Table of Contents
I. General information on Data Protection
III. Information for business partners
- General information on Data Protection
1.1 Information about the Data Controller:
BDR Thermea Group B. V.
Kanaal Zuid 106
NL-7332 BD Apeldoorn
We attach particular importance to protecting your personal data. Your personal data is processed in accordance with the data protection regulations, in particular the General Data Protection Regulation of the European Union (GDPR).
The following information provides an overview of the nature, extent and purpose of collecting, processing and transferring personal data as well as the safety measures deployed to protect these data.
Personal data are individual information on personal or factual circumstances of an identified or identifiable natural person such as e.g. your name, address, telephone number, your date of birth as well your e-mail and IP address.
1.2 Legal basis for the processing of personal data
- As far as we obtain a consent of the data subject for the processing of personal data, Art. 6 (1) a GDPR serves as legal basis. You can withdraw this processing at any time in accordance with Art. 7 (3) GDPR.
- Art. 6 (1) b GDPR serves as legal basis for the processing of personal data required for the performance of a contract or for the execution of pre-contractual measures.
- If processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) c GDPR serves as legal basis.
- If the processing is necessary for the preservation of the legitimate interest of our company or of a third party and if the fundamental rights and freedoms of the person concerned do not predominate, Art. 6 (1) f GDPR serves as legal basis for processing. In this case, you have the right of objection according to Art. 21 GDPR.
1.3 Data deletion and storage period
Personal data will be deleted as soon as the purpose for storage no longer applies. Due to legal retention periods, we may be obliged to store the data for a longer period of time.
1.4 Your Rights
Upon written request, we will inform you in accordance with Art. 15 GDPR and in accordance with our legal obligation under Art. 12 GDPR whether and which of your personal data is processed or stored by us. Furthermore, you have the right to have incorrect data corrected in accordance with Art. 16 GDPR, data transferability in accordance with Art. 20 GDPR, blocking and deletion of your personal data in accordance with Art. 17 GDPR – provided that there are no legal storage obligations to the contrary – as well as the right to restrict processing in accordance with Art. 18 GDPR. In addition, you have the right to contact the competent supervisory authority pursuant to Art. 77 GDPR.
In addition, you have the right to object pursuant to Art. 21 GDPR.
You have the right to withdraw your consent at any time in accordance with Art. 7 (3) GDPR. To do this, please refer to the contact address below.
If you have any questions regarding the processing of your personal data, you can contact our privacy contact person, who is ready to assist with any enquiries, suggestions and complaints that you may have.
Privacy contact person of
BDR Thermea Group B. V.
Kanaal Zuid 106
NL-7332 BD Apeldoorn
1.5 Changes to our Privacy Statement
We reserve the right to make changes to our privacy statement to ensure that our privacy statement is always up to date with the current legal regulations. This applies also when the privacy statement needs to be adjusted due to new or redesigned services. The new privacy statement will then take effect the next time you use our services.
2.1 Provision of the website
Use of hosting service providers
Our website is hosted on servers of a hosting service provider, which is located in the EU, based on an order processing according to Art. 28 GDPR. Within the scope of its services, the hosting service provider may have access to personal data of our users, in particular to technical data, which arise within the scope of the technical communication between you and our website (e.g. server log files). However, he may not use them for his own purposes. The use of a hosting service provider is based on our legitimate interests pursuant to Art. 6 (1) f GDPR in the provision of infrastructure and platform services, computing capacity, e-mail dispatch and security services.
When you visit our website or use our services the device used for accessing the site automatically transmits log data (connection data) to our servers. The relevant information consists of:
- The browser and its version number,
- The operating system and its version number,
- The referrer URL, which is the website you visited before switching to our website,
- The date and time of access to our website,
- The name of the subpages,
- The corresponding IP address,
- The amount of data transmitted.
