Data protection
I. Name and address of the controller
As defined by the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations the controller is:
Address:
Stegemann Lohnverpackung & Logistischer Service e.K.
Up'n Nien Esch 14
48268 Greven
Phone: +49 2571 9391-0
Fax: +49 2571 9391-22
E-mail: info@stepack.de
Internet: www.stepack.de
II. Name and address of the Data Protection Officer
The controller's Data Protection Officer can be reached at:
E-mail: dsb@stepack.de
III. General information on data processing
The extent to which we process your personal data
Fundamentally, we only collect and use personal data of our users to the extent necessary to provide our content and services and to provide a functional website. We collect and use the personal data of our users periodically, and only with the user's consent. An exception applies in those cases where circumstances prevent us from obtaining your prior consent and the processing of your data is permitted by law.
Legal basis for processing personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 a) GDPR serves as the legal basis.
In the processing of personal data required for the performance of a contract to which the data subject is a party, Art. 6 para. 1 b) GDPR serves as the legal basis. This also applies to any processing that may be necessary in the process leading to the establishment of a contractual relationship.
Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 Para. 1 d) GDPR applies as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 f) GDPR serves as the legal basis for processing.
Data erasure and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the data controller is subject. The blocking or deletion of data will also be carried out if a storage deadline prescribed by the referenced standards expires, unless data storage is a necessity for concluding or performing a contract.
IV. Provision of the website and creation of log files
Description and scope of data processing
Storage of personal user data does not take place, with the exception of cookies for Google Analytics.
Legal basis of data processing
The legal basis for the temporary storage of data is Article 6 1 f) GDPR.
Duration of storage
The data will be deleted as soon as it is no longer needed to achieve the purpose for which it was collected. In the case of data collected in order to provide the website, this occurs once the respective session has ended.
Objection and deletion options
The collection of data for the provision of the website and storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no option for you to object to its collection and retention.
V. Use of cookies
Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored on the Internet browser or by the Internet browser on the user's computer system. If you visit a website, a cookie may be stored on your operating system. This cookie contains a distinctive character string that enables unique identification of the browser when the website is accessed again.
We use cookies to make our website more user-friendly. Some elements of our website require that your browser be identifiable as you move on to another page within the site.
The following data is stored and transmitted in cookies:
(1) Javascript settings
We also use cookies on our website to analyze user behaviour.
The following data can be transmitted in this way
(1) Google Analytics
The user data collected in this way is pseudonymized by technical means. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with the user's other personal data.
When accessing our website, users are informed by an information banner on the use of cookies for analytical purposes and referred to this data protection declaration. A note is also included in this context as to how the user can disable the storage of cookies in the browser settings.
When accessing our website, you will be informed of the use of cookies for analytical purposes and we will obtain your consent for the processing of the personal data used in this context. We will at that time also make reference to this privacy policy.
Legal basis of data processing
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 f) GDPR.
The legal basis for the processing of personal data using cookies for analytical purposes is Art. 6 para. 1 a) GDPR.
Purpose of the data processing
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website will not be available if the use of cookies is disallowed. In such cases, it is necessary that the browser is recognized even after changing the page.
We require cookies for the following applications:
(1) Shopping basket
(2) Applying language settings
(3) Remembering search terms
The user data collected by technically necessary cookies is not used to create user profiles.
The analysis cookies are used to improve the quality of our website and its content. By analyzing cookies, we learn how the site is used and can constantly optimize our service.
For these purposes, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 para. 1 f) GDPR.
Duration of storage, objection and removal options
Cookies are stored on the user’s computer and transmitted from there to our site. Therefore, as a user, you have full control of the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved may be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it is possible that you will no longer be able to use all of its features.
VI. Newsletter
Description and scope of data processing
You can subscribe to a free newsletter on our website. Here is the e-mail address submitted at registration for our newsletter and then stored.
If you purchase goods or services on our website and provide us with your e-mail address, we may subsequently use it to send you a newsletter. In such a case, only direct advertisements for our own similar products or services will be sent via the newsletter.
No data is disclosed to third parties in connection with the data processing for sending newsletters. The data will be used exclusively for sending the newsletter.
Legal basis for processing the data
The legal basis for processing data after the user registers for the newsletter is, if the user's consent to this has been obtained, Art. 6 Para. 1a GDPR.
The legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 para. 3 UWG (Law Prohibiting Unfair Competition).
Purpose of data processing
The collection and processing of the user’s e-mail address is necessary for the distribution of the newsletter.
