg, Germany
Telephone number:
+49 7971 9630-0
Email address:
thomas.schuster@kwautomotive.de

Status: 22 May 2018

  1. General information on data processing and legal bases

    1. This privacy policy explains the nature, scope and purpose of the processing of personal data within our online service and the associated web pages, functions and content (hereinafter collectively referred to as the ‘online service’ or ‘website’). This privacy policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) on which the online service is operated.
    2. For the terms used, such as ‘personal data’ or its ‘processing’, please refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).
    3. The users’ personal data processed within the scope of this online service includes master data (e.g. customers’ names and addresses), contractual data (e.g. services used, names of case handlers, payment information), usage data (e.g. the web pages visited on our online service, interest in our products) and content data (e.g. entries in the contact form).
    4. The term ‘user’ covers all categories of data subjects affected by data processing. These include our business partners, customers, prospective customers and other visitors to our online service. The terms used, such as ‘user’, are to be understood as gender-neutral.
    5. We process users’ personal data only in compliance with the relevant data protection regulations. This means that users’ data is processed only where there is a legal basis for doing so. This means, in particular, where data processing is necessary for the provision of our contractual services (e.g. processing of orders) and online services, or is required by law; where the user’s consent has been given; or on the basis of our legitimate interests (i.e. an interest in the analysis, optimisation and the economic operation and security of our online offering within the meaning of Article 6(1)(f) of the GDPR, in particular in relation to audience measurement, the creation of profiles for advertising and marketing purposes, as well as the collection of access data and the use of third-party services.
    6. We would like to point out that the legal basis for consent is Article 6(1)(a) and Article 7 of the GDPR; the legal basis for processing to fulfil our services and carry out contractual measures is Article 6(1)(b) of the GDPR; the legal basis for processing to fulfil our legal obligations is Article 6(1)(c) of the GDPR; and the legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) of the GDPR.
  2. Security measures

    1. We implement state-of-the-art organisational, contractual and technical security measures to ensure compliance with data protection legislation and thereby to protect the data we process against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons.
    2. These security measures include, in particular, the encrypted transmission of data between your browser and our server.
  3. Disclosure of data to third parties and third-party providers

    1. Data is only disclosed to third parties within the framework of legal requirements. We only disclose users’ data to third parties if this is necessary, for example, on the basis of Article 6(1)(b) of the GDPR for contractual purposes, or on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR for the economic and effective operation of our business.
    2. Where we engage subcontractors to provide our services, we take appropriate legal precautions and implement corresponding technical and organisational measures to ensure the protection of personal data in accordance with the relevant legal provisions.
    3. Where, within the scope of this privacy policy, content, tools or other resources from other providers (hereinafter collectively referred to as ‘third-party providers’) are used and their registered office is located in a third country, it must be assumed that a data transfer takes place to the countries in which the third-party providers are based. Third countries are defined as countries in which the GDPR is not directly applicable law, i.e. generally countries outside the EU or the European Economic Area. Data is transferred to third countries either where an adequate level of data protection is ensured, where the user has given their consent, or where there is some other legal authorisation.
  4. Provision of contractual services

    1. We process master data (e.g. names, addresses and contact details of users), contractual data (e.g. services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and providing services in accordance with Article 6(1)(b) of the GDPR.
    2. Users may optionally create a user account, which allows them, in particular, to view their orders. During the registration process, users are informed of the required mandatory details. User accounts are not public and cannot be indexed by search engines. Once users have cancelled their user account, their data relating to that account will be deleted, unless retention is necessary for commercial or tax law reasons in accordance with Article 6(1)(c) of the GDPR. It is the users’ responsibility to back up their data prior to the termination of the contract. We are entitled to irrevocably delete all user data stored during the term of the contract.
    3. When users register, log in again or use our online services, we store their IP address and the time of the respective user action. This data is stored on the basis of our legitimate interests, as well as the users’ interests in protection against misuse and other unauthorised use. This data is not, as a matter of principle, disclosed to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Article 6(1)(c) of the GDPR.
    4. We process usage data (e.g. the web pages visited on our website, interest in our products) and content data (e.g. entries in the contact form or user profile) for advertising purposes within a user profile, in order to display, for example, product recommendations based on the services the user has previously used.
  5. Contacting us

