Information about data protection

1.  Introduction

This website is provided by BEHR AG. In the following, we inform you in accordance with Article 13 of the General Data Protection Regulation (GDPR) about the processing of your personal data when you access and use our website.

2.  Responsibilities

You can contact the data controller at the following address:

BEHR AG

Parkstraße 2

21220 Seevetal

Germany

Phone: +49 (0) 4185 79 33 – 40

E-mail: info@behr-ag.com

Further information can be found in the imprint.

3.  Datenschutzbeauftragter

You can contact our data protection officer in writing by sending a letter marked 'Data protection officer’ to the address specified in the legal notice, via E-mail at datenschutz@behr-ag.com or at

IT.DS Beratung

Klecker Weg 14a

21244 Buchholz

Germany

Phone: +49 (0) 4181 / 2109 1514

Web: https://itdsb.de/

4.  Processing of personal data

4.1.  General overview of the processing activities

Below you will find an overview of the processing activities, which are described in detail further down:

• Operation of the website
• Use of cookies
• Use of cookie consent
• Presentation of videos
• Presentation of maps
• Use of social media links
• Joint responsibility for social media presence
• Job applications
• Customers and business partners

4.2.  Operation of the website

4.2.1.  Nature and scope of data processing

The following information, which your browser automatically transmits to us, is processed when you visit our website:

• IP address: Identifier of your device in the network. If you use a firewall or a proxy, its IP address may be displayed here
• Host name: The location of your device may be located via the IP address. The host name is determined from the IP address and may provide information about the origin (domain) of the end device (e.g. provider or university)
• Browser and operating system: e.g. Google Chrome or Windows 10
• Cookies: Cookies contain information that the website or domain you access may have stored on your device and that can be read again.
• Language: Language you have set in your browser
• Previous website: The website you used before

If you have activated the JavaScript function in your browser, additional information can also be read from your browser every time you access the page, such as

• Screen resolution, e.g. 1680 x 1050

• Colour depth (e.g. 24 bit)

• Size of browser window (e.g. 1680 x 917)

4.2.2.  Purposes and legal basis

Your personal data is processed for the following purposes in accordance with Art. 6 para. 1, subpara. 1 (f) of the GDPR.

• Enabling the use of the website: We have a legitimate interest in presenting our portfolio of services
• Ensuring the stability and security of the website: We have a legitimate interest in fulfilling legal obligations and asserting legal claims when defending against and investigating cyberattacks

4.2.3. Recipients or categories of recipients

Our website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4—6, 32339 Espelkamp. Personal data is disclosed to the extent that it is necessary for the prevention of criminal offences and/or we are otherwise legally obliged to do so.

4.2.4.  Transfer to a third country or an international organisation

No data is transferred to a third country.

4.2.5.  Duration of storage

The personal data is automatically deleted four weeks after the end of the connection, unless there are any statutory retention periods to the contrary.

4.2.6.  Information about your rights

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. There is therefore no possibility of deletion, objection or correction.

4.3.  Use of cookies

4.3.1.  Nature and scope of data processing

Our website uses cookies to offer you a convenient and highly functional online service and to verify your entitlement to use the services offered. Cookies are text files that contain information to identify returning visitors only for the duration of their visit to the website. Cookies are stored on the hard drive of your computer and do not cause any damage there.

The website cookies contain personal data. Cookies save you from having to enter data multiple times, make it easier to transmit specific content, and help us to identify particularly popular areas of our website. They enable us to continuously improve the structure and content of our website. The following cookies are stored on your device:

4.3.2.  Purposes and legal basis

The legal basis for the processing of personal data using technically necessary cookies is Article 6, paragraph 1, subparagraph 1, point (f), of the GDPR. The legal basis for the storage is provided in accordance with section 25, paragraph 2, subparagraph 2 of the German Act on the Regulation of Data Protection and the Protection of Privacy in Telecommunications and Telemedia (TTDSG). The storage of the cookie is necessary in order to save the settings for your consent.

The legal basis for the processing of your personal data using cookies to store your consent is Art. 6 para. 1 (a) of the GDPR.

4.3.3.  Duration of storage

Cookies are stored on your computer. The storage period can be found in the table above.

