Privacy Policy

§ 1 INFORMATION ABOUT THE COLLECTION OF PERSONAL DATA 

(1) The following information concerns the collection of personal data while using this website. Personal data are all data that can be personally related to you, e.g. name, address, email addresses, user behaviour. 

(2) The Bahlsen GmbH & Co. KG, Podbielskistraße 11, 30163 Hannover and the BAHLSEN LLP, Randall House, Chiltern Park, Chiltern Hill, Chalfont St. Peter, Buckinghamshire, SL9 9 FG are responsible under data protection law pursuant to Art. 26 UK GDPR within the framework of a joint responsibility agreement. Together, we determine the purposes and means of processing your personal data and ensure its security and compliance with data protection laws.

(3) You can contact our data protection officer Dr Volker Wodianka, LL.M. at volker.wodianka@privacy-legal.de or at our postal address with the addition "the data protection officer".

(4) When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, your name and telephone number, if applicable, and the content of your message) will be stored by us in order to answer your questions. Your data will be processed as part of pre-contractual measures or on the basis of your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a) and b) UK GDPR. We delete the data arising in this context after storage is no longer necessary, or restrict processing if there are statutory retention obligations.

§ 2 YOUR RIGHTS 

(1) You have the following rights towards us with regard to your personal data: 

• Right to information, 

• Right to correction or deletion, 

• Right to restriction of processing, 

• Right to refusal of processing, 

• Right to data portability. 

(2) You also have the right to lodge a complaint about our processing of your personal data with a data protection authority.  

§ 3 REVOCATION OR WITHDRAWAL OF CONSENT TO THE PROCESSING OF YOUR DATA 

(1) If you have given your consent to the processing of your data, you can revoke it at any time. Such a revocation affects the permissibility of the processing of your personal data after you have given it to us.

(2) Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the fulfilment of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and will either discontinue or adapt the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing.

§ 4 DELETION AND STORAGE OF PERSONAL DATA 

(1) The data processed by us will be deleted in accordance with the legal requirements if the purpose for processing your data no longer applies or if it is no longer required for the purpose. Your data will also be deleted if the processing was based on your consent and you have withdrawn it.

(2) It may be that the storage of your data is necessary for other legally permissible purposes, such as the fulfilment of a legal obligation, the exercise of legal claims or for tax law reasons. In these cases, your personal data will only be processed for these purposes.

§ 5 COLLECTION OF PERSONAL DATA WHEN YOU VISIT OUR WEBSITE 

(1) If you use the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f) UK GDPR):

• Date and time of the enquiry

• Web browser type and version and operating system used

• Hostname (IP address) of the requesting provider (visitor)

(2) In addition to the aforementioned data, technically necessary and, optionally, technically unnecessary cookies are stored on your computer if you give your consent. Cookies are small text files that are stored on your hard drive assigned to the browser you are using and through which certain information flows to the body that sets the cookie (in this case us). They are used to make the website more user-friendly and effective overall. 

(3) If cookies are set on our website that require your consent, we will inform you about this separately within this privacy policy. If you have given your consent to this, you can revoke it at any time via the cookie banner on our website.

(4) To protect your data, we use SSIL encryption. You can recognise this by the prefix https:// in the address bar of your browser.

(5) You can revoke your consent at any time with effect for the future here.

§ 6 OTHER FUNCTIONS AND OFFERS ON OUR WEBSITE 

(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you must generally provide additional personal data that we use to provide the respective service and for which the aforementioned data processing principles apply.

(2) In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.

(3) If our service providers or partners are based in a country outside the UK we will inform you of the consequences of this circumstance at the appropriate point in this privacy policy.

§ 7 CONSENT MANAGER 

We use the Headless Content Management System of the following provider:

Storyblok GmbH, Peter-Behrens-Platz 2, 4020 Linz, Austria.

The images contained in our website are hosted and made available via this provider's systems. Your IP address is sent to Storyblok and is stored there for up to seven days for system-related reasons.

§ 8 CATEGORIES OF RECIPIENTS OF PERSONAL DATA

(1) To process our business transactions, we use external domestic and foreign service providers (e.g. for IT, logistics, telecommunications, sales and marketing) who may also gain knowledge of your personal data. We have concluded order processing contracts with these providers in accordance with Art. 28 UK GDPR, which ensure that data processing is carried out in a permissible manner.

(2) If your personal data is passed on by us to our subsidiaries or is passed on to us by our subsidiaries (e.g. for advertising purposes), this is also done on the basis of existing order processing relationships.

§ 9 CONDITIONS FOR THE TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

(1) For the exceptional cases in which personal data is transferred to countries outside the UK, i.e. to third countries, this is done under the conditions of Art. 44 et seq. UK GDPR. We will inform you about the respective details of the transfer at the relevant points below.

(2) The Commissioner certifies that some third countries have a level of data protection comparable to the UK standard by means of so-called adequacy decisions. However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible via binding corporate rules, standard data protection clauses of the Commissioner for the protection of personal data pursuant to Art. 46 para. 1, 2 lit. c) UK GDPR, certificates or recognised codes of conduct.

§ 10 WEB ANALYTICS MATOMO

(1) With your consent, we use a cookie to analyse your browsing behaviour so that we can continually improve the quality, content and usability of our website. For this purpose we use the open source software tool Matomo, a service of InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, NZBN 6106769 (hereinafter "Matomo").

(2) The legal basis for the processing of your personal data is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR.

