1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
OSNATOL-Werk GmbH & Co. KG
represented by the Managing Director Mareike Bartels
Bahnhofstraße 14
49191 Belm-Vehrte
Phone: +49 5406 8300-0
Email: info@osnatol.de
2. Data protection officer
[PLACEHOLDER: If a data protection officer has been appointed, enter name and contact details here. Otherwise remove this section.]
3. General information
We take the protection of your personal data seriously and treat it confidentially and in accordance with the statutory data protection regulations and this privacy policy. Personal data is any data that can be used to identify you personally. This policy informs you about which data we collect when you visit our website, how we use it and what rights you have.
4. Legal bases for processing
We process personal data on the following legal bases:
- Art. 6 (1) (a) GDPR, if you have given us your consent, for example via our consent tool.
- Art. 6 (1) (b) GDPR for the performance of a contract or to take pre-contractual steps, for example for product enquiries or applications.
- Art. 6 (1) (c) GDPR for compliance with legal obligations, for example retention obligations under commercial and tax law.
- Art. 6 (1) (f) GDPR to protect our legitimate interests, for example in the secure and stable operation of the website.
Where information on your terminal device is accessed that is not technically necessary, we obtain your consent pursuant to § 25 (1) TDDDG.
5. Hosting and server log files
Our website is hosted by the following provider: [PLACEHOLDER: name and address of the hosting provider, server location Germany/EU].
When you visit our website, the web server automatically stores information transmitted by your browser in so-called server log files. These are: IP address (truncated or deleted after seven days at the latest), date and time of the request, page or file accessed, amount of data transferred, browser type and version, operating system and the previously visited page (referrer URL). This data is not merged with other data sources.
Processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically error-free presentation, security and optimisation of our website. We have concluded a data processing agreement with the hosting provider pursuant to Art. 28 GDPR.
6. SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.
7. Cookies and consent management
Our website uses cookies and similar technologies. We use technically necessary cookies, for example to store your cookie settings or your language selection, on the basis of § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR. All other cookies and services are only loaded after your express consent.
To obtain and manage your consent, we use the consent tool Real Cookie Banner (devowl.io GmbH, Lerchenstraße 19, 71144 Steinenbronn, Germany). The tool stores your decision in a cookie in your browser and as proof of your consent. You can withdraw or adjust your consent at any time via the “Cookie settings” link in the footer of the website.
| Cookie | Purpose | Storage period |
|---|---|---|
| real_cookie_banner-* | Storage of your cookie settings | 12 months |
| pll_language | Storage of the selected language | 12 months |
8. Contact and enquiries
8.1 Contact form
If you send us an enquiry via the contact form, the details you enter (name, company, email address, telephone number and other details requested depending on the request, such as postcode, substrate or product) are transmitted to us and delivered by email to info@osnatol.de. The data is also stored in the website’s content management system for 30 days for verification purposes.
Processing is carried out to answer your enquiry on the basis of Art. 6 (1) (b) GDPR if your enquiry is related to the initiation or performance of a contract, and otherwise on the basis of Art. 6 (1) (f) GDPR. We store your data for as long as is necessary to process your request, at most until statutory retention periods expire.
8.2 Contact by email or telephone
If you contact us by email or telephone, we process the data transmitted to handle your request on the same legal bases as described under 8.1.
9. Applications
Via our careers page you can apply for advertised positions or send an unsolicited application. We process the data you provide (name, contact details, desired position, cover letter and uploaded application documents) exclusively for the purpose of carrying out the application process. The legal basis is § 26 (1) BDSG in conjunction with Art. 6 (1) (b) GDPR. Applications are forwarded exclusively to our HR department.
After completion of the application process, we delete your documents after six months at the latest, unless you are hired or have consented to longer storage for consideration for future positions. If you are hired, the data will be transferred to your personnel file.
10. Google reCAPTCHA v3
To protect our forms against automated misuse (spam), we use the Google reCAPTCHA v3 service on the form pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA v3 analyses visitor behaviour in the background based on various characteristics, such as IP address, time spent on the site, mouse movements and Google cookies set, and transmits this data to Google. A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework. The service is only loaded after you have given your consent via our consent tool. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Without consent, the form is not available. In this case you can reach us by email or telephone.
Further information can be found in Google’s privacy policy at https://policies.google.com/privacy and in the terms of use at https://policies.google.com/terms.
11. Fonts
The fonts used on this website (Manrope, Inter) are hosted locally on our server. No connection to servers of Google or other third parties is established when the fonts are loaded.
12. Icons and scripts
All icons, stylesheets and scripts are delivered from our own server. No content is loaded from third-party content delivery networks.
13. External links to Google Maps
No map material is embedded on our website. The “Plan route” button on the contact page leads to Google Maps via an external link (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Only when you click this link do you leave our website; from that moment on, Google’s privacy policy applies (https://policies.google.com/privacy). Merely visiting our contact page does not transmit any data to Google.
14. Downloads
When you download documents from our download area, no personal data is collected beyond the log data mentioned under section 5. In future, access with an email address and personal access PIN may be required for protected product data sheets. In this case we store your email address for access management on the basis of Art. 6 (1) (b) GDPR.
15. Social media links
On our website we refer to our profiles on Facebook, Instagram and LinkedIn via simple links. No social media plugins are embedded. No data is transmitted to these providers when you visit our website. Only when you follow a link does the privacy policy of the respective provider apply.
16. Search engine optimisation
For technical search engine optimisation we use the WordPress plugin Rank Math SEO. The plugin does not process any personal data of website visitors and does not transmit visitor data to third parties.
17. Recipients and transfers to third countries
Your data is only passed on to third parties insofar as this is necessary for the purposes mentioned, in particular to our hosting provider as a processor. A transfer to third countries outside the EU or EEA only takes place in the context of the use of Google reCAPTCHA described under section 10 and only with your consent.
18. Storage period
Unless a specific storage period is stated in this policy, your data remains with us until the purpose of processing no longer applies. Statutory retention obligations, in particular under commercial and tax law (six or ten years), remain unaffected.
19. Your rights
You have the following rights vis-à-vis us with regard to your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw consent with effect for the future (Art. 7 (3) GDPR)
An informal message to the contact details stated under section 1 is sufficient to exercise your rights.
20. Right to object
Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
21. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:
The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hannover
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
22. Changes to this privacy policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The current version then applies to your next visit.
As of: [PLACEHOLDER: go-live date]