4.3.4.  Information about your rights

You can deactivate or restrict the transfer of cookies by changing the settings in your Internet browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, you may no longer be able to use all functions of the website to their full extent. You can change your settings at any time by clicking on the icon at the bottom left of the screen.

4.4  Use of cookie consent

We have used the cookie consent tool provided by Osano Inc. on our website.

4.4.1.  Nature and scope of data processing

In order to meet the legal requirements, we have decided to obtain your consent to the use of cookies and/or tracking technologies using the cookie consent tool. Once you have made your decision, a cookie will be stored on your device for one year and the cookie notice will no longer be displayed when you access the page. According to the manufacturer, your IP address is transmitted in order to determine whether displaying the legal notice is relevant at all.

4.4.2.  Purposes and legal basis

The cookie stores your decision when you visit the website as to whether or not you have consented to data processing that requires your consent. The cookie is then stored on your computer so that you do not have to repeat the questions each time you access it. The legal basis for this is Art. 6 para. 1 subpara. 1 (f) of the GDPR. We have a legitimate interest in the implementation of the legally necessary requirements and the attractive design of our website.

4.4.3.  Recipients or categories of recipients

Your settings are processed locally on our website.

4.4.4.  Transfer to a third country or an international organisation

No data is transferred to a third country.

4.4.5.  Information about your rights

You can prevent the execution of cookie consent by using tools such as Ghostery or by preventing the setting of cookies in your browser. However, you may then no longer be able to access all services on the website. You can change your settings at any time by clicking on the icon at the bottom left of the screen.

4.4.6.  Other information

You can find details on cookie consent at https://www.osano.com

4.5.  Presentation of videos

We have integrated various videos from YouTube on our website. When you view a video, a connection is established to the servers of the service providers and the video is displayed on our website.

4.5.1.  Nature and scope of the processing of personal data

When the videos are accessed, the data specified in 4.2.1 is passed on to the service providers so that the video can be displayed. The videos are embedded on YouTube in “extended data protection mode”. The form of embedding ensures that only a small amount of data is transmitted to the service provider when the videos are viewed. At the same time, the fonts used by service provider (Google Fonts) are loaded and cookies are set.

4.5.2.  Purposes and legal basis

The processing of your personal data is carried out by the controller on the basis of your consent pursuant to Art. 6 para. 1 subpara. 1 (a) in conjunction with Art. 7 GDPR. If you do not give your consent, the videos will not be displayed to you.

4.5.3.  Recipients or categories of recipients

By viewing the service provider’s video, your data is transferred to the following companies:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland

4.5.4. Transfers to a third country or an international organisation

Your personal data is transferred to the following company in a third country on the basis of your consent pursuant to Article 49 para 1(a) of the GDPR:

• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

4.5.5  Duration of storage

We are not aware of how long the service providers store the above-mentioned data.

4.5.6.  Information about your rights

You can prevent the assignment to your account by logging out of your user accounts and deleting the corresponding cookies before using our website. You can also prevent videos from being played by deactivating the JavaScript functionality in your browser. You can revoke the transfer of your personal data at any time with effect for the future by clicking on the video. To do this, adjust your settings by clicking on the icon at the bottom left of the screen.

4.5.7.  Other information

Further information on data processing and data protection information can be found at:

YouTube: www.google.de/intl/de/policies/privacy/

4.6.  Map display

On our website we have integrated various CartoDB maps. When you view a map, a connection to the servers of the service provider is established and the map is then displayed on our website.

4.6.1.   Nature and scope of the processing of personal data

When the maps are accessed, the data specified in 4.2.1 is transmitted to the service provider.

4.6.2.  Purposes and legal basis

The processing of your personal data takes place on the basis of your consent pursuant to Art. 6 para. 1 subpara. 1 (a) in conjunction with Art. 7 GDPR. If you do not give your consent, the maps will not be displayed to you. A data processing agreement pursuant to Article 28 of the GDPR has been concluded with the service provider.