(3) Matomo does not transmit any information to servers outside of our control. All data processing takes place on our servers. We use Matomo with an 'anonymised IP', where your IP address is shortened by Matomo so that the data cannot be assigned to you.

(4) If you consent to web analysis using Matomo, the following data will be collected and processed:

• Your IP address (which is truncated by Matomo and cannot be traced back to you)

• the accessed website

• the website from which you accessed the web page you have called up

• the subpages that are accessed from the accessed website

• the time spent on the website

• the frequency of visits to the website
  
  

§ 11 FRIENDLY CAPTCHA

(1) We use the "Friendly Captcha" service on our website. The provider is Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is a privacy-friendly protection solution to make it more difficult for automated programs and scripts (so-called "bots") to use websites.

(2) Friendly Captcha verifies whether the data input on this website (e.g., in a contact form) is made by a human or by an automated program (spam bot). For this purpose, Friendly Captcha analyzes the behavior of the website visitor based on various characteristics. Friendly Captcha does not store any personal data of the visitor. Data that could identify the visitor (such as IP addresses) are anonymized using one-way hashing.

The following data is collected:

• IP address

• Connection data

• Environment data

• Interaction data

• Functional data

(3) You can find more information about Friendly Captcha here.

(4) Data processing is carried out on the basis of Art. 6 Para. 1 lit. f) GDPR, as we have a legitimate interest in protecting our website from abusive automated reconnaissance and spam. The data will be deleted when the purpose for processing ceases to exist.

(5) For this purpose, we have a data processing agreement with Friendly Captcha, which guarantees the data protection-compliant processing of the data mentioned above.

§ 12 Social media presence

(1) We maintain fan pages within various social networks and platforms with the aim of communicating with the customers, interested parties and users active there and informing them about our services. When operating the fan pages, we determine the means and purposes of processing user data together with the respective platform operator. In this respect, we and the social media providers are “joint controllers” in accordance with Art. 26 UK GDPR.

(2) We would like to point out that your personal data may also be processed outside the European Union, namely in the USA. The European Commission issued its adequacy decision for the USA on July 10, 2023. It stipulates that the USA guarantees an adequate level of data protection for transfers within this framework. Meta and Google are certified under the EU-US Data Privacy Framework (DPF) and an adequate level of data protection can be assumed.

(3) As a rule, user data is processed for market research and advertising purposes. For example, usage profiles can be created from the usage behavior and the resulting interests of the users. These user profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are generally stored on the user's computer, in which the user's usage behavior and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

(4) We have integrated YouTube videos into our website. No data about you as a user is transferred to YouTube if you do not play the videos. The data is only transferred when you play the videos. We have no influence on this data transfer.

(5) The processing of users' personal data is based on our legitimate interests in effectively informing users and communicating with users in accordance with Art. 6 para. 1 lit. f) GDPR. If users are asked by the respective providers to consent to data processing (i.e. to give their consent, e.g. by ticking a checkbox or confirming a button), the legal basis for processing is Art. 6 (1) (a) UK GDPR.

(6) Further information on the processing of your personal data and on your options for objection or revocation can be found under the links of the respective provider listed below. The assertion of information and other rights of the data subjects can also be made against the providers, as only they have direct access to the data of the users and have the corresponding information. We are of course available to answer any questions you may have and will support you if you need help. The providers for our social media presences are:

Facebook
Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA
Privacy Policy

Instagram
Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA
Privacy Policy

Google and YouTube
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Privacy Policy

§ 13 LINKS

(1) We use links to content on websites of other websites operators.

(2) We have no influence on the data collected there or the data processing procedures, nor do we know the entire scope of the data collection, the purpose of the processing of the retention periods.

(3) We also have no information about the deletion of the collected data by the linked provider. In this respect, we are not responsible under data protection law for the data processing on the linked website. 

(4) Further information on the purpose and scope of data collection and processing by the website operator can be found in the following data protection statements. There you will also find further information on your rights in this regard and the settings options for protecting your privacy. 

§ 14 DATA PROTRECTION FOR ONLINE JOB APPLICATIONS AND APPLICATION PROCESSING

(1) You can send us application documents by e-mail or post.

(2) Your data required for establishing contact and the application process will be for the purpose of carrying out an application procedure in compliance with the legal regulations. The legal basis for this is Art. 6 para. 1 lit. b) UK GDPR.

(3) The following data may be processed by us in the application process

• Master data (title, first name, surname, date of birth if applicable)

• Contact data (address, telephone or mobile phone number, private e-mail address)

• Application data (e.g. profile picture and other documents such as CV, cover letter, complete application, certificates).

(4) In the event of employment, the data will be transferred to the personnel file. Information on the storage period can be found in the information on the processing of personal data of our employees.

(5) If an application for a specific job advertisement is unsuccessful, your data will be retained for data for evidence purposes for up to 6 months after completion of the application procedure for the possible assertion, exercise or defense of legal claims.

(6) With your consent, we will be happy to include your application in our applicant pool until further notice. We will save unsolicited applications for the search for a suitable position for you until you withdraw your consent.

(7) The provision of data is not required by law or contract. You are not obliged to provide the data. However, if you do not provide the data, it will not be possible to carry out an application procedure and, if applicable, to hire you.

§ 15 UPDATING THE PRIVACY POLICY

We amend this privacy policy from time to time if this is necessary due to changes in data processing. Please make sure you keep updated with the content of our privacy policy and also about the latest updates on contact information from third parties.