Data Protection

Below, we describe the data processing activities associated with the use of our website.

Purposes and legal basis

Log data

Whenever you visit a website, your internet browser automatically sends information to our web server for technical reasons (known as log data). We store some of this information in log files, e.g.

• Date of access
• Time of access
• URL of the referring website
• File accessed
• Amount of data transferred
• Browser type and version
• Operating system
• IP address

In principle, we only analyse log data to rectify malfunctions in the operation of our website or to investigate security incidents.

To rectify malfunctions or to preserve evidence in the event of security incidents, it may be necessary for us to collect additional personal data alongside the log data. In such cases, we base the processing of log data on a legal authorisation.

Legal basis

This processing is based on Article 6(1)(f) of the GDPR; our legitimate interest is the technical provision, security and optimisation of the website.

Retention period

The data processed in connection with the collection of server log files is stored for as long as is necessary for the purposes stated.

Contact form

You can get in touch with us via the contact form. We will store the information you provide in the enquiry form, including your contact details, for the purpose of processing your enquiry and in case we need to follow up with any further questions.

Categories of personal data

When you submit an enquiry via the contact form, the following personal data will be processed:

• Your enquiry
• Name
• Address
• Telephone number
• Email address

Legal basis

The processing of data entered into the contact form is based on our legitimate interest in offering our customers a simple means of contact, as well as in improving the quality of our advice, and for contractual purposes (Art. 6(1)(f) GDPR). You may provide us with information beyond the mandatory fields on a voluntary basis. The legal basis for this information is Article 6(1)(a) of the GDPR, namely your consent. The processing of voluntarily provided data serves to improve the service we offer you and to enable us to provide you with more comprehensive support. You may withdraw your consent to the processing of voluntarily provided data at any time. To do so, please use the contact details provided above.

Withdrawal of your consent to data processing

Some data processing operations are only possible with your consent. You may withdraw consent you have already given at any time. An informal notification by email to one of the email addresses stated above is sufficient. The lawfulness of the data processing carried out up to the time of withdrawal remains unaffected by the withdrawal.

Forwarding of emails in connection with an enquiry

When you contact our service team by email, the contact details transmitted by the customer by email for the current enquiry, as well as other digitally transmitted matters, may be used, where possible, to forward the enquiry automatically to the responsible internal department. This is intended to ensure the proper handling of these business processes and to enable customer enquiries to be processed more quickly. For this purpose, the contact details provided are transferred to our customer database and stored there.

Legal basis

The data you provide in this context is processed on the basis of our legitimate interest in accelerating and further optimising our processes for our customers (Art. 6(1)(f) GDPR).

Retention period

The personal data processed in this context is retained for the duration of your business relationship with us or until you ask us to erase it. Statutory retention obligations remain unaffected.

Cookies

The websites of SANHA® GmbH & Co. KG sometimes use so-called cookies. Cookies are small text files that we store on your device when you visit our website. Each time you visit our website again, these cookies are transmitted back to us. This allows us, for example, to recognise you or to make navigation easier for you using the information contained in the cookies.

Cookies cannot be used to launch programs or transmit viruses to a computer. Cookies can only be read by the web server from which they originated.

We do not pass the information contained in cookies on to third parties without your express consent. You can also view our website without cookies. Internet browsers are generally configured to accept cookies. To prevent your internet browser from using cookies, you can (1) refuse the use of cookies when visiting our website via the cookie layer (if available), or (2) disable the use of cookies in the settings of your internet browser. The help functions of your internet browser explain how to disable and/or delete cookies in your browser. Please note that disabling/deleting cookies may mean that individual functions of our website no longer work as expected. Cookies that may be required for certain functions of our website are described below. In addition, disabling/deleting cookies only affects the internet browser used for this purpose. Cookies must therefore be disabled/deleted separately in any other internet browser. Cookies that we use for certain functions without reference to an identifiable person:

• Cookies that store certain user preferences (e.g. search or language settings);
• Cookies that store data to ensure uninterrupted playback of video or audio content.
• Cookies that temporarily store certain user entries (e.g. the contents of a shopping cart or an online form);
• Cookies that we use for certain functions and that relate to an identifiable person:
• Cookies used to identify or authenticate our users;

We store the data until the end of the lifetime of the respective cookie or until you delete the cookies. This processing is based on Art. 6(1)(f) GDPR. Our interest is the continuous optimisation of the website and the improvement of user-friendliness.