4.6.3.  Recipients or categories of recipients

By displaying the map of the service provider, your data is transmitted to the following company:

• Fastly Inc., PO Box 78266, San Francisco, CA 94107, USA
• CartoDB Inc. , 307 Fifth Avenue, Floor 9, New York, NY 10016, USA

4.6.4.  Transfers to a third country or an international organisation

The transfer of personal data to a third country takes place on the basis of the adequacy decision between the EU and the USA. Further information can be found at the following link to CartoDB Inc. and Fastly Inc.

 4.6.5  Duration of storage

We are not aware of how long the service providers store the above-mentioned data.

4.6.6.  Information about your rights

You may revoke your consent with future effect at any time. To do this, adjust your settings by clicking on the icon at the bottom left of the screen.

4.6.7.  Other information

Further information on data processing and data protection information can be found at

https://carto.com/privacy

4.7  Use of social media links

We use social media links from various providers on our website. When you visit our website, no personal data is initially transmitted to the provider.  This only takes place when you click on the link to the respective provider. They will then receive the information that you have visited our website with your IP address.

We would like to point out that, as the provider of the website, we do not have any knowledge of the content of the data transmitted or how it is used. Further information on this can be found in the relevant information on data protection at:

Facebook: https://de-de.facebook.com/policy.php

Instagram: https://privacycenter.instagram.com/policy

Pinterest: policy.pinterest.com/de/privacy-policy

4.8  Joint responsibility for social media presences

We offer you further information about our services on our social media pages. For the information service offered, we are jointly responsible for data processing together with the providers.

4.8.1  Nature and scope of data processing

We use the personal data that you transmit to the operators in the context of the use of the social media pages to analyse the use of our fan page and to tailor our offering to target groups. In doing so, we use statistical reports such as the total number of page views, "like" information, end devices used, page activities, post interactions and reach, user activities (comments, shared content, answers), origin (country and city), language, views and clicks in the shop, age group, gender, educational level, profession, relationship status, clicks on telephone numbers or groups linked to our site. We also use users’ preferred visiting times to optimise the timing and content of our posts.

As the provider of the information services, we do not process any other data from the use of our fan pages. However, in accordance with the terms of use that you agreed to when creating your social media profile, we may identify the subscribers or users of our fan pages and view your profile and other information shared by them and contact you.

4.8.2  Purposes and legal basis

Together with the provider, we are jointly responsible for the information service offered in accordance with Article 26 of the GDPR. The legal basis for the processing of personal data is Art. 6 para. 1, subpara. 1 (f) of the GDPR. Our legitimate interest arises from the aim of optimising our social media channel. Information on the agreements can be found at:

• https://business.pinterest.com/de/pinterest-advertising-services-agreement/rest-of-apac/
• https://de-de.facebook.com/legal/terms/page_controller_addendum

4.8.3 Recipients or categories of recipients

Data processing is carried out by the following companies:

• Meta Platforms Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland.
• Pinterest Inc., 651 Brannan Street, San Francisco, CA 94107, USA.

4.8.4  Transfer to a third country or an international organisation

Your data will be transferred to the following companies in a third country:

• Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA übermittelt werden.

• Pinterest Inc., 651 Brannan Street, San Francisco, CA 94107, USA.

4.8.5  Information about your rights

Since only the provider has full access to the user data, we recommend that you contact the provider directly if you wish to exercise your rights as a data subject. Requests sent to us to exercise your rights will be forwarded to the provider. You can find more information about this in the following links:

Facebook: https://de-de.facebook.com/policy.php

Instagram: https://privacycenter.instagram.com/policy

Pinterest: policy.pinterest.com/de/privacy-policy

4.9   Job applications

4.9.1  Nature and scope of data processing

You can send us your application documents including attachments for the job advertisements listed by us using a form. The following data is required for us to process your application and is marked with an asterisk “*” on the form:

• Personal master data (e.g. title, first name, surname)

• Address and communication data (e.g. address, e-mail address, telephone number)

• Application data (e.g. cover letter, CV, references)

• Information from correspondence and interviews

• Log data and metadata resulting from the use of IT and telecommunications systems

You also have the option of sending voluntary information, such as an application photo or a personal message. The processing of health data provided voluntarily is necessary for the exercise of the rights and obligations arising from Part 3, Book 9 of the German Social Code (Sozialgesetzbuch).

