1. Data protection at a glance
General remarks
The following remarks give a simple overview on what happens to your personal data if you visit this website. Personal data are any data with which you can be personally identified. You can infer detailed information on the topic of data protection from our Privacy Policy below.
Recording of data on this website
Who is responsible for recording data on this website?
Data are processed on this website by the website operator. You can find the contact details of the website operator in the ‘Note on the institution responsible’ section in this Privacy policy.
How do we record your data?
Your data are, firstly, collected by you providing them to us. This may, for example, concern data that you enter on a contact form.
Other data are automatically recorded by our IT systems when you visit the website or following your consent on the website. These are mainly technical data (for instance Internet browser, operating system or time when the page was accessed). Such data are recorded automatically as soon as you enter this website.
What do we use your data for?
Some of the data are collected in order to guarantee that the website is provided free of faults. Other data may be used to analyse your usage pattern. If contracts can be concluded or initiated through the website, the transmitted data can also be processed for contractual offers, orders or other order enquiries.
What rights do you have in regard to your data?
You shall be entitled at any time to receive information free of charge regarding the origin, recipient and purpose of your stored personal data. You are also entitled to order that these data be rectified or erased. If you have given your consent to data processing, you may withdraw this consent at any time with regard to any future processing. Under certain circumstances, you shall also have the right to request restriction of the processing of your personal data. Furthermore, you are entitled to lodge a complaint with the responsible supervisory authorities.
For further questions about this as well as general questions about data protection, you may contact us at any time.
Analysis tools and tools of third-party providers
When you visit this website, your surfing patterns may be statistically evaluated. This is done primarily on the basis of analysis programs.
You can find detailed information on these analysis programs in the Privacy Policy below.
2. General remarks and obligatory information
Data protection
The operators of this website take the privacy of your personal data very seriously. We treat your personal data as confidential and in accordance with the statutory data protection regulations and this Privacy Policy.
Various personal data are collected when you use this website. Personal data are data with which you can be personally identified. The present Privacy Policy explains what data we collect and what we use these data for. It also explains how, and for what purpose, that is done.
However, we would like to point out that data transmission via internet (e.g. email communication) may be subject to security vulnerabilities. Complete protection of personal data against unauthorised access by third parties is not possible.
Note on the institution responsible
The institution responsible for processing the data on this website is:
Heinrich Kühlmann GmbH
Im Thüle 26
33397 Rietberg, Germany
Telephone: +49 5244 / 4009 0
Email: info@kuehlmann.de
The institution responsible is the natural or legal person who or which decides on the purposes and means of the processing of personal data (e.g. names, email addresses, etc.), either alone or together with another party.
Storage period
Insofar as no special storage period is stipulated in this Privacy Policy, your personal data will remain with us until the purpose for the data processing lapses. If you file a justified request for erasure or withdraw your consent to data processing, your data are erased insofar as we do not have any other legally permissible reasons for storing your personal data (for instance retention periods stipulated by fiscal or commercial legislation). If that is the case, your data will be erased after these reasons no longer apply.
General information on the legal bases of data processing on this website
If you have consented to data processing, we process your personal data based on Art. 6(1)(a) GDPR and Art. 9(2)(a) GDPR if special data categories are processed according to Art. 9(1) GDPR. In the event of express consent for transferring personal data to third parties, data processing also takes place based on Art. 49(1)(a) GDPR. If you have consented to saving cookies or to allowing access to information on your device (e.g. via device fingerprinting), data processing is also rendered based on section 25(1) TDDDG. Consent may be withdrawn at any time. If your data are required to fulfil or execute pre-contractual measures, we process your data based on Art. 6(1)(b) GDPR. Moreover, we process your data if they are required to fulfil a legal obligation based on Art. 6(1)(c) GDPR. Furthermore, data processing may take place based on our legitimate interest according to Art. 6(1)(f) GDPR. The following sections of this Privacy Policy outline the legal bases relevant in each specific case.
