Dear customers,
With this Data Protection Notice, we aim to inform you about the processing of your personal data by HOFFMANN Maschinen- und Apparatebau GmbH and the rights afforded to you as a data subject in line with the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) since 25 May 2018.
Controller for the processing of your personal data
HOFFMANN Maschinen- und Apparatebau GmbH
Hauerstr. 2–4
38268 Lengede, Germany
Tel.: +49 (0) 5344-9009-0
Fax: +49 (0) 5344-5773
info@hoffmann-filter.de
Data Protection Officer
Anna Bauer
LINET Services GmbH
Hinter dem Turme 12a
38112 Braunschweig, Germany
datenschutz@hoffmann-filter.de
Information for business partners (customers, suppliers, service providers, etc.)
Source of data
You generally provide us with your personal data with your order and/or in the course of our business relationship. In these cases, we collect your personal data directly from you.
However, we may also process personal data which we did not collect ourselves. The data may come from public sources. These are:
- Google search results
- register of outstanding debts
- land registers
- commercial register and register of associations
- the press
Furthermore, it is possible in certain cases that we receive your personal data from third, non-public sources. These are:
- Public authorities
Public authorities may pass your personal data on to us so that we can process your enquiry and perform the associated service.
- Our business partners
Companies associated with us in the context of a business relationship may pass your personal data on to us so that we can process your enquiry and perform the associated service.
Purposes and legal basis of data processing
We process your personal data exclusively in line with the legal requirements of GDPR, BDSG, and any relevant industry-specific laws. Therefore, we process your data if there is a contractual basis to do so, to safeguard our legitimate interests, if you have given us your consent to process the data, or if a law permits or obliges us to process your data.
- Data processing for the performance of a contract or the implementation of precontractual measures
We process your personal data to the extent necessary for the implementation of precontractual measures, for the conclusion of the contract, the performance of the contract, and the termination of the contractual relationship. This includes your first name, surname, customer number and address, in addition to the data relating to the service or goods you have ordered.
To enable proper contract processing for you and to be able to contact you as quickly as possible, for example in the event of problems or questions, we also process your address and/or (mobile) phone number and/or email address provided that you have provided us with these for this purpose.
The legal basis for data processing for the performance of a contract and the implementation of precontractual measures is generally Art. 6 para. 1 lit. b GDPR.
- Data processing for the purpose of safeguarding the legitimate interests of the controller or a third party
We also process your data to the extent necessary for the safeguarding of our legitimate interests or those of a third party. The processing we carry out based on legitimate interest regularly includes direct advertising for our own products, the compilation of internal statistics, investigation of crimes, measures to ensure the proper operation of our IT infrastructure and the transmission of your personal data to credit agencies for assessment of your creditworthiness.
The legal basis for data processing for the purpose of safeguarding the legitimate interests of the controller or a third party is Art. 6 para. 1 lit. f GDPR.
- Data processing for the fulfilment of a legal obligation
We also process your personal data to the extent necessary for the fulfilment of a legal obligation which applies to us. The obligations we have to fulfil include, in particular, retention obligations under fiscal and commercial law.
The legal basis for processing for the fulfilment of a legal obligation is Art. 6 para. 1 lit. c GDPR in conjunction with any relevant legal standard.
- Data processing on the basis of your consent and for other purposes
We may process your personal data if you have given your express consent for this (cf. Art. 6 para. 1 lit. a GDPR). In such cases, we will provide you with additional data-protection information as part of the consent procedure. You can revoke your consent at any time via the contact details mentioned above.
Should we require your personal data in future for other purposes not stated in this Data Protection Notice, we will inform you of this separately in line with legal requirements.
Categories of personal data recipients
- External service providers and affiliated companies
Our external service providers and affiliated companies who perform data processing on our behalf are contractually obliged, to the extent required by law, in line with Art. 28 GDPR to handle the personal data in accordance with applicable regulations. Should these companies come into contact with your personal data, we have ensured through legal, technical and organisational measures, as well as through regular checks, that they comply with the provisions of data protection laws. We currently use the following types of service provider to process your data:
- IT providers
- Software providers
- Advertising agencies
- File destroyers
- Chambers of foreign trade
- Consulting firms
- Third parties
We will provide your personal data to public authorities if this is necessary as part of our statutory reporting obligations. Your personal data will also be transmitted to our tax consultant if this is necessary for his work.
- Data transfer to third countries
In principle, we do not transfer your personal data to a third country or to an international organisation outside the European Economic Area (EEA). Should we, in individual cases, effect such a transfer, this only takes place to those third countries for which an adequacy decision has been issued by the European Commission or the appropriate level of data protection has been ensured by suitable or adequate safeguards (e.g. Binding Corporate Rules or EU standard contractual clauses).