4.9.2  Purposes and legal basis

We have received your personal data directly from you or, in consultation with you, from one of our HR service providers. Your data will only be processed for application purposes. The legal basis for the processing of the data is in accordance with Art. 6 para. 1 subpara. 1 (b) of the GDPR to initiate an employment relationship.

4.9.3  Recipients or categories of recipients

Your application data will be processed within the company insofar as this is necessary to establish the employment relationship. We also use processors in accordance with Article 28 of the GDPR who are responsible for operating and maintaining our network and the devices and applications used. Where appropriate, the data is transmitted to third parties, such as legal advice or authorities, if you have given your consent or if this is necessary due to a legitimate interest on our part or on the part of a third party, such as for the assertion, exercise or defence of legal claims.

4.9.4  Transfer to a third country or an international organisation

Your data will not be transferred to a third country.

4.9.5  Duration of storage

The data will be processed until the application process has been completed. If we choose another candidate, your data will be deleted six months after your rejection. In individual cases, a storage period may extend beyond the decision on the establishment of the desired contractual relationship. This would be the case, for example, if there are indications that you may assert claims against us. The data is then stored for as long as the processing of the data is necessary for the establishment, exercise or defence of legal claims. The criteria for retention may include periods pursuant to laws such as Section 15 para. (4) sentence 1 of the German Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz), Section 61 b of the German Labour Court Act (Arbeitsgerichtsgesetz), limitation periods or statutory retention obligations.

4.9.6  Information about your rights

You have the right to request information from us at any time about the data we process about you, as well as its origin, recipients or categories of recipients to whom this data is passed on and the purpose of the processing. You may object to the use of your data for the aforementioned purposes at any time with effect for the future and have it deleted. To do so, please send an email to the data protection officer at the address provided above.

4.9.7  Other information

You are not obliged to provide us with personal data in order to carry out the application process. However, we are unable to carry out the application process without your personal data, which is necessary for the assessment of your professional career, your qualifications, your availability and the establishment of contact. If you do not provide us with the necessary health data pursuant to Article 9, paragraph 1 of the GDPR, we will be unable to comply with the rights and obligations arising from Part 3, Book 9 of the German Social Code (Sozialgesetzbuch).

4.10.  Customers and business partners

4.10.1  Nature and scope of data processing

We process personal data that we have received from you or your employer in the course of our business relationship. We also process – where necessary for the provision of our service – personal data that we have lawfully received from other companies or other third parties (e.g. for the execution of orders, for the fulfilment of contracts or on the basis of your consent).

In accordance with the statutory requirements, we may process data that you have made public. Key data categories are:

• Personal master data

• Communication data

• Company details

• Invoice data

• Authentication data

• Quotation, order and contract data

• Correspondence and notes

• Log data and metadata from electronic or telephone communication.

4.10.2  Purposes and legal basis

The processing of personal data is carried out in accordance with Art. 6 para. 1 subpara. 1 (b) of the GDPR primarily for the initiation and implementation of concluded contracts or for the purpose of taking steps prior to entering into a contract with our customers and business partners as well as for all services associated with the contract

In addition, as a company, we are subject to legal obligations pursuant to Art. 6 para. 1 subpara. 1 (c) of the GDPR, such as the German Commercial Code (Handelsgesetzbuch), the German Fiscal Code (Abgabenordnung) or the German Money Laundering Act (Geldwäschegesetz).

The processing of personal data is additionally carried out in accordance with our legitimate interests or with those of third parties pursuant to Art. 6 para. 1 subpara. 1(f) of the GDPR. These include, but are not limited to:

• The processing of contact details and contact history to allow consistent and coordinated corporate communication with you
• The fulfilment of the obligation to provide evidence of legal requirements, such as the General Data Protection Regulation,
• Ensuring IT security and IT operations
• Direct marketing measures such as Christmas cards, invitations to events or birthday greetings to existing customers and business partners in accordance with Section 7 of the German Act Against Unfair Competition (UWG)
• Measures to further develop services and products
• Business and risk management measures in the Group, such as the prevention of money laundering and the financing of terrorism
• Asserting, exercising or defending any legal claims on our part or on the part of third parties

No automated decision-making (including profiling) within the meaning of Art. 22 GDPR is used.