    1. When you contact us (via the contact form or by email), your details are processed in accordance with Article 6(1)(b) of the GDPR for the purpose of handling your enquiry and processing it.
  6. Collection of access data and log files

    1. On the basis of our legitimate interests within the meaning of Article 6(1)(f) of the GDPR, we collect data on every access to the server on which this service is hosted (so-called server log files). Access data includes the name of the webpage accessed, the file, the date and time of access, the amount of data transferred, confirmation of successful access, browser type and version, the user’s operating system, the referrer URL (the previously visited page), IP address and the requesting provider.
    2. Log file information is stored for a maximum of 14 days for security reasons (e.g. to investigate cases of misuse or fraud) and is subsequently deleted. Data which must be retained for further evidence purposes is exempt from deletion until the respective incident has been fully clarified.
  7. Cookies & Audience Measurement

    1. Cookies are pieces of information that are transmitted from our web server or third-party web servers to users’ web browsers, where they are stored for later retrieval. Cookies may be small files or other forms of information storage.
    2. List of cookies used:

      Name:b2b
      Category:Essential
      Type: Persistent
      This cookie is permanent
      Purpose:Ensures that you have acknowledged the cookie notice

      Name: _ga
      Category:Statistics
      Type: Persistent
      This cookie remains active for 2 years for the statistical tracking of visitors.
      Purpose:Statistical collection of user data.

      Name: _gid
      Category:Statistics
      Type: Persistent
      This cookie remains active for 24 hours.
      Purpose:Statistical collection of user data.

    3. We use ‘session cookies’, which are stored only for the duration of your current visit to our website (e.g. to save your login status or the shopping basket function, thereby enabling you to use our online service at all). A session cookie contains a randomly generated unique identification number, known as a session ID. A cookie also contains information about its origin and storage period. These cookies cannot store any other data. Session cookies are deleted once you have finished using our online service, for example, when you log out or close your browser.
    4. Users are informed about the use of cookies in the context of pseudonymous audience measurement in this privacy policy.
    5. If users do not wish cookies to be stored on their computer, they are asked to disable the relevant option in their browser’s settings. Stored cookies can be deleted via the browser’s settings. Disabling cookies may result in functional limitations on this website.
    6. You can opt out of the use of cookies for audience measurement and advertising purposes via the Network Advertising Initiative’s opt-out page
      (http://optout.networkadvertising.org/) and, additionally, the US website
      (http://www.aboutads.info/choices) or the European website
      (http://www.youronlinechoices.com/uk/your-ad-choices/).
  8. Google Analytics

    1. We use Google Analytics, a web analytics service provided by Google Inc. (‘Google’), on the basis of our legitimate interests (i.e. our interest in the analysis, optimisation and commercial operation of our online service within the meaning of Article 6(1)(f) of the GDPR). Google uses cookies. The information generated by the cookie regarding users’ use of the online service is usually transmitted to a Google server in the USA and stored there.
    2. Google is certified under the Privacy Shield Framework and thereby guarantees compliance with European data protection law
      (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
    3. Google will use this information on our behalf to analyse how users use our website, to compile reports on activity within the website, and to provide us with other services relating to the use of this website and internet usage. In doing so, pseudonymous user profiles may be created from the processed data.
    4. We use Google Analytics to ensure that adverts placed within Google’s advertising services and those of its partners are shown only to users who have demonstrated an interest in our online offering or who exhibit certain characteristics (e.g. interests in specific topics or products, determined on the basis of the webpages visited), which we transmit to Google (so-called ‘remarketing’ or ‘Google Analytics audiences’). We also use Remarketing Audiences to ensure that our adverts are tailored to users’ potential interests and do not come across as intrusive.
    5. We only use Google Analytics with IP anonymisation enabled. This means that users’ IP addresses are truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.
    6. The IP address transmitted by the user’s browser is not combined with any other data held by Google. Users can prevent the storage of cookies by adjusting the settings in their browser software; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online service, as well as prevent Google from processing this data, by downloading and installing the browser plug-in available via the following link:
      http://tools.google.com/dlpage/gaoptout?hl=en.
    7. Further information on Google’s use of data, as well as options for settings and opting out, can be found on Google’s websites: https://www.google.com/intl/de/policies/privacy/partners (“How Google uses data when you use our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Data usage for advertising purposes”), http://www.google.de/settings/ads (“Manage the information Google uses to show you adverts”).
  9. Newsletter