Duration of storage
The data will be deleted as soon as it is no longer needed to achieve the purpose for which it was collected. Your e-mail address will be stored for as long as your subscription to the newsletter is active.
Options for objecting to the collection of your data and requesting its deletion
The subscription to the newsletter can be terminated at any time by the user concerned. A relevant link can be found in every newsletter for this purpose.
VII. Registration
Description and scope of data processing
On our website, we offer users the opportunity to register, during which you will be asked to provide personal information. The data is entered into an input screen, transmitted to us and then stored. This data shall not be passed on to third parties. The following data is collected during the registration process:
(1) Shipment number
(2) Company
(3) Name
(4) Phone
(5) Fax
(6) E-mail
(7) Date and time of registration
Legal basis for processing the data
The legal basis for the processing of data is Art. 6 para. 1 a) GDPR if the user has given his/her consent.
If registration serves the fulfilment of a contract to which the user is a party or the implementation of pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 b) GDPR.
Purpose of the data processing
The user's registration is necessary for the provision of certain items of content and services on our website.
Our services include tracking, procurement, contact etc.
You have to register in order for us to fulfil or enter into a contractual relationship with you.
Duration of storage
The data will be deleted as soon as it is no longer needed to achieve the purpose for which it was collected.
This is the case for data collected during the registration process for fulfilment of a contract or implementation of pre-contractual measures, if the data is no longer necessary for fulfilment of the contract. Even after conclusion of the contract, it may still be necessary to store personal data of the contractual partner in order to fulfil contractual or legal obligations.
Options for objecting to the collection of your data and requesting its deletion
As a user, you have the option of cancelling your registration at any time. You may at any time change the data we have stored about you.
In the case of erase or change requests, you can contact us via datenschutz@stepack.de.
If the data is required to fulfil or establish a contractual relationship with you, premature erasure of data is only possible insofar as contractual or legal obligations do not preclude erasure.
VIII. Contact via e-mail
Description and scope of data processing
You can contact us via the e-mail address provided. If you use this option, your personal data will be transmitted along with the e-mail, both of which will be stored.
Such data will not be disclosed to third parties in this context. This data will be used exclusively to respond to your enquiry.
Legal basis for processing the data
The legal basis for the processing of data is Art. 6 para. 1 a) GDPR if the user has given his consent.
The legal basis for processing the data transferred in the course of sending an e-mail is Article 6 paragraph 1 f) GDPR. If the e-mail contact aims at the conclusion of a contract, then additional legal basis for the processing is Art. 6 para. 1 b) GDPR.
Purpose of the data processing
In the event of contacting us by e-mail, this also constitutes the necessary legitimate interest in the processing of the data.
The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.
Duration of storage
The data will be deleted as soon as it is no longer needed to achieve the purpose for which it was collected. For the personal data from the contact form input screen and the data that was sent by e-mail, this is the case when the respective conversation with the user has been completed. The conversation is terminated when the circumstances indicate that the matter in question has been finally resolved.
Personal data that was additionally collected during the transmission procedure will be deleted within seven days at the latest.
Objection and erasure options
The user has the option of withdrawing his/her consent to the processing of personal data at any time. If you contact us by e-mail, you may object to the storage of your personal data at any time. If you exercise this right, it will not be possible to continue the conversation.
In such cases, all personal data that was stored when you made contact with us will be deleted.
IX. Google Analytics
Insofar as you have given your consent, is used on this website Google Analytics, a web analytics service provided by Google Inc. ("Google"). The use includes the "Universal Analytics" operating mode. This makes it possible to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus analyze the user's activities across devices. This Privacy Notice is provided by www.intersoft-consulting.de.
Google Analytics uses so-called "cookies", text files that are stored on your computer and that enable you to analyze the utilization of the website. The information generated by the cookie regarding your use of this website is normally transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, within the member states of the European Union or in other states that are party to this European Economic Area (EEA) Agreement your IP address will be abbreviated prior to this by Google. The full IP address will be transferred to a Google server in the USA and abbreviated there only in exceptional cases. We point out that on this website Google Analytics has been extended by the code "anonymizeIp" in order to ensure an anonymous collection of IP addresses (so-called IP masking). The IP address communicated by your browser within the scope of Google Analytics will not be combined with other Google data items. Further information concerning the terms and conditions of use and data privacy can be found at www.google.com/analytics/terms/de.html or at policies.google.com.
Purposes of the processing
At the behest of the operator of this website, Google will use this information to evaluate your utilization of the website, to compile reports on the website activities, and to provide the website operator with other services associated with utilization of the website and use of the Internet.