4.10.3  Recipients or categories of recipients

The data is transferred to the following recipients for a specific purpose:

• Internal employees within the group of companies for the specific implementation of the aforementioned purposes
• Public bodies that receive data on the basis of statutory regulations (e.g. social security agencies, authorities) and, in the context of state-subsidised housing, to auditors/tax advisers, city/municipal administrations and notaries
• External processors (service companies) to process data on our behalf in accordance with Art. 28 of the GDPR
• Other external bodies such as companies belonging to the Group or other external bodies for the fulfilment of the aforementioned purposes, insofar as you have given your written consent, this is necessary for the fulfilment of the contract, is prescribed by law or a transfer is permissible due to our overriding legitimate interests or those of third parties, such as legal advisors, auditors, experts, or investors

4.10.4  Transfer to a third country or an international organisation

As a rule, your data will be processed within the EU. If we intend to process your data in a third country, we ensure that the recipients have the appropriate safeguards in accordance with Article 44 et seq. of the GDPR in order to ensure an appropriate level of data protection. Possible safeguards include an appropriate level of protection as determined by the EU Commission, e.g. in Switzerland or Canada, your consent to data processing or EU standard contractual clauses concluded with the recipient. For more information, please contact our data protection officer using the contact details above.

4.10.5  Duration of storage

Pursuant to Article 17 of the GDPR, the data is stored, supplemented and updated for as long as required by the respective purpose for which the personal data is processed, insofar as there are no legal obligations to the contrary, such as retention obligations under the Administrative Offences Act, the Money Laundering Act, commercial law or tax law.

If this purpose no longer applies, the data is erased using standardised processes within the company. In individual cases, the storage period may be extended if there are indications that claims by you, us or third parties exist and are being asserted. The data will then be stored for as long as the processing of your data is necessary for the establishment, exercise and defence of legal claims. According to Sections 195 et seq. of the German Civil Code (BGB), these limitation periods may last up to 30 years, whereby the regular limitation period is 3 years.

5. Information about your rights

You have the following rights with regard to your personal data used by us:

Article 15 GDPR: Right of access by the data subject

You have the right to obtain information from us about the personal data we process about you.

Article 16 GDPR: Right to rectify

If the data concerning you is incorrect or incomplete, you may request that incorrect information be corrected or that incomplete information be completed.

Article 17 GDPR: Right to erasure

Under the conditions of Art. 17 of the GDPR, you have the right to request the erasure of your personal data. Your right to erasure depends, among other things, on whether the data concerning you is still required by us to fulfil our contractual or legal obligations and whether there is no legitimate interest on our part or on a third party’s part, such as to defend against or assert legal claims.

Article 18 GDPR: Right to restriction of processing

Under the conditions of Article 18 of the GDPR, you have the right to request the restriction of processing of personal data concerning you.

Article 20 GDPR (right to data portability)

You may request to receive the data you have provided in a structured, commonly used and machine-readable format and to transmit it to other controllers.

Article 21 GDPR: Right to object

On grounds relating to your particular situation, you may object to the processing of your data at any time. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims. Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes.

Article 7, paragraph 3, of the GDPR: Right to withdraw consent

You have the right to withdraw your consent to the processing of your personal data at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent prior to its withdrawal.

Article 77 GDPR: Right to lodge a complaint with a supervisory authority

If you believe that the processing of personal data concerning you is unlawful, you may lodge a complaint with a data protection supervisory authority responsible for your place of residence or place of work or for the place of the alleged infringement. The supervisory authority responsible for us is: Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstrasse 5, 30159 Hannover, Germany.

6.  Links to other websites

Our website contains links to other websites. We have no control over whether their operators comply with data protection regulations. Although we have carefully checked the content beforehand, we cannot accept any liability for external links to third-party content.

7.  Validity and updating

Due to the further development of our website or changes in case law, it may be necessary to change this information with effect for the future. We recommend that you look at this information every time you visit our website.

Seevetal, 13 December 2023