Duration of data storage
We only store your personal data for as long we need it in the context of the above-mentioned purposes, as well as for the period in which we potentially have to expect the assertion of legal claims against us. In individual cases, the statutory limitation period for such claims can be between three and thirty years.
Furthermore, we store your personal data to the extent to which we are obliged to do so as part of our statutory obligations to provide evidence and retain records (e.g. in under the German Commercial Code, Fiscal Code, or Money Laundering Act). The statutory retention periods can be up to ten years. Furthermore, in exceptional cases, there may be special obligations to provide evidence that necessitate the storage of your personal data for a longer period of time.
Information for applicants
Source of data
You generally provide us with your personal data with your application. In these cases, we collect your personal data directly from you.
However, we may also process personal data which we did not collect ourselves. The data may come from public sources. These are:
- Google search results
- register of outstanding debts
- land registers
- commercial register and register of associations
- the press
Furthermore, it is possible in certain cases that we receive your personal data from third, non-public sources. These are:
- Recruitment agencies:
We occasionally commission recruitment agencies to find suitable personnel to fill vacancies. In this process, your application documents are forwarded to us to continue the application process.
- Professional social networks
We use professional social networks, such as XING and LinkedIn, to find and contact suitable personnel to fill vacancies. Furthermore, our applicant portal makes it possible to transfer your CV and other data from professional social networks. As such, your personal data is not collected directly from you, but from the professional social network.
Purposes and legal basis of data processing
We process your personal data exclusively in line with the legal requirements of GDPR, BDSG, and any relevant industry-specific laws. Therefore, we process your data to carry out the application process or if you have given us your consent to process the data.
- Data processing for the completion of the application process
We process your personal data to the extent necessary to complete the application process. This includes your contact data (surname, first name, postal address, phone number, e-mail address), all of your application documents (e.g. photo, curriculum vitae, certificates, references) as well as all data which you disclose to us in the course of the application process. The legal basis for data processing for the purpose of the employment relationship is in general Art. 6 Para. 1 lit. b GDPR, Art. 88 GDPR in conjunction with § 26 BDSG (German Federal Data Protection Act).
- Data processing on the basis of your consent
We may process your personal data if you have given your express consent for this (cf. Art. 6 para. 1 lit. a GDPR). In such cases, we will provide you with additional data-protection information as part of the consent procedure. You can revoke your consent at any time via the contact details mentioned above.
Should we require your personal data in future for other purposes not stated in this Data Protection Notice, we will inform you of this separately in line with legal requirements.
Categories of personal data recipients
- External service providers and affiliated companies
Our external service providers and affiliated companies who perform data processing on our behalf are contractually obliged, to the extent required by law, in line with Art. 28 GDPR to handle the personal data in accordance with applicable regulations. Should these companies come into contact with your personal data, we have ensured through legal, technical and organisational measures, as well as through regular checks, that they comply with the provisions of data protection laws. We currently use the following types of service provider to process your data:
- IT providers
- Software providers
- Advertising agencies
- File destroyers
- Chambers of foreign trade
- Consulting firms
- Third parties
We will provide your personal data to public authorities if this is necessary as part of our statutory reporting obligations.
- Data transfer to third countries
In principle, we do not transfer your personal data to a third country or to an international organisation outside the European Economic Area (EEA). Should we, in individual cases, effect such a transfer, this only takes place to those third countries for which an adequacy decision has been issued by the European Commission or the appropriate level of data protection has been ensured by suitable or adequate safeguards (e.g. Binding Corporate Rules or EU standard contractual clauses).
Duration of data storage
We only store your personal data for the duration of the application process, as well as for the period in which we potentially have to expect the assertion of legal claims against us. The statutory limitation period for such claims in the context of the application process is 6 months after the end of the application process.
If you consent to us processing your data, your data will be processed until you revoke your consent.
Should an employment relationship result from your application, the retention periods for employee data apply accordingly.
Information for employees
Source of data
Generally, we collect your personal data directly from you via our staff questionnaire at the start of your employment.
However, we may also process personal data which we did not collect ourselves. The data may come from public sources. These are:
- Google search results
- register of outstanding debts
- land registers
- commercial register and register of associations
- the press
Furthermore, it is possible in certain cases that we receive your personal data from third, non-public sources. These are:
- Temporary employment agencies:
If you are employed by us as a temporary worker, we will generally receive your personal data from the temporary employment agency we have commissioned to post you.
- Temporary employment agencies:
If you are employed by us as a temporary worker, we will generally receive your personal data from the temporary employment agency we have commissioned to post you.
- Businesses taken over as part of a business transfer
As part of a transfer of business, we may not collect your personal data directly from you, but rather assume it from the transferred company.