Statistical analysis with Matomo

We use the analytics service to statistically evaluate the use of our website: Matomo. The provider is InnoCraft Ltd, 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand. We have concluded a data processing agreement with Matomo. When Matomo is used, personal data may also be transferred to the servers of ePrivacy GmbH in Germany.

You can view Matomo's privacy policy at the following link:

Privacy Policy - Analytics Platform - Matomo

Legal basis

We use Matomo to statistically evaluate our website on the basis of Art. 6(1)(a) GDPR, namely your consent.

You can prevent the use of cookies by not giving us your consent. However, please note that in this case you may not be able to use all functions of this website in full.

Withdrawal of your consent to data processing

Some data processing operations are only possible with your consent. You may withdraw consent you have already given at any time. An informal notification by email to one of the email addresses stated above is sufficient. The lawfulness of the data processing carried out up to the time of withdrawal remains unaffected by the withdrawal.

Newsletter

If you wish to subscribe to the newsletter offered on the website, we require your email address and confirmation that you agree to receive the newsletter. No further data is collected, or it is collected only on a voluntary basis.

The data entered in the newsletter subscription form is processed exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You may withdraw your consent to the storage of the data and email address and to their use for sending the newsletter at any time, for example via the “unsubscribe” link in the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.

Withdrawal of your consent to data processing

Some data processing operations are only possible with your consent. You may withdraw consent you have already given at any time. An informal notification by email to one of the email addresses stated above is sufficient. The lawfulness of the data processing carried out up to the time of withdrawal remains unaffected by the withdrawal.

Newsletter delivery by Rapidmail

SANHA® GmbH & Co. KG uses the Rapidmail service to send the newsletter. The provider of this service is rapidmail GmbH, Wentzingerstraße 2, 79106 Freiburg im Breisgau, Germany.

Rapidmail is a service that can be used, among other things, to organise and analyse the delivery of newsletters. The data you enter for the purpose of subscribing to the newsletter is stored on Rapidmail's servers in Germany.

If you do not want Rapidmail to analyse your use, you must unsubscribe from our newsletter. You will find the relevant link in every newsletter message.

Data analysis by Rapidmail

For the purpose of analysing the success of our newsletter, emails sent with Rapidmail contain a so-called web beacon or “tracking pixel” that reacts to interactions with the newsletter. This makes it possible to determine whether a newsletter message was opened, whether links were clicked and at what time the newsletter was read.

As part of the performance analysis, Rapidmail processes the following data:

• Master data (e.g. name, address)
• Contact details (e.g. email address, telephone number)
• Metadata and communication data (e.g. device information, IP address)
• Usage data (e.g. interests, access times)

Legal basis

The data processing is based on your consent (Art. 6(1)(a) GDPR). You may withdraw this consent at any time. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

Withdrawal of your consent to data processing

Some data processing operations are only possible with your consent. You may withdraw consent you have already given at any time. An informal notification by email to one of the email addresses stated above is sufficient. The lawfulness of the data processing carried out up to the time of withdrawal remains unaffected by the withdrawal.

Retention period

The data you provide to us for the purpose of receiving the newsletter is stored by us until you unsubscribe from the newsletter and is erased after you unsubscribe. Data stored by us for other purposes (e.g. email addresses used to register in the online shop) remains unaffected by this.

Conclusion of a data processing agreement

We have concluded an agreement with rapidmail GmbH pursuant to Art. 28(3) GDPR, under which we oblige rapidmail to protect our customers' data and not to disclose it to third parties.

Disclosure to other third parties

With regard to newsletter, press and investor distribution lists, we use some of the following external service providers to fulfil our contractual and statutory obligations:

EQS Group AG, Karlstraße 47, 80333 Munich, Germany, website: https://www.eqs.com/de/

IR.on AG, Mittelstraße 12-14, Building A, 50672 Cologne, Germany, website: https://www.ir-on.com/

The data you provide to us via the newsletter subscription form is transmitted to the service providers named above. The legal basis for the data processing is Art. 6(1)(b) and (f) GDPR.
Our service providers will process your data only to the extent necessary to fulfil their service obligations and will follow our instructions regarding this data. To ensure data protection-compliant processing, we have concluded data processing agreements with our service providers.