Data protection officer
We have appointed a data protection officer.
ubb GmbH,
Walter-Bröker-Ring 8
32756 Detmold, Germany
Telephone: +49 5231 / 709 344
Email: mail@ubb.gmbh
Recipient of personal data
We collaborate with various external bodies as part of our business activity. To a certain extent, it is also necessary to transmit personal data to these external bodies. We only forward personal data to external bodies if this is required to fulfil a contract, if we are duty bound to do so by law (e.g. forwarding of data to tax authorities), if we have a legitimate interest according to Art. 6(1)(f) GDPR in the forwarding of such, or if there is another legal basis for the data forwarding. If contract processors are used, we forward our customers’ personal data only based on a valid contract on contract processing. In the event of joint processing, a contract is concluded regarding joint processing.
Withdrawal of your consent to the data processing
Many data processing procedures are only possible with your explicit consent. You may withdraw previously-granted consent at any time. The lawfulness of the data processing which occurred before your consent was withdrawn shall not be affected by the revocation.
Right to object to data collection in particular cases and to object to direct marketing (Art. 21 GDPR)
IF THE DATA PROCESSING IS PERFORMED ON THE BASIS OF ARTICLE 6(1) (e) OR (f) GDPR, YOU SHALL HAVE THE RIGHT TO OBJECT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, AT ANY TIME TO PROCESSING OF YOUR PERSONAL DATA, INCLUDING PROFILING BASED ON THOSE PROVISIONS. PLEASE REFER TO THIS PRIVACY POLICY FOR THE RESPECTIVE LEGAL BASIS FOR PROCESSING. IF YOU RAISE AN OBJECTION, WE SHALL CEASE PROCESSING YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS OR FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS. (RIGHT OF OBJECTION PURSUANT TO ART. 21(1) GDPR).
SHOULD YOUR PERSONAL DATA BE PROCESSED IN ORDER TO EFFECT DIRECT MARKETING, YOU ARE ENTITLED TO RAISE AN OBJECTION TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING AT ANY TIME IN SO FAR AS IT IS CONNECTED WITH SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA SHALL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).
Right to complain with the responsible supervisory authority
In the event of infringements of the GDPR, the data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement. The right to lodge a complaint shall exist without prejudice to any other administrative or judicial remedy.
Right of data portability
You are entitled to have any data that we automatically process based on your consent or in fulfilment of a contract handed over to you or a third party in a common, machine-readable format. Should you require direct transmission of the data to another Controller, this is only done if it is technically feasible.
Information, correction and erasure
You shall be entitled, at any time and within the context of the applicable statutory provisions, to receive information free of charge on any data stored relating to you personally as well as on their origin, their recipient and the purpose of data processing. You shall also be entitled to claim the rectification or erasure of such data. For further questions about this as well as general questions about “personal data”, you may contact us at any time.
Right to restriction of the data processing
You shall have the right to demand restriction of the processing of your personal data. You may contact us at any time in this regard. There shall be a right to restriction of the data processing in the following cases:
- If you dispute the correctness of your personal data stored by us, we generally require time to check this. During the time while this is being checked, you shall have the right to demand restriction of the processing of your personal data.
- If your personal data was/is unlawfully processed, you may demand the erasure of these data instead of restriction of the data processing.
- If we no longer require your personal data, but you require them for the exercise, defence or assertion of legal claims, you shall have the right to demand the restriction of the processing of your personal data instead of their erasure.
- If you have raised an objection pursuant to Art. 21(1) GDPR, your interests will be weighed against our interests. As long as it is not clear whose interests predominate, you shall have the right to demand restriction of the processing of your personal data.
If you have restricted the processing of your personal data, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
SSL or TLS encryption
For security reasons, and in order to protect the transmission of confidential content, such as any orders or inquiries that you transmit to us in our capacity as website operators, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that your browser’s address bar changes from “http://” to “https://” and by the lock symbol shown in your browser’s browser line.
If the SSL or TLS encryption is enabled, the data that you transmit to us cannot be read by any third parties.
