(1) In the following, we inform you about the collection of personal data when using our website. Personal data means all information relating to an identified or identifiable natural person (hereinafter "data subject"), e.g., name, address, e-mail addresses, telephone number, user behavior.
(2) The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is Bahlsen GmbH & Co. KG, Podbielskistraße 11, 30163 Hanover, Germany (see our Imprint ). You can contact our Data Protection Officer at volker.wodianka@privacy-legal.de or via our postal address with the addition "der Datenschutzbeauftragte" (The Data Protection Officer).
(3) When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, and, if applicable, your name and telephone number) will be stored by us in order to answer your questions. We delete the data arising in this context after 12 months once storage is no longer necessary, or restrict processing if statutory retention obligations apply. The processing of this personal data is carried out for the performance of pre-contractual measures and/or the execution of a contract (Art. 6(1)(b) GDPR) or for the purposes of our legitimate interests or the legitimate interests of third parties (Art. 6(1)(f) GDPR).
(4) If we use commissioned service providers for individual functions of our offering or wish to use your data for commercial or advertising purposes, we will inform you in detail below about the respective processes. In doing so, we also state the specified criteria for the storage duration.
(1) You have the following rights vis-à-vis us regarding your personal data, which you can assert via e-mail to Datenschutz@Bahlsen.com:
Right of access (Art. 15 GDPR)
Right to rectification or erasure (Art. 16, 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to data portability (Art. 20 GDPR)
Right to withdraw consent granted (Art. 7(3) GDPR; see § 5)
(2) You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data (Art. 77 GDPR).
(1) In the case of merely informational use of the website, i.e., if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (legal basis is Art. 6(1)(f) GDPR):
Date and time of the request
Web browser type and version used, as well as operating system
Hostname (IP address) of the requesting provider (visitor)
(2) In addition to the aforementioned data, technically necessary cookies—and, upon your consent, technically non-necessary cookies—are stored on your computer. Cookies are small text files that are stored on your hard drive assigned to the browser you are using, through which certain information flows to the entity setting the cookie (in this case, us). They serve to make the overall internet offering more user-friendly and effective.
(3) If cookies requiring your consent are set on our website, we will inform you separately within this Privacy Policy. If you have granted your consent for this, you can withdraw it at any time via the cookie banner on our website.
(4) To protect your data, we use SSL encryption. You can recognize this by the prefix https:// in the address bar of your browser.
(5) Statistics cookies collect information anonymously. This information helps us understand how our visitors use our website in order to continuously improve it. This includes, in particular, Matomo Analytics (see point 6).
(6) Matomo Analytics
Furthermore, upon granting your consent, we use a cookie that enables an analysis of your browsing behavior, allowing us to continuously optimize our website with regard to its quality, content, and user-friendliness. For this purpose, we use the open-source software tool Matomo, a service provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, NZBN 6106769 (hereinafter "Matomo").
The legal basis for the processing of your personal data is your consent pursuant to Art. 6(1)(a) GDPR.
With Matomo, no data is transmitted to servers that are outside our control. Data processing takes place exclusively on the servers of our website. We use Matomo with the extension "anonymized-IP", whereby your IP address is truncated by Matomo so that it is no longer possible to associate the data with you. If you consent to web analytics via Matomo, the following data will be collected and processed:
Your IP address (which is truncated by Matomo and subsequently does not allow any conclusions to be drawn about your person)
The webpage visited
The website from which you reached the visited webpage (referrer)
The subpages accessed from the visited webpage
The time spent on the webpage
The frequency of visits to the webpage
The data will be deleted as soon as it is no longer required for our analytical purposes. The storage duration depends on the type of cookie:
Visitor Cookie: 13 months
Referral Cookie: 6 months
Session Cookie: 30 minutes
You may withdraw your consent at any time with future effect via the data protection settings on our website .
(7) Friendly Captcha
We use the service "Friendly Captcha" on our website. The provider is Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is a privacy-friendly protective solution designed to make the use of websites by automated programs and scripts (so-called "bots") more difficult.