The data collected are used exclusively for evaluating the data statistically to ensure operation and safety and to optimise processing of the offer. For security grounds, however, we reserve the right to inspect log files retroactively if we have sufficient grounds to suspect illegal usage. The data will not be stored for longer than necessary. This collection is carried out on the basis of our legitimate interest under Art. 6 (1) f GDPR.
Cookies are small files, which are stored on the visitor’s hard disk drive. Cookies do not damage your computer and do not contain viruses. Most cookies used on the website are so-called “session cookies”. They are automatically deleted after the end of your visit. Other cookies stay on your devices and make it possible for your browser to be recognised the next time you visit. These files can be used, for example, to display information on the page that is specifically tailored to your interests.
Security of Your Data
We deploy technical and organisational security measures to adequately protect the data that you have made available to us from being unintentionally or intentionally manipulated, lost, destroyed or accessed by unauthorised persons. Therefore, we are using SSL encryption for the transmission of confidential content e.g. enquires which you send to us as the site operator. An encrypted connection can be recognised when the web address changes from “http://” to “https://” and a padlock symbol is shown in your browser bar. When SSL encryption is activated, third parties cannot read the data that you transmit to us. Our security measures are kept up-to-date.
2.2 Contact us
If you contact us (e.g. via contact form, e-mail, telephone, social media), your personal data will be stored and processed by us for the purpose of processing the enquiry and any related follow-up questions pursuant to Art. 6 (1) b GDPR (within the framework of pre-contractual / contractual measures) or pursuant to Art. 6 (1) f GDPR (general enquiries). This data is not transferred to third parties without your consent.
The data entered into the contact form remain with us until you request that they be deleted, you withdraw your consent to the storage of your data, or the purpose of the data storage is no longer given (i.e. after the successful processing of your request), provided there are no legal storage obligations to the contrary.
When you sign up on our website to get access to BDR Thermea Group Digital ISH 2021, personal data will be collected. Signing up allows you to access services and contents which are only available to registered users. If needed, registered users have the possibility to alter or delete data provided in the framework of registration at any time. Where appropriate, your data used for the registration process are transmitted to providers (Art. 28 EU DS-GVO) commissioned by us. Your personal data are not disseminated to third parties in any other way. The processing of your personal data is carried out within the framework of implementing the contract (in accordance with Art. 6 (1) b GDPR). Deletion of your data is carried out in accordance with the applicable statutory retention periods.
When you subscribe to our newsletter on our website we use the personal data you provide only for distributing the newsletter.
The subscription to our newsletter takes place by way of the double opt-in process. This means that upon signing up you receive an email that requests you to confirm your subscription. This confirmation is necessary to prevent the use of third-party email addresses. The subscriptions to our newsletter are recorded so that the subscription process can be retraced in accordance with legal requirements (consent pursuant to Art. 6 (1) lit. a) GDPR). This includes the logging of the time of subscription, the time of confirmation and the IP address.
Any data that we obtain from you as well as the logging information will not be disseminated to third parties according to Art. 4 No. 10 GDPR. Your consent to the collection and storage of your data as well as their usage for the distribution of the newsletter can be withdrawn at any time without stating any reasons. A link to cancel your subscription can be found at the end of every newsletter.
The analysis measures listed below and used by us are carried out on the basis of Art. 6 (1) a GDPR (consent). With the use of these analysis measures, we want to ensure that our website is designed to meet requirements and is continuously optimised. Using the analysis tools, we record the use of our website under a pseudonym and evaluate it for the purpose of optimising our services.
You can withdraw this processing at any time in accordance with Art. 7 (3) GDPR.