    1. The following information explains the content of our newsletter, as well as the procedures for subscription, distribution and statistical analysis, and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described.
    2. Content of the newsletter: We send out newsletters, emails and other electronic communications containing promotional information (hereinafter “newsletters”) only with the consent of the recipients or where permitted by law. Where the content of the newsletter is specifically described as part of the subscription process, this content forms the basis for the user’s consent. In addition, our newsletters contain information about our products, offers, promotions and our company.
    3. Double opt-in and logging: Subscription to our newsletter takes place via a so-called double opt-in procedure. This means that, after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can subscribe using someone else’s email address. Subscriptions to the newsletter are logged so that we can provide evidence of the subscription process in accordance with legal requirements. This includes storing the time of subscription and confirmation, as well as the IP address. Any changes to your data stored with the mailing service provider are also logged.
    4. Mailing service provider: The newsletters are sent via CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, hereinafter referred to as the ‘mailing service provider’. You can view the mailing service provider’s privacy policy here: https://www.cleverreach.com/de/datenschutz/.
    5. Furthermore, according to the mailing service provider’s own information, it may use this data in pseudonymous form, i.e. without linking it to a specific user, to optimise or improve its own services, e.g. for the technical optimisation of the dispatch and presentation of the newsletters or for statistical purposes to determine which countries the recipients come from. However, the mailing service provider does not use the data of our newsletter recipients to contact them directly or to pass it on to third parties.
    6. Subscription details: To subscribe to the newsletter, you simply need to provide your email address. We also ask you to provide a name so that we can address you personally in the newsletter.
    7. Statistical collection and analysis – The newsletters contain a so-called ‘web beacon’, i.e. a pixel-sized file that is retrieved from the mailing service provider’s server when the newsletter is opened. As part of this retrieval, technical information – such as details about your browser and system – as well as your IP address and the time of retrieval are initially collected. This information is used to improve our services technically, based on the technical data, or to analyse target groups and their reading behaviour based on their access locations (which can be determined using the IP address) or access times. The statistical analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. Although this information can, for technical reasons, be attributed to individual newsletter recipients, it is neither our intention nor that of the email service provider to monitor individual users. Rather, the analyses serve to help us identify our users’ reading habits and tailor our content to them, or to send different content in line with our users’ interests.
    8. The use of the mailing service provider, the carrying out of statistical surveys and analyses, and the logging of the registration process are based on our legitimate interests in accordance with Article 6(1)(f) of the GDPR. Our interest lies in using a user-friendly and secure newsletter system that serves both our business interests and meets users’ expectations.
    9. Cancellation/Withdrawal – You may cancel your subscription to our newsletter at any time, i.e. withdraw your consent. This will simultaneously revoke your consent to its dispatch by the mailing service provider and to the statistical analyses. Unfortunately, it is not possible to withdraw consent separately for the newsletter’s dispatch by the service provider or for statistical analysis. You will find a link to unsubscribe from the newsletter at the end of every newsletter. If users have only subscribed to the newsletter and have cancelled this subscription, their personal data will be deleted.
  10. Integration of third-party services and content