Legal basis
The legal basis for the use of Google Analytics is your consent according to Art. 6 para. 1 sentence 1 a) GDPR.
Recipient / categories of recipients
The recipient of the data collected is Google.
Transmission to third countries
The personal data is transmitted under the EU-US Privacy Shield based on the adequacy decision of the European Commission in the United States. The certificate is available for download here.
Duration of data storage
The data items sent by us and linked with cookies, user IDs or advertising IDs are automatically deleted after 14 months. Once the retention period for a piece of data has expired, it will be automatically deleted in a process that is run once a month.
Rights of the data subject
You can prevent the cookies being stored by setting your browser software appropriately; however, we do draw your attention to the fact that, in this case, you may perhaps not be able to use all the functions of this website to the full extent.
Furthermore, you can prevent the collection by Google of the data generated by the cookie (including your IP address) and relating to your use of the website and also the processing of these data by Google by downloading and installing the browser plug-in. Opt-out cookies prevent any future collection of your data when you visit this website. In order to prevent data collection by Universal Analytics across multiple devices, you need to perform the opt-out on all systems you are using. If you click here, an opt-out cookie will be set: Deactivating Google Analytics
X. Google Tag Manager
This website uses Google Tag Manager. Using this service, website tags can be managed over an interface. Google Tool Manager only implements tags. This means: No cookies are used, and personal data is not collected. Google Tool Manager triggers other tags that capture data again, if necessary. However, Google Tag Manager does not access this data. If deactivation occurs at domain or cookie level, it remains in use for all tracking tags, insofar as they are implemented with Google Tag Manager.
XI. Google Fonts
This website uses external fonts: Google Fonts. Google Fonts is a service of Google Inc. ("Google"). Integration of these web fonts is implemented via access to a server, typically a Google server in the United States. This transmits information to the server as to which of our website pages you have visited. Google also stores the IP address of the visitor's end-user device’s browser used to access these web pages. For more information, see the Google Privacy Policy, which can be found here:
www.google.com/fonts#AboutPlace:about
www.google.com/policies/privacy/
XII. Your rights as a data subject
If your personal data is processed, you are a data subject as defined by GDPR and you have the following rights vis-a-vis the controller of your data:
Right to information
You may demand confirmation from us as to whether we are processing or have processed personal data concerning you.
If such is indeed the case, you can request the following information from the data controller:
(1) the purposes for which the personal data is being processed
(2) the categories of personal data being processed
(3) the recipients or categories of recipients to whom your personal data has been or will be disclosed
(4) how long the controller plans to store your personal data, or, if specific information in this respect is not possible, the controller's criteria for determining the storage period
(5) the existence of a right to ensure the correction or deletion of the personal data relating to you, of a right to ensure the restriction of processing by the data controller, or of a right to object to said data processing
(6) the existence of a right to lodge a complaint with a supervisory authority
(7) any available information on the origin of the data if the personal data has not been collected from the data subject
(8) the existence of automated decision-making, including profiling, referred to in Article 22 paras. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
You have the right to be informed as to whether your personal data is to be transmitted to a third country or an international organization. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transmission.
Right to rectification
If the personal data that is being processed concerning yourself is incorrect or incomplete, you have an entitlement, vis-a-vis the controller, to have corrections performed or to have the information completed. The controller is required to make these corrections without undue delay.
Right to restriction of processing
You may ask for the processing of your personal data to be restricted under the following conditions:
(1) if you contest the accuracy of your personal data, for as long as it takes the data controller to verify its accuracy
(2) if the processing is unlawful; you reject the deletion of the personal data, demanding instead that the utilization of said data be restricted
(3) the data controller no longer needs the personal data for the purpose of processing, but you need it to be retained in order to establish, exercise, or defend legal claims; or
(4) if you have raised an objection to the processing pursuant to Art. 21 para. 1 GDPR and it has not yet been established whether or not the data controller's legitimate reasons outweigh yours.
If the processing of personal data concerning you has been restricted, then – apart from its storage – this data may only be processed with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person, or for reasons of an important public interest on the part of the Union or a Member State.
If the limitation of the processing has been restricted for any of the grounds listed above, you will be notified by the data controller before the restriction has been lifted.
Right regarding erasure (‘right to be forgotten’)
a) Obligation to erase
You have the right to demand that we delete your personal data immediately and we must do so without delay if any of the following reasons applies:
(1) Your personal data relating to you is no longer necessary for the purposes for which it was originally collected or otherwise processed.