- Affiliated companies
If you are employed at a company affiliated with us, your personal data will come from this affiliated company and be processed by us, e.g. for uniform personnel management.
Purposes and legal basis of data processing
We process your personal data exclusively in line with the legal requirements of GDPR, BDSG, and any relevant industry-specific laws. Therefore, we process your data if an employment relationship exists, if we have a legitimate interest in processing your data, if you have given us your consent to process the data, or if a law permits or obliges us to process your data.
- Data processing for the purpose of the employment relationship
We process the personal data to the extent necessary to implement the employment relationship. These include personal details (e.g. your first name, surname, address, (mobile) phone number, email address, bank details), employment information (e.g. your job title and highest educational qualification), tax information (e.g. your tax ID and tax bracket) and social security information (e.g. your health insurance provider).
The legal basis for data processing for the purpose of the employment relationship is in general Art. 6 Para. 1 lit. b GDPR, Art. 88 GDPR in conjunction with § 26 BDSG (German Federal Data Protection Act).
- Data processing for the purpose of safeguarding the legitimate interests of the controller or a third party
We also process your data to the extent necessary for the safeguarding of our legitimate interests or those of a third party. The processing we carry out based on legitimate interest regularly includes the compilation of internal statistics, investigation of crimes, and measures to ensure the proper operation of our IT infrastructure.
The legal basis for data processing for the purpose of safeguarding the legitimate interests of the controller or a third party is Art. 6 para. 1 lit. f GDPR.
- Data processing for the fulfilment of a legal obligation
We also process your personal data to the extent necessary for the fulfilment of a legal obligation which applies to us. The obligations we have to fulfil include, in particular, retention obligations under fiscal and commercial law.
The legal basis for processing for the fulfilment of a legal obligation is Art. 6 para. 1 lit. c GDPR in conjunction with any relevant legal standard.
- Data processing on the basis of your consent and for other purposes
We may also process your personal data if you have given your express consent for this (cf. Art. 6 para. 1 lit. a GDPR). In such cases, we will provide you with additional data-protection information as part of the consent procedure. You can revoke your consent at any time via the contact details mentioned above.
If we require your personal data in future for other purposes not stated in this Data Protection Notice, we will inform you of this separately in line with legal requirements.
Categories of personal data recipients
- External service providers and affiliated companies
Our external service providers and affiliated companies who perform data processing on our behalf are contractually obliged, to the extent required by law, in line with Art. 28 GDPR to handle the personal data in accordance with applicable regulations. Should these companies come into contact with your personal data, we have ensured through legal, technical and organisational measures, as well as through regular checks, that they comply with the provisions of data protection laws. We currently use the following types of service provider to process your data:
- IT providers
- Software providers
- Advertising agencies
- File destroyers
- Chambers of foreign trade
- Consulting firms
- Third parties
We will provide your personal data to public authorities if this is necessary as part of our statutory reporting obligations. Your personal data will also be transmitted to our tax consultant if this is necessary for his work.
- Data transfer to third countries
In principle, we do not transfer your personal data to a third country or to an international organisation outside the European Economic Area (EEA). Should we, in individual cases, effect such a transfer, this only takes place to those third countries for which an adequacy decision has been issued by the European Commission or the appropriate level of data protection has been ensured by suitable or adequate safeguards (e.g. Binding Corporate Rules or EU standard contractual clauses).
Duration of data storage
We only store your personal data for as long as the processing of your data is required for the employment relationship, as well as for the period in which we potentially have to expect the assertion of legal claims against us. In individual cases, the statutory limitation period for such claims can be between three and thirty years.
Furthermore, we store your personal data to the extent to which we are obliged to do so as part of our statutory obligations to provide evidence and retain records (e.g. in under the German Commercial Code, Fiscal Code, or Money Laundering Act). The statutory retention periods can be up to ten years. Furthermore, in exceptional cases, there may be special obligations to provide evidence that necessitate the storage of your personal data for a longer period of time.
Information for competition entrants
Source of data
You generally provide us with your personal data in the context of your entry into the competition. In this case, we collect your personal data directly from you.
However, we may also process personal data which we did not collect ourselves. The data may come from public sources. These are:
- Google search results
- register of outstanding debts
- land registers
- commercial register and register of associations
- the press
Furthermore, it is possible in certain cases that we receive your personal data from third, non-public sources in the process of holding a competition. These are:
- Social networks
If we hold a competition via one of our social media presences, your personal data will usually be disclosed to us via the relevant social network.
- Marketing companies
If a marketing company holds a competition on our behalf and in our name, this company will generally collect your personal data and forward it to us.
- Business partners
If we commission one of our business partners (e.g. a trade fair operator) to hold a competition in our name, the partner will collect your personal data and transmit it to us.