Friendly Captcha verifies whether data input on this website (e.g., in a contact form) is performed by a human or by an automated program (spam bot). For this purpose, Friendly Captcha analyzes the behavior of the website visitor based on various characteristics. Friendly Captcha does not store any personal data of the visitor. Data that could identify the visitor (such as IP addresses) is anonymized using one-way hashing. The following data is collected:
IP address
Connection data
Environmental data
Interaction data
Functional data
Data processing is carried out on the basis of Art. 6(1)(f) GDPR, as we have a legitimate interest in protecting our website from abusive automated spying and spam. The data is deleted once the purpose has ceased to exist. For this purpose, a data processing agreement has been concluded with Friendly Captcha, which guarantees the privacy-compliant processing of the aforementioned data. Further details can be found in the provider's privacy policy.
(1) In addition to the purely informational use of our website, we offer various services that you can use if interested. For this purpose, you generally have to provide further personal data, which we use to provide the respective service and to which the aforementioned data processing principles apply. In this context, data processing is either necessary for the provision of the service pursuant to Art. 6(1)(b) GDPR, or we inform you of the possibility of giving your voluntary consent for the use of your personal data pursuant to Art. 6(1)(a) GDPR (for the withdrawal of consent to the processing of personal data, see § 5).
(2) In some cases, we use external service providers ("processors" within the meaning of Art. 28 GDPR) to process your data. These have been carefully selected and commissioned by us, are bound by our instructions, and are regularly monitored.
(3) Furthermore, we may disclose your personal data to third parties if promotional campaigns, sweepstakes, contract conclusions, or similar services are offered by us jointly with partners. More detailed information on this will be provided when you supply your personal data or in the respective terms of use or terms and conditions of participation.
(4) Insofar as our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this circumstance in the description of the offering. Service providers in third countries are commissioned—unless they fall under an adequacy decision of the EU Commission—incorporating the EU Standard Contractual Clauses and the requirements pursuant to Art. 49 GDPR. Depending on the protection requirements of the data, appropriate additional security measures are agreed upon.
(1) If you have granted consent to the processing of your data (Art. 6(1)(a) GDPR), you may withdraw it at any time. Such withdrawal affects the lawfulness of the processing of your personal data after you have declared it to us. Please note, however, that any withdrawal has no effect on the lawfulness of the processing of personal data on the basis of other legal grounds pursuant to Art. 6(1) GDPR.
(2) Insofar as we base the processing of your personal data on the balancing of interests (Art. 6(1)(f) GDPR), you may object to the processing. This is the case if the processing is not necessary, in particular, for the performance of a contract with you, which is described by us in the respective functional description below. When exercising such an objection, we ask you to state the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and will either stop or adjust the data processing, or point out to you our compelling legitimate grounds worthy of protection on the basis of which we will continue the processing.
(3) Of course, you may object to the processing of your personal data for advertising and data analysis purposes at any time. You can inform us of your objection to advertising via the following contact details: Datenschutz@bahlsen.com.
(1) For exceptional cases where personal data is transferred to countries outside the European Economic Area (EEA), i.e., to third countries, this is done in accordance with the conditions of Art. 44 et seq. GDPR. We will inform you below of the respective details of the transfer at the relevant points.
(2) The European Commission certifies that certain third countries have data protection comparable to the EEA standard through so-called adequacy decisions. However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of statutory provisions. If this is the case, we ensure that data protection is sufficiently guaranteed. This is possible through binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data pursuant to Art. 46(1), (2)(c) GDPR, certificates, or recognized codes of conduct.
(1) Our websites contain links to other websites. We have no influence on the data collected there or on the data processing practices, nor do we know the full extent of data collection, the purpose of processing, or the retention periods.
(2) Furthermore, we have no information regarding the erasure of the collected data by the linked provider. In this respect, we are not responsible under data protection law for data processing on the linked website.
(3) Further information on the purpose and scope of data collection and processing by the website operator can be found in the privacy policies of the respective websites. There you will also find further information about your rights in this regard and setting options for protecting your privacy.
(1) We maintain fan pages within various social networks and platforms with the aim of communicating with customers, interested parties, and users active there, and informing them about our services. In operating these fan pages, we jointly determine the means and purposes of the processing of user data with the respective platform operator. To this extent, we and the social media providers are "joint controllers" pursuant to Art. 26 GDPR.