Google Tag Manager
This website uses Google Tag Manager. Google Tag Manager is a solution offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 Ireland, with which the company can administer website tags via an interface. The tool itself (which implements the tags) is a cookie-free domain that collects no personal data. Google Tag Manager triggers other tags which may collect data. Google Tag Manager does not access this data. If on the domain or the cookie level a deactivation is configured by the user, such deactivation is retained for all tracking tags that were implemented with Google Tag Manager. The tags used are named separately below and can be individually edited by you in the privacy settings, for example by deactivating cookies for these elements. Further information http://www.google.com/tagmanager/use-policy.html
This website uses the functions of the web analysis service Google Analytics. It is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 Ireland. Google Analytics uses so-called “cookies”. These are text files which are stored on your computer and make it possible to analyse your use of the website. Deletion of the user and results data takes place after 4 months.
We have activated an IP anonymisation function on this website. Through this, Google shortens your IP address prior to its transfer to the USA provided that you are within a member state of the European Union or in another contracting state to the Agreement on the European Economic Area. In exceptional circumstances only, the full IP address is transmitted to a server of Google in the USA and shortened there. Google uses this data on behalf of the website operator to evaluate the use of the website, to compile reports about website activities and to provide other website services related to website and internet usage on behalf of the website provider. Your IP address, collected in the context of Google Analytics, is not combined with other data provided by Google.
Browser Plugin / Prevention of data collection
You can prevent the storage of cookies with the appropriate settings in your browser. Please note, however, that if you do so not all features of the website will be available to you. Furthermore, you can prevent Google from gaining access to the data created by the cookie and your usage data (incl. your IP address) and prevent Google from processing such data by downloading the following plug-in for your browser: https://tools.google.com/dlpage/gaoptout?hl=en
More information regarding the handling of user data by Google Analytics is available at Google under the following link: https://support.google.com/analytics/answer/6004245?hl=en
2.6 Contents and Services of Third Parties
Based on the legitimate interest of the provider according Art. 6 (1) f GDPR, a situation can arise where contents, services and benefits of third parties are integrated which complement our service offerings. With the use of the following services, we want to ensure a customised design and the continuous optimisation of our website.
We use “Google reCAPTCHA” (hereinafter “reCAPTCHA) on our website. reCAPTCHA is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 Ireland (“Google”). In order to ensure sufficient data security when forms are transmitted, we use the Google reCAPTCHA service in certain cases. This serves above all to differentiate whether the input is made by a natural person or whether it is misused by mechanical and automated processing. To this end, reCAPTCHA analyses the behaviour of the website visitor on the basis of various characteristics. This analysis starts automatically as soon as you visit the website. For analysis purposes, reCAPTCHA evaluates various information (e.g. IP address, length of stay of the website visitor on the website or mouse movements made by the user).
However, if IP anonymisation is enabled on this website, Google will previously truncate your IP address within member states of the European Union or other signatory states to the Agreement on the European Economic Area. Google uses this information to evaluate your use of this service. The IP address transmitted by your browser as part of reCAPTCHA is not merged with other data from Google. These data are subject to the differing data protection regulations of Google. The processing takes place on the basis of our legitimate interest to protect our web offers from abusive automated spying and from SPAM.
Google Web Fonts
In order to promote the consistent presentation of fonts, this site uses so-called web fonts which are made available by Google. When visiting a web page, your browser downloads the required web fonts into its cache so that texts and typefaces are rendered correctly.
To this end, your browser must connect with Google servers. Thereby, Google becomes aware that our website has been accessed using your IP address. The use of Google Web Fonts is carried out for the sake of a uniform and appealing presentation of our online offer. This is considered legitimate interest under Art. 6 (1) f GDPR. If your browser does not support web fonts, a standard font from your computer is used instead.
This website uses services provided by Cloudflare. The provider is Cloudflare Inc, 101 Townsend St, San Francisco, CA 94107, United States of America. CloudFlare offers a worldwide distributed content delivery network with DNS. Technically, the transfer of information between your browser and our website is routed through CloudFlare’s network. CloudFlare is thus able to analyse the data traffic between users and our websites, for example, in order to detect and ward off attacks on our services. It is possible that Cloudflare uses its own cookies to provide these services.