3. Recording of data on this website
Cookies
Our websites use cookies. Cookies are small data packages and do not cause any damage to your device. They are either temporarily stored for the duration of a session (session cookies) or permanently stored on your device (permanent cookies). Session cookies are erased automatically after your website visit. Permanent cookies remain stored on your device until you yourself erase them or your web browser automatically erases them.
Cookies can originate from us (first party cookies) or from third-party undertakings (third party cookies). Third party cookies enable certain services from third-party undertakings to be integrated within websites (e.g. cookies to process payment services).
Cookies have various functions. Many cookies are technically necessary because certain website functions would not function without them (e.g. the shopping basket function or playing videos). Other cookies can be used to evaluate the user patterns or for advertising purposes.
Cookies necessary for electronic communication for providing certain functions that you require (e.g. for the shopping basket function) or for optimising the website (e.g. cookies for measuring the web audience, necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR insofar as no other legal basis is cited. The website operator has a legitimate interest in the storage of necessary cookies for technically error-free and optimised provision of its services. Insofar as consent for storing cookies and comparable recognition technologies was requested, processing takes place exclusively based on this consent (Art. 6(1)(a) GDPR and section 25(1) TDDDG); consent may be withdrawn at any time.
You can adjust the settings of your browser in such a way that you are informed about the creation of cookies and permit such cookies only in individual cases, exclude the acceptance of cookies in certain cases or in general, and activate the automatic erasure of cookies whenever you close the browser. If cookies are deactivated, the functionality of this website may be restricted.
To find out which cookies and services are used on this website, please review this Privacy Policy.
Consent with Cookiebot
Our website uses the cookie consent technology from Cookiebot to obtain your consent for storing cookies in your browser and to document this in accordance with data protection legislation. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter “Cookiebot”).
When you enter our website, a connection is made to Cookiebot servers to obtain your consents and other declarations on the use of cookies. Cookiebot then saves a cookie in your browser to be able to assign to you the granted consents or revoke them. The collected data are stored until you request us to erase them or you erase the Cookiebot cookie yourself or the purpose for storing the data lapses. Mandatory statutory retention periods shall remain unaffected by this.
Cookiebot is used in order to obtain mandatory statutory consent for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.
Contract data processing
We have concluded a contract on contract processing on using the service stated above. This is a contract stipulated under data protection law safeguarding that this contractor processor processes personal data of our website visitors only according to our instructions and by adhering to the instructions of GDPR.
Contact form
If you send us enquiries via the contact form, we shall store your information provided in the enquiry form, including your contact data stated therein, for purposes of processing the enquiry and in the event of additional questions. We shall not pass on these data without your consent.
These data are processed on the basis of Art. 6(1)(b) GDPR, insofar as your enquiry relates to the fulfilment of a contract or is necessary for performing pre-contractual measures. In all other cases, the processing is based on our legitimate interests in the effective processing of the queries directed to us (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR) insofar as this was queried; the consent may be withdrawn at any time.
The data entered on the contact form by you remain with us until such time as you request us to erase them, withdraw your consent to their storage, or the reason for the data storage lapses (e.g. once the processing of your enquiry has been concluded). Mandatory statutory provisions – in particular retention periods – shall not be affected thereby.
Enquiry by email, telephone or telefax
If you contact us by email, telephone or telefax, we will store and process your inquiry, including all personal data involved with this (name, enquiry) for the purposes of processing your request. We shall not pass on these data without your consent.
These data are processed on the basis of Art. 6(1)(b) GDPR, insofar as your enquiry relates to the fulfilment of a contract or is necessary for performing pre-contractual measures. In all other cases, the processing is based on our legitimate interests in the effective processing of the queries directed to us (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR) insofar as this was queried; the consent may be withdrawn at any time.
The data you sent to us by contact inquiries remain with us until such time as you request us to erase them, withdraw your consent to their storage, or the reason for the data storage lapses (e.g. once the processing of your enquiry has been concluded). Mandatory statutory provisions – in particular statutory retention periods – shall not be affected thereby.