YouTube

We have embedded YouTube videos on our website; these videos are stored at www.youtube.com. If you use these videos, you will be redirected to the YouTube platform. The provider of this platform is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. When YouTube is used, personal data may also be transferred to Google LLC, which is based in the USA. The processing of personal data is covered by so-called standard contractual clauses of the European Commission concluded with us. https://privacy.google.com/businesses/processorterms/.

All YouTube videos on our website are embedded in enhanced privacy mode. This means that no data about you as a user, or personal data in general, is transmitted to YouTube unless you play the videos. If you play the videos offered, data will be transmitted. We have no control over the data transmitted. The data is transmitted regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, the data will be assigned to your user account.

If you do not want data to be transferred to YouTube and associated with your profile, you must log out of your Google account before playing the videos. YouTube stores your data as usage profiles and uses it for advertising, market research and/or the needs-based design of its website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.

The processing is based on Art. 6(1)(a) GDPR. You may withdraw your consent at any time. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

Withdrawal of your consent to data processing

Some data processing operations are only possible with your consent. You may withdraw consent you have already given at any time. An informal notification by email to one of the email addresses stated above is sufficient. The lawfulness of the data processing carried out up to the time of withdrawal remains unaffected by the withdrawal.

You can find further information about YouTube and Google here:

https://www.google.com/intl/de/policies/privacy/ (General Google Privacy Policy)

https://policies.google.com/terms?hl=de#toc-software (Terms of Service for Google services)

https://www.youtube.com/static?gl=DE&template=terms&hl=de (YouTube Terms of Service)

We maintain a presence on social networks for marketing purposes, to communicate with our customers and to generate interest in our company. The following sections provide information about the associated processing activities.

Data processing for presentation and communication

Social networks enable us to present our company to people who have an account with the social network (hereinafter “users”) and to all visitors to our profiles who do not have an account with the social network (hereinafter “guests”). Customers and prospective customers can also contact us via this profile. Our profiles and posts can generally be viewed by users and guests (users and guests are hereinafter collectively referred to as “visitors”). If you comment on our posts or send us a message, this data is stored by the social network and can be viewed by us. We can respond to your comment or message. In the case of posts, your comment and our response may continue to be visible to all users of the social network or to all visitors.

Data processing for statistical and advertising purposes

If you access our profile, the social network may store and analyse your visit and all your other interactions on the social network's website. Our profiles and posts can generally be viewed by users and guests (users and guests are hereinafter collectively referred to as “visitors”). If you comment on our posts or send us a message, this data is stored by the social network and can be viewed by us. We can respond to your comment or message. In the case of posts, your comment and our response may continue to be visible to all users of the social network or to all visitors.

If you have an account with the social network and are logged in when visiting our profile, the provider of the social network can link your interactions with our profile to your account data and process them further. However, data about your interactions with our profile may also be stored by the social network for the duration of your visit and processed for other purposes if you are not logged in there or do not have an account. In this case, an association may be made, for example, through the use of cookies, small files stored on your device, or in connection with your IP address.

The purpose of this data processing by the platform is to create an interest profile for the visitor and use it for advertising purposes. When the person accesses certain websites, information about that access is analysed and the provider assigns certain interests to the visitor. Advertisements are shown to the visitor on the basis of the assigned interests. The provider may display interest-based advertisements both within and outside the social network's websites.

Categories of data subjects

Persons who access our profile on the relevant social network (both users with an account with the social network provider and visitors without an account).

Exercising your rights as a data subject

For requests for access or to exercise your other rights as a data subject, we recommend contacting the provider directly, as only the provider has full access to the data processed in connection with a visit to our profile or interaction with us on the social network. The contact information of the social networks for exercising your rights as a data subject can be found under “Information about the social networks we use”. Where the provider of the social network and we are joint controllers for data processing, you also have the right to exercise your rights as a data subject against us. In such a case, we will forward your request to the social network insofar as it concerns data or processing activities carried out by the social network.