Amazon Web Service (AWS)
This website uses functionalities of Amazon Web Service (AWS). The provider is Amazon Web Services, Inc, 410 Terry Avenue North Seattle, WA 98109 USA. Amazon Web Service is a web hosting and cloud computing platform. These are services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity). Further information on the processing of your data at Amazon can be found on the website: https://aws.amazon.com/de/ and in the data protection declaration: https://aws.amazon.com/de/privacy/?nc1=f_pr.
3Q (Video Streaming)
This website uses the jQuery service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 Ireland. By using jQuery, an optimisation of the loading speed is achieved. For this purpose, program libraries are called up from Google servers. Google’s CDN (content delivery network) is used. If you have already used jQuery on another page from the Google CDN, your browser will fall back on the copy stored in the cache. If this is not the case, downloading is required. For this purpose, the browser you are using must connect to Google’s servers. This enables Google to know that our website has been accessed via your IP address.
You can find out more at: https://developers.google.com/speed/libraries/#jquery and under the data protection regulations of google.de at: https://www.google.com/policies/privacy/.
Links to websites of third parties
Based on the legitimate interest of the provider, it may occur that contents, services and benefits of third parties are integrated which complement our service offerings. When you access web pages which are linked on this website, information such as your name, IP address, browser details etc. can be retrieved again. This Privacy Statement does not govern the collection, dissemination or the processing of personal data by any third parties. In this regard, please also pay attention to the individual privacy statements of the respective third-party providers and service providers to which we link on our website.
We principally address adult persons with our online offer. Personal information of persons under 16 years of age may only be made available to us with the explicit consent of their legal guardian (Art. 8 GDPR). Processing without the consent of the legal guardian is not permitted. We therefore reserve the right to delete all data relating to minors unless we have the consent of a parent or guardian.
- Information for business partners
3.1 Purpose and legal basis for the collection and processing
The primary purpose of data processing is the creation, execution or termination of the contractual relationship. The primary legal basis for this is Art. 6 (1) b GDPR. Without this type of use of your data, the business relationship existing between you and us cannot be carried out.
We also process your data on the basis of Art. 6 (1) f GDPR to protect our legitimate interests or those of third parties (e.g. public authorities). This may be necessary, for example, to maintain IT security and IT operations or for purposes of corporate management, internal communication and other administrative purposes. You can object to this processing by giving special reasons in accordance with Art. 21 GDPR.
In addition, we process your data to fulfil legal obligations, such as regulatory requirements, commercial and tax law storage obligations or documentation obligations. The legal basis for this is Art. 6 (1) c GDPR in conjunction with the nationally applicable laws.
In individual cases, it may also happen that we process your data on the basis of your separately granted consent in accordance with Artt. 6 (1) a, 7 GDPR (e.g. in the context of registering for our newsletter or publishing photo and video recordings). You are always free to decide whether you wish to give your consent. Once you have given your consent, you can withdraw it at any time with effect for the future. To do so, please send corresponding enquiries to the contact address given above.
Should we process your personal data for a purpose not mentioned above, we will inform you of this in advance.
3.2 Recipient of your data
Within our company, only those persons receive your personal data who need it to fulfil our contractual and legal obligations. In addition, we sometimes use different service providers to fulfill these obligations, so that it may be necessary to transfer your personal data to other recipients outside the company to the extent necessary to fulfill our contractual and legal obligations. These third parties can be, for example, authorities, financial institutions, suppliers, etc.
To process your data technically, we sometimes use external service providers. It is possible that we may transfer and process your data outside the country in which you have your residence / company headquarters or in one of the countries in which we operate. You can also request detailed information by using the contact information above.
3.3 Storage of your data
We store your personal data only as long as they are necessary for the above-mentioned purposes. After termination of the contractual relationship, your personal data will be stored for as long as we are legally obliged to do so. This regularly results from legal obligations to provide evidence and to retain data. In addition, personal data may be stored for the time during which claims can be made against us (statutory limitation period of three or up to thirty years).