4. Analysis tools and advertising
Google Tag Manager
We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The Google Tag Manager is a tool we use to integrate tracking or statistics tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, save any cookies and perform any independent analyses. It is used merely to manage and display the tools it is used to integrate. However, the Google Tag Manager collects your IP address, which can also be transmitted to the Google parent undertaking in the United States.
The use of the Google Tag Manager is governed by Art. 6(1)(f) GDPR. The website operator has a legitimate interest in integrating and managing various tools on its website in a swift and uncomplicated manner. If associated consent was requested from you, processing is rendered exclusively based on Art. 6(1)(a) GDPR and section 25(1) TDDDG if the consent includes storing cookies or accessing information on the user’s terminal device (e.g. device fingerprinting) as envisaged by the TDDDG. Consent may be withdrawn at any time.
The undertaking holds certification according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure adherence of European data protection standards when data are processed in the USA. Each undertaking certified according to DPF commits to adhere to these data protection standards. The provider has further information on this under the following link: https://www.dataprivacyframework.gov/participant/5780.
Google Analytics
This website uses functions of the website analysis tool, Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyse the website visitors’ use patterns. In the process, the website operator receives various types of use data, e.g. page views, duration of visit, operating systems used and user origin. These data are assigned to the user’s device. They are not assigned to a user ID.
Moreover, we can use Google Analytics to record your mouse and scroll movements and clicks, for example. Moreover, Google Analytics uses various modelling approaches to supplement the collected data records and deploys machine learning technologies as part of data analysis.
Google Analytics uses technologies to enable the user to be recognised for the purpose of analysing the user pattern (e.g. cookies or device finger printing). The information collected by the cookie about the use of this website is generally sent to and stored on a Google server in the USA.
This service is used based on your consent according to Art. 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.
The data transfer to the USA is based on the standard contract clauses of the EU Commission. You will find details here: https://privacy.google.com/businesses/controllerterms/mccs/.
The undertaking holds certification according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure adherence of European data protection standards when data are processed in the USA. Each undertaking certified according to DPF commits to adhere to these data protection standards. The provider has further information on this under the following link: https://www.dataprivacyframework.gov/participant/5780.
IP anonymization
Google Analytics IP anonymisation is activated. As a result, your IP address is truncated by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area prior to being transmitted to the USA. Only in exceptional cases is the full IP address sent to and truncated on a Google server in the USA. Google uses this information on behalf of the website operator to evaluate the way you use the website, to collate reports on website activities and to provide the website operator other services related to website and internet use. The IP address sent by your browser as part of Google Analytics is not combined with other data held by Google.
Browser Plugin
ou can prevent your data from being collected and processed by Google’s cookie by downloading and installing a browser plug-in provided at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
You can find more detailed information about dealing with user data at Google Analytics in Google’s Privacy Policy at: https://support.google.com/analytics/answer/6004245?hl=en.
Contract data processing
We have concluded an agreement with Google for contract data processing and fully implement the most stringent requirements of the German data protection authorities when using Google Analytics.
Google Conversion-Tracking
This website uses Google Conversion Tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
With the help of Google Conversion Tracking, both Google and ourselves can recognise whether the user has carried out certain actions. In this way, we are able to evaluate which buttons on our website are clicked how frequently, for example, and which products have been viewed or purchased particularly frequently. This information is used to create conversion statistics. We find out the total number of users who have clicked on our advertisements and which actions they have carried out. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.
This service is used based on your consent according to Art. 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.
You can find more information on Google conversion tracking in Google’s data privacy policy at: https://policies.google.com/privacy?hl=en.
The undertaking holds certification according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure adherence of European data protection standards when data are processed in the USA. Each undertaking certified according to DPF commits to adhere to these data protection standards. The provider has further information on this under the following link: https://www.dataprivacyframework.gov/participant/5780.
5. Plugins and Tools
YouTube with enhanced data protection
This website integrates videos of the YouTube website. The website operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
If you visit one of these websites with an embedded YouTube plugin, a connection to YouTube servers will be established. The YouTube server will then receive information about which of our website pages you visited. If you are logged on to your YouTube account, you enable YouTube to associate your browsing behaviour with your personal profile. You may prevent this by logging out of YouTube.