Further information about the processing activities of the social networks and the available objection options can be found under “Information about the social networks we use”.

Facebook:

Provider

Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Facebook”)

Website

https://de-de.facebook.com/

Form for contacting Facebook's Data Protection Officer:

https://www.facebook.com/help/contact/540977946302970

Facebook Data Policy

https://de-de.facebook.com/policy.php

Our profile

https://www.facebook.com/sanhagmbh

Joint controller

We have concluded a joint controller agreement with Facebook that applies to the processing of data in connection with our Facebook profile (the “Page”) for the provision of the profile and the statistical analysis of visitors' interactions with our profile. It specifies which obligations in connection with data processing are to be fulfilled either by Facebook or by us and which party is responsible for the individual processing activities.

Agreement on joint controllership for the processing of Page Insights data between Facebook and us as the owner of a Facebook profile pursuant to Art. 26 GDPR:

https://www.facebook.com/legal/terms/page_controller_addendum

Purposes and legal basis

• Presentation of our company, legitimate interest ((Art. 6(1), first sentence, point (f) GDPR)
• Communication with customers and prospective customers, legitimate interest ((Art. 6(1), first sentence, point (f) GDPR)
• Statistical purposes, legitimate interest ((Art. 6(1), first sentence, point (f) GDPR)

Where Facebook carries out further processing activities or processes data for statistical or advertising purposes, Facebook is the controller for the processing and the processing may be based on other legal bases. Further information can be found under “Facebook Data Policy”.

Right to object

If you wish to object to processing by Facebook, you will find the relevant options for the different processing activities at the following link:

https://www.facebook.com/help/contact/367438723733209?no_redirect

PayPal

On our website, we offer payment via PayPal, among other options. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).

Legal basis

If you select payment via PayPal, the payment data you enter will be transmitted to PayPal.

Credit card

On our website, we also offer payment by credit card through our payment service provider Computop Paygate GmbH, Schwarzenbergstr. 4, D-96050 Bamberg, Germany.

If you select payment by credit card, the personal and payment-related data requested and required to process the transaction is transmitted directly to your bank, credit card company or Computop. Credit card data is collected exclusively by Computop and stored in encrypted form.

Legal basis

Your data is transmitted to Computop for contractual purposes.

To process enquiries and to initiate, conduct and manage our customer and business relationships, we process the contact, communication, customer and contract data required for these purposes. In particular, we use central customer management and enterprise resource planning systems for this purpose.

We also collect, process and use personal data outside the online shop environment insofar as it is necessary to establish, define the content of or amend the contract.

Categories of data

We require the following data to register you as a customer:

• Company name including legal form (e.g. GmbH)
• Registered office (street / house number / postcode / town or city)
• First name and surname of the contact person
• Telephone
• First name and surname of the managing director/owner of the business. You may voluntarily provide us with the following data:
• Email address – Please note, however, that we require this in order to provide access to our online shop.
• Fax
• Different billing address, if applicable
• Mobile telephone
• Date of birth of the managing director/owner of the business

Retention period

We store the data collected for as long as you have a business relationship with us. After the business relationship ends, your data is erased. Statutory retention periods remain unaffected.

Categories of data

The following personal data is processed as part of the processing of customer-related personal data.

• Customer number
• Company
• Street
• House number
• Postcode
• Town or city
• Contact person
• Function
• Telephone
• Email

Legal basis

The personal data is processed for contractual purposes. The legal basis for processing for these purposes is:

• if you are a registered merchant or self-employed professional, Art. 6(1)(b) GDPR, as the data processing is necessary for the performance of the contract or for pre-contractual measures involving the data subject; or
• if you act as an employee of a company, e.g. as a purchasing employee, Art. 6(1)(f) GDPR, namely the legitimate interest of SANHA® GmbH & Co. KG. The legitimate interest of SANHA® GmbH & Co. KG consists here in preparing the sale of products or services by companies of SANHA® GmbH & Co. KG, which is justified in particular by entrepreneurial freedom and freedom of occupation.

Retention period

We already hold the transmitted data and merely transfer it to the respective company. The retention period at SANHA® GmbH & Co. KG is determined by the retention period for the original processing purpose. The retention period at the receiving company is governed by the privacy information of the respective company.