PRIVACY POLICY

We take data protection seriously
 

Protecting your privacy when processing personal data is a matter of great importance to us. When you visit our website, our web servers automatically record your Internet Service Provider’s IP address, the website from which you are visiting us, the pages you view on our site, and the date and duration of your visit. This information is essential for the technical delivery of the web pages and for secure server operation. This data is not analysed in a personalised manner.

If you send us data via the contact form, this data will be stored on our servers as part of our data backup procedures. We will use your data solely for the purpose of dealing with your enquiry. Your data will be treated in strict confidence. It will not be passed on to third parties.

Data controller:

CD-LUX Warenhandelsgesellschaft mbH
Industriestraße 8
93455 Traitsching
Telephone: 09971-85 71 0
Email: info@cd-lux.de
 

Personal data

Personal data is information relating to you as an individual. This includes your name, address and email address. You are not required to provide any personal data in order to visit our website. In some cases, we need your name and address, as well as further information, in order to provide you with the service you have requested.

The same applies if, at your request, we send you information material or respond to your enquiries. We will always inform you of this in such cases. Furthermore, we only store the data that you have provided to us automatically or voluntarily.

When you use one of our services, we generally collect only the data necessary to provide you with that service. We may ask you for further information, but this is provided on a voluntary basis. Whenever we process personal data, we do so in order to provide you with our service or to pursue our commercial objectives.

Contacting Us

When you contact us (e.g. via the contact form, by email, telephone or social media), the details provided by the enquirer are processed to the extent necessary to respond to the enquiry and to carry out any requested actions.

Responding to enquiries within the context of contractual or pre-contractual relationships is carried out to fulfil our contractual obligations or to respond to (pre-)contractual enquiries, and otherwise on the basis of our legitimate interests in responding to such enquiries.

• Types of data processed: Master data (e.g. names, addresses), contact details (e.g. email addresses, telephone numbers), content data (e.g. entries in online forms).
• Data subjects: Communication partners.
• Purposes of processing: Contact enquiries and communication.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Automatically stored data
 

Server log files
 

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:

• Date and time of the request
• Name of the requested file
• Page from which the file was requested
• Access status (file transferred, file not found, etc.)
• Web browser and operating system used
• Full IP address of the requesting computer
• Amount of data transferred

This data is not combined with other data sources. Processing is carried out in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

For reasons of technical security, in particular to defend against attempted attacks on our web server, we store this data temporarily. It is not possible for us to identify individual persons on the basis of this data. After seven days at the latest, the data is anonymised by truncating the IP address to the domain level, so that it is no longer possible to establish a link to an individual user. In anonymised form, the data is also processed for statistical purposes; it is not cross-referenced with other data sets or disclosed to third parties, even in part. The number of page views is only reported as part of our server statistics, which we publish every two years in our annual report.

Cookies
 

When you visit our website, we may store information on your computer in the form of cookies. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters that enables websites and servers to associate the cookie with the specific web browser in which it was stored. This enables the websites and servers visited to distinguish the data subject’s individual browser from other web browsers that contain different cookies. A specific web browser can be recognised and identified via the unique cookie ID.

By using session cookies, the data controller can provide users of this website with a user-friendly service that would not be possible without the use of cookies. Without consent, we only use technically necessary cookies on the legal basis of legitimate interest in accordance with Article 6(1)(f) of the GDPR.
 

We only use personal data cookies to improve our website or for marketing/advertising purposes with your consent. On your first visit, you may voluntarily consent to tracking or analytics via the cookie banner that appears on the screen. Where applicable, your data may be passed on to partners or third-party providers. These cookies will only be stored if you explicitly consent to them; the legal basis in this case is your consent in accordance with Article 6(1)(a) of the GDPR.

You can change your cookie settings at any time here:

Hotjar

This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).

Hotjar is a tool for analysing your user behaviour on this website. With Hotjar, we can, amongst other things, record your mouse and scroll movements and clicks. Hotjar can also determine how long you have hovered your mouse pointer over a specific area. From this information, Hotjar creates so-called heatmaps, which can be used to identify which areas of the website visitors prefer to view.