(2) You revoke your consent, on which the processing was based pursuant to Art. 6 para. 1 a) or Art. 9 para. 2 a) GDPR, and there is no other legal basis for the processing.
(3) If you raise an objection to the processing pursuant to Art. 21 para. 1 GDPR and no legitimate reasons that take precedence are advanced for the processing, or you raise an objection to the processing pursuant to Art. 21 para. 2 GDPR.
(4) If the personal data relating to you was processed unlawfully.
(5) If the deletion of the personal data is necessary in order to discharge a legal obligation under European Union law or pursuant to the legislation of member states to which the controller is subject.
(6) If the personal data was collected in respect of services offered by the information society pursuant to Art. 8 para.1 GDPR.
b) Transfer of personal data to third parties
Where the party responsible has made the personal data relating to you public and is obliged to delete this in accordance with Art. 17 para. 1 GDPR, he shall take appropriate measures, including technical measures, taking into account the technology available and the implementation costs, to inform data processors of the personal data that a data subject has requested them to delete all copies or replications of said personal data, including all links to said personal data.
c) Exceptions
The right to erasure does not apply if the processing is necessary
(1) to exercise the right to freedom of expression and information
(2) to fulfil a legal obligation that requires the said processing under the law of the Union or of the Member States to which we are subject or for the performance of a task in the public interest or in the exercise of official authority conferred on the controller
(3) for reasons of public interest in the field of public health pursuant to Art. 9 para. 2 h) and i) and Art. 9 para. 3 GDPR
(4) for archiving purposes, for scientific or historical research purposes or for statistical purposes in the public interest, pursuant to Art. 89 para. 1 GDPR, insofar as the right referred to under a) is likely to render impossible or seriously impair the attainment of the objectives of such processing, or
(5) for the purpose of asserting, exercising, or repudiating legal claims.
Right to information
If you have asserted the right to have your data corrected or deleted or have restricted its further processing, we are obliged to notify all recipients to whom your personal data has been disclosed of this correction, or deletion of the data or restrictions in the processing of the same, unless this proves to be impossible or involves disproportionate effort.
You have the right to be informed about who these recipients are.
Right to data portability
You are entitled to receive the personal data concerning yourself that you have made available to us in a structured, conventional, and machine-readable format. Moreover, you have the right to transmit this data to another data controller without any obstruction from the data controller to whom the personal data has been given, if
(1) processing is based on consent pursuant to Art. 6 para. 1 a) GDPR or Art. 9 para. 2 a) GDPR or on a contract pursuant to Art. 6 para. 1 b) GDPR and
(2) such processing is carried out using automated methods.
In exercising this right, you are furthermore entitled to arrange for the personal data relating to yourself to be communicated by a data controller directly to another data controller, in so far as this is technically feasible. The liberties and rights of other persons must not be impaired in the process.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the data controller.
Right to object
You have the right to object at any time to the processing of personal data concerning yourself on the basis of Art. 6 para. 1 e) or f) GDPR for reasons arising from your particular situation, including profiling based on these provisions.
We will no longer process the personal data relating to you unless we can prove a compelling, legitimate reason for the same which outweighs your interests, rights, and freedoms, or unless the processing serves to assert, exercise, or defend our legal claims.
If the personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to such processing for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct marketing.
If you object to your data being processed for direct marketing purposes, your personal data will no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by using an automated process to which technical specifications are applied.
Right to revoke your consent under data protection law
You have the right to withdraw your consent made under data privacy law at any time. This revocation will not affect the legality of any processing based on your consent that occurred up to said revocation.
Automated decision in individual cases, including profiling
You have the right not to be subjected to a decision based solely on automated processing – including profiling – that has a legal bearing on you or that significantly affects you in a similar manner. This shall not apply if the decision
(1) is necessary for the conclusion or execution of a contract between you and the data controller
(2) is authorized by EU or national law to which we are subject, provided the statutory provisions concerned also set forth suitable measures for safeguarding your rights, and freedoms, and legitimate interests
(3) or is based on your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 a) or g) applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.
In the cases referred to in (1) and (3), we shall take reasonable measures to safeguard your rights, freedoms, and legitimate interests, including, at a minimum, the right to obtain the intervention of a person on our part to state our position and to challenge the decision.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or legal remedy, you are entitled to lodge a complaint with a regulatory authority, especially in the member state in which your place of residence, your workplace, or the place of the suspected infringement is located, if you are of the opinion that the processing of the personal data relating to yourself contravenes the GDPR.
The supervisory authority with which the complaint has been filed shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.