We use YouTube in enhanced data protection mode. According to YouTube, videos played in enhanced data protection mode are not used to personalise surfing on YouTube. Advertisements shown in enhanced data protection mode are likewise not personalised. No cookies are set in enhanced data protection mode. Instead, so-called local storage elements are saved in the user’s browser; similar to cookies, they contain personal data and can be used for recognition. Details on enhanced data protection mode can be found here: https://support.google.com/youtube/answer/171780.
After you start watching a YouTube video, other data processing procedures may possibly be triggered, which we are unable to influence.
YouTube is used in the interests of an appealing display of our online services. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If associated consent was requested from you, processing is rendered exclusively based on Art. 6(1)(a) GDPR and section 25(1) TDDDG if the consent includes storing cookies or accessing information on the user’s terminal device (e.g. device fingerprinting) as envisaged by the TDDDG. Consent may be withdrawn at any time.
You can find further information on data privacy at YouTube in the provider’s Privacy Policy at: https://policies.google.com/privacy?hl=en.
The undertaking holds certification according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure adherence of European data protection standards when data are processed in the USA. Each undertaking certified according to DPF commits to adhere to these data protection standards. The provider has further information on this under the following link: https://www.dataprivacyframework.gov/participant/5780.
Adobe Fonts
This website uses Adobe Web Fonts to depict certain fonts in a unified manner. The provider is Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe).
When you visit this website, your browser loads the required font directly from Adobe to enable your device to display the content correctly. In so doing, your browser connects to Adobe servers in the USA. Thereby Adobe becomes aware of the fact that this website has been accessed via your IP address. According to Adobe, no cookies are saved when fonts are provided.
These data are collected based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in a unified display of its font on its website. If associated consent was requested from you, processing is rendered exclusively based on Art. 6(1)(a) GDPR and section 25(1) TDDDG if the consent includes storing cookies or accessing information on the user’s terminal device (e.g. device fingerprinting) as envisaged by the TDDDG. Consent may be withdrawn at any time.
The data transfer to the USA is based on the standard contract clauses of the EU Commission. You will find details here: https://www.adobe.com/de/privacy/eudatatransfers.html
For more information on Adobe Fonts, visit: https://www.adobe.com/de/privacy/policies/adobe-fonts.html.
You can find the Adobe Privacy Policy here: https://www.adobe.com/de/privacy/policy.html
The undertaking holds certification according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure adherence of European data protection standards when data are processed in the USA. Each undertaking certified according to DPF commits to adhere to these data protection standards. The provider has further information on this under the following link: https://www.dataprivacyframework.gov/participant/5660.
Google Maps
This site uses the map service of Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. With the help of this service, we can integrate map material on our website.
In order to use the functions of Google Maps, it is necessary to store your IP address. This information is usually transmitted to a server of Google in the USA and stored there. The provider of this site has no control over such data transmission. If Google Maps is activated, Google can use the Google Fonts for unified display. When Google Maps is accessed, the browser loads the necessary web fonts into the browser cache in order to display texts and fonts correctly.
Google Maps is used in the interest of our online offers being displayed attractively and for you to be able to find the locations, specified by us on the website, easily. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If associated consent was requested from you, processing is rendered exclusively based on Art. 6(1)(a) GDPR and section 25(1) TDDDG if the consent includes storing cookies or accessing information on the user’s terminal device (e.g. device fingerprinting) as envisaged by the TDDDG. Consent may be withdrawn at any time.
The data transfer to the USA is based on the standard contract clauses of the EU Commission. For details, please refer to: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
More information on dealing with user data can be found in Google’s data privacy policy at: https://policies.google.com/privacy?hl=en.
The undertaking holds certification according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure adherence of European data protection standards when data are processed in the USA. Each undertaking certified according to DPF commits to adhere to these data protection standards. The provider has further information on this under the following link: https://www.dataprivacyframework.gov/participant/5780.