Furthermore, we can determine how long you stayed on a page and when you left it. We can also identify at which point you abandoned your entries in a contact form (so-called conversion funnels).
 

In addition, Hotjar can be used to gather direct feedback from website visitors. This function serves to improve the website operator’s online offerings.

Hotjar uses technologies that enable user recognition for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting).

The use of this analytics tool is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

If you wish to disable data collection by Hotjar, click on the following link and follow the instructions provided there:

https://www.hotjar.com/policies/do-not-track/

Please note that Hotjar must be deactivated separately for each browser and for each device. For further information about Hotjar and the data collected, please refer to Hotjar’s privacy policy at the following link:

https://www.hotjar.com/privacy
 

We have entered into a data processing agreement (DPA) in accordance with Article 28 of the GDPR with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Google Tag Manager

Our website uses Google Tag Manager, a tool provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”). We use Google Tag Manager to manage the tools employed on our website, which are described in this privacy notice. For details regarding these tools, please refer to the information relating to the specific tool. We use Google Tag Manager on the basis of our legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in integrating tags. The use of Google Tag Manager enables us to integrate further services into our website.

The tool triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in effect for all tracking tags implemented using Google Tag Manager. Tag Manager processes and transmits your IP address to servers in the USA.

The data transmitted consists solely of pseudonyms; it is not possible to identify you by name. Google bases the transfer of data to the USA on the Transatlantic Data Privacy Framework of 10 July 2023 (TADPF) and, in the case of data transfers to other third countries, on the EU Standard Contractual Clauses. You can obtain a copy of the EU Standard Contractual Clauses here. This ensures that a level of protection comparable to that in the EU is maintained.

We have entered into a data processing agreement with Google for the use of Google Tag Manager. Under this agreement, Google undertakes to collect data in accordance with the General Data Protection Regulation and to safeguard the rights of data subjects. Further information on Google Tag Manager can be found in the terms of use for this product.

Google Analytics (4)
 

We use Google Analytics 4 on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: ‘Google’). In this context, pseudonymous user profiles are created and cookies are used.

The information generated by the cookie regarding the use of our website (e.g. the IP address of the accessing computer, the time of access, the referrer URL, and information about the browser and operating system used) is generally transmitted to Google’s servers in the USA and processed there.

The use of Google Analytics is based on your consent (Article 6(1), first sentence, point (a) of the GDPR in conjunction with Section 25(1) of the TDDDG) for the analysis and optimisation of our online offering and the efficient operation of this website. Google therefore processes this information on our behalf in order to analyse the use of the website, to compile reports on website activity, and to provide us with further services relating to website and internet usage for the purposes of market research and the needs-based design of these web pages.

We have entered into a data processing agreement with Google regarding the use of Google Analytics. Under this agreement, Google undertakes to process the data in accordance with the General Data Protection Regulation and to ensure the protection of the data subject’s rights.
 

The IP address processed by Google Analytics is automatically truncated. The last three digits of your IP address are replaced with a ‘0’, which prevents it from being linked to you.

Where applicable, the data collected may be transferred to third parties where required by law or where third parties process the data on our behalf. User data collected via cookies is automatically deleted after 14 months.

The information generated by the cookies regarding the use of our website (e.g. the IP address of the accessing computer, the time of access, the referrer URL, and information about the browser and operating system used) is transferred to Google’s servers in the USA and processed there. For the transfer of data to recipients based in the USA, Google relies on the Transatlantic Data Privacy Framework of 10 July 2023 (TADPF) and, in the case of data transfers to other third countries, on standard contractual clauses approved by the European Commission as a guarantee to ensure a level of data protection comparable to that in the EU. You can obtain a copy of the standard contractual clauses here. We only transfer data to Google on the basis of your consent.

You may withdraw or amend your consent at any time with future effect. Further information on data protection in connection with Google Analytics can be found, for example, in the Google Analytics Help Centre. Information on Google’s use of data can be found in their privacy policy.