    1. Within our online offering, we incorporate, on the basis of our legitimate interests (i.e. an interest in the analysis, optimisation and commercial operation of our online offering within the meaning of Article 6(1)(f) of the GDPR), to integrate content or services from third-party providers in order to incorporate their content and services, such as videos or fonts (hereinafter collectively referred to as “content”). This always requires the third-party providers of this content to collect users’ IP addresses, as they would be unable to send the content to users’ browsers without the IP address. The IP address is therefore necessary for the display of this content. We endeavour to use only such content where the respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These “pixel tags” enable information, such as visitor traffic on the pages of this website, to be analysed. This pseudonymous information may also be stored in cookies on the user’s device and may include, amongst other things, technical information about the browser and operating system, referring websites, time of visit and further details regarding the use of our online service; it may also be linked to such information from other sources.
    2. The following section provides an overview of third-party providers and their content, together with links to their privacy policies, which contain further information on data processing and – in some cases already mentioned here – options to object (so-called ‘opt-out’):
      1. If our customers use third-party payment services (e.g. PayPal or Sofortüberweisung), the terms and conditions and privacy policies of the respective third-party providers apply; these are available on the relevant websites or within the transaction applications.
      2. External fonts from Google, Inc., https://www.google.com/fonts (“Google Fonts”). Google Fonts are integrated via a server request to Google (usually in the USA).
        Privacy policy: https://www.google.com/policies/privacy/,
        Opt-out: https://www.google.com/policies/privacy/.
      3. Maps provided by the “Google Maps” service from the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
        Privacy policy:https://www.google.com/policies/privacy/,
        Opt-out: https://www.google.com/settings/ads/.
      4. Videos from the “YouTube” platform provided by the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
        Privacy policy: https://www.google.com/policies/privacy/,
        Opt-out: https://www.google.com/settings/ads/.
      5. External code from the “jQuery” JavaScript framework, provided by the third-party provider jQuery Foundation, https://jquery.org.
      6. To provide the WhatsApp chat service, we use the service provided by Whappodo.com! GmbH. On behalf of KWautomotive GmbH, as the website operator, Whappodo.com! GmbH will use your telephone number to provide you with the WhatsApp service. Furthermore, Whappodo.com! GmbH may collect additional personal data stored with WhatsApp, in particular the first name and surname stored with WhatsApp, the device, profile picture and messages/images that you send to us via WhatsApp.
        Further information and the privacy policy of Whappodo.com! GmbH can be found here:
        https://www.whappodo.com/de/datenschutz/
  11. Users’ rights

    1. Users have the right, upon request, to receive information free of charge about the personal data we hold about them.
    2. In addition, users have the right to have inaccurate data rectified, to restrict the processing of, and to have their personal data erased, where applicable, to exercise their right to data portability, and, in the event of unlawful data processing, to lodge a complaint with the relevant supervisory authority.
    3. Users may also withdraw their consent, generally with effect for the future.
  12. Deletion of data

    1. The data stored by us will be erased as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing its erasure. Where users’ data is not erased because it is required for other, legally permissible purposes, its processing will be restricted. This means that the data is blocked and not processed for any other purposes. This applies, for example, to users’ data that must be retained for commercial or tax law reasons.
    2. In accordance with statutory requirements, data is retained for 6 years pursuant to Section 257(1) of the German Commercial Code (HGB) (commercial ledgers, inventories, opening balance sheets, annual accounts, commercial correspondence, accounting documents, etc.) and for 10 years in accordance with Section 147(1) of the German Fiscal Code (AO) (ledgers, records, management reports, accounting documents, commercial and business correspondence, documents relevant to taxation, etc.).
  13. Right to object

    1. Users may object at any time to the future processing of their personal data in accordance with the statutory requirements. In particular, an objection may be raised against processing for the purposes of direct marketing.
  14. Changes to the Privacy Policy

    1. We reserve the right to amend the privacy policy to bring it into line with changes in the legal framework, or in the event of changes to the service or data processing. However, this applies only in respect of statements concerning data processing. Where users’ consent is required, or where parts of the privacy policy contain provisions governing the contractual relationship with users, changes will only be made with the users’ consent.
    2. Users are asked to check the content of the Privacy Policy regularly.