Purposes and legal basis of data processing
We process your personal data exclusively in line with the legal requirements of GDPR, BDSG, and any relevant industry-specific laws. Therefore, we process your data if there is a contractual basis to do so, if you have given us your consent to process the data, or if a law permits or obliges us to process your data.
- Data processing for the performance of a contract (competition)
We process your personal data to the extent necessary to hold the competition and conclude the associated contract. This includes your first name, surname, customer number and address, as well as the data relating to the service or goods you have ordered.
To enable proper implementation of the competition and and to be able to contact you as quickly as possible, for example in the event of problems or questions, we also process your address and/or (mobile) phone number and/or email address provided that you have provided us with these for this purpose.
The legal basis for data processing for the performance of a contract is generally Art. 6 para. 1 lit. b GDPR.
- Data processing for the fulfilment of a legal obligation
We also process your personal data to the extent necessary for the fulfilment of a legal obligation which applies to us. The obligations we have to fulfil include, in particular, retention obligations under fiscal and commercial law.
The legal basis for processing for the fulfilment of a legal obligation is Art. 6 para. 1 lit. c GDPR in conjunction with any relevant legal standard.
- Data processing on the basis of your consent and for other purposes
We may process your personal data if you have given your express consent for this (cf. Art. 6 para. 1 lit. a GDPR). In such cases, we will provide you with additional data-protection information as part of the consent procedure. You can revoke your consent at any time via the contact details mentioned above.
If we require your personal data in future for other purposes not stated in this Data Protection Notice, we will inform you of this separately in line with legal requirements.
Categories of personal data recipients
- External service providers and affiliated companies
Our external service providers and affiliated companies who perform data processing on our behalf are contractually obliged, to the extent required by law, in line with Art. 28 GDPR to handle the personal data in accordance with applicable regulations. Should these companies come into contact with your personal data, we have ensured through legal, technical and organisational measures, as well as through regular checks, that they comply with the provisions of data protection laws. We currently use the following types of service provider to process your data:
- IT providers
- Software providers
- Advertising agencies
- File destroyers
- Chambers of foreign trade
- Consulting firms
- Third parties
We will provide your personal data to public authorities if this is necessary as part of our statutory reporting obligations.
- Data transfer to third countries
In principle, we do not transfer your personal data to a third country or to an international organisation outside the European Economic Area (EEA). Should we, in individual cases, effect such a transfer, this only takes place to those third countries for which an adequacy decision has been issued by the European Commission or the appropriate level of data protection has been ensured by suitable or adequate safeguards (e.g. Binding Corporate Rules or EU standard contractual clauses).
Duration of data storage
We only store your personal data for as long as the processing of your data is required to hold the competition, as well as for the period in which we potentially have to expect the assertion of legal claims against us. In individual cases, the statutory limitation period for such claims can be between three and thirty years.
If you have consented to our processing of your data, this data will be processed on the basis of your consent until you revoke it.
Furthermore, we store your personal data to the extent to which we are obliged to do so as part of our statutory obligations to provide evidence and retain records (e.g. in under the German Commercial Code, Fiscal Code, or Money Laundering Act). The statutory retention periods can be up to ten years. Furthermore, in exceptional cases, there may be special obligations to provide evidence that necessitate the storage of your personal data for a longer period of time.
Data subject rights
As a data subject, you have the following rights vis-à-vis us in accordance with Art. 15 et seq. GDPR. Please send an email for this purpose to datenschutz@hoffmann-filter.de. Alternatively, please let us know your request by post to the address stated above.
- Right to information
You have the right to demand information from us about whether we process personal data relating to you. If this is the case, you have the right to demand information from us about this personal data.
- Right to rectification
You have the right to demand rectification of any inaccurate personal data relating to you.
- Right to erasure
In certain cases, you have the right to demand that we erase personal data relating to you without delay.
- Right to restriction of processing
In certain cases, you have the right to demand restriction of processing by us.
- Right to data portability
You have the right to receive personal data relating to you which you have provided to us in a structured, common and machine-readable format.
- Right to object to processing per Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation and at any time, to processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR. If we use your data for direct advertising, you can object to this at any time.
- Right to revocation
If you have given us consent to use personal data, you are entitled to revoke this consent at any time.
- Right not to be subjected to a decision based solely on automated processing, including profiling
If we use your personal data to make a decision regarding you that is made exclusively within the framework of automated processing, you have the right to demand that this decision is not made exclusively by automated means.
- Right to lodge a complaint with a supervisory authority
In addition, you have the option to lodge a complaint with the responsible data-protection supervisory authority about the processing of your personal data. The data protection supervisory authority responsible for us is:
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hanover, Germany
If you have any further questions or comments, please feel free to contact us or our data protection officer.
Last updated: 21.06.2024