Google Web Fonts (locally hosted)

This site uses so-called web fonts, provided by Google, to ensure consistent font display. The Google Fonts are installed locally. No connection is made to Google’s servers.

Further information on Google Web Fonts can be found at

https://developers.google.com/fonts/faq and in Google’s privacy policy:

https://policies.google.com/privacy?hl=de.

Google Maps

This website uses the Google Maps mapping service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this website has no influence over this data transfer. When Google Maps is activated, Google may use Google Web Fonts to ensure consistent font display. When you access Google Maps, your browser loads the required web fonts into its cache to display text and fonts correctly.
 

We use Google Maps to ensure our online services are presented in an appealing way and to make it easy to locate the places listed on our website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses.

Further details can be found here:

https://privacy.google.com/businesses/gdprcontrollerterms/ and

https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

Further information on the handling of user data can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.

Online application form and appointment booking via Microsoft Forms and Microsoft Bookings
 

For our online application process, we use the services Microsoft Forms (online form) and Microsoft Bookings (online appointment booking). These services are provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (hereinafter “Microsoft”).

We use Microsoft Forms to enable you to apply to us online via a structured form. We use Microsoft Bookings so that you – provided you have not previously worked for us – can conveniently book an appointment for a face-to-face interview. As part of the application process, we process the data you provide in the form, in particular your title, first name and surname, contact details (email, telephone number and, where applicable, postal address), details of your preferred role and working hours, start date, salary expectations (where applicable), and any other information you provide voluntarily. When booking an interview, the selected date and the contact details required to organise the appointment are also processed. From a technical perspective, when you access the form or the booking page, connection data (including IP address, date and time of access, and browser information) is also processed by Microsoft. The legal basis for the processing of your application data is Article 6(1)(b) of the GDPR in conjunction with Section 26(1) of the BDSG (initiation of an employment relationship). Where you also consent to your data being stored for a longer period (e.g. for our talent pool), the legal basis is Article 6(1)(a) of the GDPR and Section 26(2) of the BDSG. You may withdraw this consent at any time with effect for the future. Your application data will be stored for the duration of the recruitment process and deleted no later than 6 months after the process has been completed, unless a longer retention period is required by law or you have consented to longer storage. If you are offered a position, the data will be transferred to your personnel file.

We have entered into a data processing agreement with Microsoft in accordance with Article 28 of the GDPR (Microsoft Products and Services Data Protection Addendum, DPA). Microsoft processes your data exclusively in accordance with our instructions and for the purposes set out above. Microsoft is a company based in the EU; however, it may transfer data to group companies in the USA in order to provide its services. Microsoft is certified under the EU-US Data Privacy Framework, meaning that an adequate level of data protection in accordance with Article 45 of the GDPR is generally guaranteed. In addition, Microsoft has implemented EU Standard Contractual Clauses in accordance with Article 46(2)(c) of the GDPR.
 

Further information on data protection at Microsoft can be found in the Microsoft Privacy Statement at:
https://privacy.microsoft.com/de-de/privacystatement

Customer Account / Retailer Login

We set up password-protected direct access to their account details stored with us (customer account) for every customer who registers accordingly. Here you can view details of your completed, pending and recently dispatched orders, and manage your address details, bank details and newsletter subscription. You undertake to treat your personal login details as confidential and not to disclose them to any unauthorised third party. We cannot accept any liability for the misuse of passwords, unless we are responsible for such misuse.

Online Presence on FACEBOOK and INSTAGRAM
 

Provided that you have given your consent to the relevant social media operator in accordance with Article 6(1), first sentence, point (a) of the GDPR, when you visit our online presence on the social media platforms mentioned above, your data will be automatically collected and stored for market research and advertising purposes, from which usage profiles are created using pseudonyms. These may be used, for example, to display adverts both on and off the platforms that are presumed to match your interests. Cookies are generally used for this purpose. For detailed information on the processing and use of data by the relevant social media operator, as well as contact details, your rights in this regard and settings to protect your privacy, please refer to the providers’ privacy policies linked below. Should you nevertheless require assistance in this regard, please do not hesitate to contact us.