(2) Please note that your personal data may also be processed outside the European Union, namely in the USA. For the USA, the European Commission adopted its adequacy decision on July 10, 2023. It stipulates that the USA ensures an adequate level of data protection for transfers within this framework. Meta is certified under the EU-US Data Privacy Framework (DPF), and an adequate level of data protection can be assumed.
(3) User data is generally processed for market research and advertising purposes. For example, user profiles can be created based on usage behavior and the resulting user interests. These user profiles can, in turn, be used to place advertisements inside and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are generally stored on users' computers, in which usage behavior and user interests are saved. Furthermore, data may also be stored in user profiles independently of the devices used by the users (in particular if users are members of the respective platforms and are logged into them).
(4) We have integrated YouTube videos into our website. No data about you as a user is transmitted to YouTube unless you play the videos. Data is only transferred if you play the videos. We have no influence on this data transmission. Data processing is thus carried out voluntarily on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
(5) The processing of users' personal data is carried out on the basis of our legitimate interests in providing users with effective information and communicating with users pursuant to Art. 6(1)(f) GDPR. If users are asked by the respective providers for consent to data processing (i.e., declaring their agreement, e.g., by checking a checkbox or confirming a button), the legal basis for processing is Art. 6(1)(a) GDPR.
(6) Further information on the processing of your personal data as well as your options to object or withdraw consent can be found in the privacy policies of the respective providers listed below. The assertion of access rights and other rights of data subjects can also be exercised directly against the providers, as only they have direct access to user data and possess the corresponding information. Of course, we are available to answer questions and support you if you need assistance. The providers of our social media presences are:
Facebook
Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA
Privacy Policy
Instagram
Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA
Privacy Policy
Google und YouTube
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Privacy Policy
X (ehemals Twitter)
X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland
Privacy Policy
Via our job portal, you can find out about our current vacancies and apply. We collect and process applicant personal data for the purpose of handling the application process (legal basis is Art. 6(1)(b) or (f) GDPR). If we conclude an employment contract with an applicant, the submitted data will be stored for the purpose of managing the employment relationship in compliance with statutory provisions. If no employment contract is concluded with the applicant, the application documents are automatically deleted six months after notification of the rejection decision, provided that deletion is not opposed by any other legitimate interests on our part. Other legitimate interests in this sense include, for example, the defense of legal claims.
We use Rexx Systems GmbH Headquarters (Süderstrasse 75-79, 20097 Hamburg) as an external service provider. Rexx Systems operates the job portal under the domain karriere.bahlsen.com and processes personal data on our behalf as part of these activities. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Rexx Systems, which ensures that the processing is carried out in an appropriate manner.
We also process required personal data to conduct compliance screenings in connection with sanction and terror lists. This is done on the basis of our legitimate interest in complying with applicable sanctions regulations and fulfilling our compliance requirements pursuant to Art. 6(1)(f) GDPR.
Insofar as we do not collect personal data directly from you—for instance by reviewing publicly accessible professional profiles (e.g., on LinkedIn) or by contacting reference persons specified by you—this is done on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in supplementing and verifying your information within the scope of the application process. The categories of data processed in this context include, in particular, information regarding your professional qualifications, previous activities and skills, as well as assessments by reference persons. The data originates from the respective publicly accessible sources or from the references nominated by you.
Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Furthermore, storage may take place if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which we are subject. Blocking or erasure of the data also takes place when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.
(1) To conduct our business transactions, we use external domestic and foreign service providers (e.g., in the areas of IT, logistics, telecommunications, sales, and marketing), who may also gain knowledge of your personal data. We have concluded data processing agreements pursuant to Art. 28 GDPR with these providers, ensuring that data processing is carried out lawfully.
(2) If personal data is passed on by us to our subsidiaries or passed on to us by our subsidiaries (e.g., for advertising purposes), this is also done on the basis of existing data processing agreements.
We adapt this Privacy Policy from time to time whenever this becomes necessary due to changes in data processing activities. Please inform yourself regularly about the content of our Privacy Policy and also about the currency of contact information of third parties.