Facebook: https://www.facebook.com/policy.php

Instagram: https://instagram.com/about/legal/privacy/

Newsletter
 

We use the so-called double opt-in procedure to send out the newsletter; in other words, we will only send you a newsletter by email once you have expressly confirmed to us that you wish us to activate the newsletter service. We will then send you a confirmation email and ask you to confirm that you wish to receive our newsletter by clicking on a link contained in that email. When you subscribe to our newsletter, we store your IP address and the date of your subscription. This information is stored solely as evidence in the event that a third party misuses your email address to subscribe you to the newsletter without your knowledge or authorisation.

Should you no longer wish to receive newsletters from us at a later date, you may opt out at any time without incurring any costs other than the transmission costs charged at standard rates. A written notification to us or our Data Protection Officer (e.g. email, fax, letter) is sufficient for this purpose. Naturally, you will also find an unsubscribe link in every newsletter.

We use the Cleverreach service to send out the newsletter; a contract for commissioned data processing has been concluded with this service provider.

Security

We have put in place technical and administrative security measures to protect your personal data against loss, destruction, tampering and unauthorised access. All our employees and service providers working on our behalf are bound by the applicable data protection laws.

Whenever we collect and process personal data, it is encrypted before being transmitted. This means that your data cannot be misused by third parties. Our security measures are subject to a continuous improvement process and our privacy policies are regularly updated. Please ensure that you have the most recent version.

Data subjects’ rights

You have the right at any time to access, rectify, erase or restrict the processing of your stored data, the right to object to the processing, as well as the right to data portability and the right to lodge a complaint in accordance with the provisions of data protection law.

Right of access:

You may request information from us as to whether and to what extent we process your data.

Right to rectification:

If we process your data and it is incomplete or inaccurate, you may request that we rectify or complete it at any time.

Right to erasure:

You may request that we erase your data if we are processing it unlawfully or if the processing disproportionately infringes upon your legitimate interests. Please note that there may be reasons preventing immediate erasure, e.g. in the case of statutory retention obligations.

Irrespective of whether you exercise your right to erasure, we will erase your data promptly and in full, provided that no contractual or statutory retention obligation prevents this.

Right to restriction of processing:

You may request that we restrict the processing of your data if

• you contest the accuracy of the data, for a period enabling us to verify the accuracy of the data.
• the processing of the data is unlawful, but you object to erasure and instead request a restriction on the use of the data,
• we no longer require the data for the intended purpose, but you still need this data to establish, exercise or defend legal claims, or
• you have objected to the processing of the data.

Right to data portability:

You may request that we provide you with the data you have supplied to us in a structured, commonly used and machine-readable format, and that you may transmit this data to another data controller without hindrance from us, provided that

• we process this data on the basis of consent given by you (which may be withdrawn) or for the performance of a contract between us, and
• this processing is carried out by automated means.

Where technically feasible, you may request that we transfer your data directly to another data controller.

Right to object:

If we process your data on the basis of a legitimate interest, you may object to this data processing at any time; this would also apply to profiling based on these provisions. We will then no longer process your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You may object at any time, without giving reasons, to the processing of your data for the purposes of direct marketing.

Right to lodge a complaint:
 

If you believe that we are breaching German or European data protection law in our processing of your data, please contact us so that we can clarify any issues. You also, of course, have the right to contact the supervisory authority responsible for you, namely the relevant State Office for Data Protection Supervision.

Changes to this Privacy Policy

We reserve the right to amend our privacy policies should this be necessary due to new technologies. Please ensure that you have the most up-to-date version. Should any fundamental changes be made to this Privacy Policy, we will announce them on our website.

Mr Robert Heindl

Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg

Tel.:  0941 2986930
Fax:  0941 29869316
Email: anfragen@projekt29.de
Website: www.projekt29.de