Data Protection Declaration - Privacy Statement

§ 1       Information on the collection of personal data
(1)        In the following, we inform you about the collection of personal data when using our website. Personal data includes all data that can be related to you personally, e.g., name, address, e-mail addresses, user behavior.

(2)        Responsible controller and contact data pursuant to Art. 4 (7) EU General Data Protection Regulation (GDPR) is Bahlsen GmbH & Co. KG, Podbielskistraße 11, 30163 Hannover (see our imprint). Our Data Protection Officer can be reached at info@Bahlsen.com or via postal mail address directed toward the “Data Protection Officer”.

(3)        If you contact us via e-mail or by using a contact form, the data provided by you (your e-mail address and, if necessary, your name and phone number) will be stored in order to respond to your query. The data provided in this context will be deleted after six months, after the storage of such data is no longer require. Or, in case legal retention periods apply, the processing of the data will be restricted.

(4)        If we contract service providers for individual functions of our offer, or if we would like to use your data for advertising purposes, we will inform you about the respective activities, as detailed below, including the established criteria for the duration of storage.

§ 2       Your rights

(1)        You may assert the following rights towards us regarding your personal data:

• Right to information,
• Right to rectification or erasure,
• Right to restriction of processing,
• Right to revoke the declaration of consent to the processing,
• Right to data portability.

(2)        You also have the right to lodge a complaint with a supervisory authority concerning our processing of your personal data.

§ 3       Collection of personal data when visiting our website

(1)        When using the website for informational purposes only, meaning without registering or providing other information, we only collect the personal data sent to our server by your browser.  If you wish to view our website, the following technical data necessary to display our website and to ensure safety and stability is collected (legal basis: Art. 6(1), clause 1, lit. f GDPR):

• Date and time of the request
• Name of the called upon file
• Access status
• Amount of data transferred
• The browser and operating system used
• Referrer URL (previously visited site)
• The search string, if accessed via a browser
• Hostname (IP address) of the requesting provider (user)

(2)        In addition to the aforementioned data, when using our website, cookies that you have selected and accepted will be stored on your computer. Cookies are small text files that are stored on your computer respective to the browser used, and through which certain information is transferred to the site placing the cookie (in this case, us). Cookies cannot execute programs or transfer viruses to your computer. They serve to provide more user-friendly and effective internet services.

• Transient cookies, see (c)
• Persistent cookies, see (d)

(c)        Transient cookies are automatically deleted when you close the browser you are using, including session cookies. These cookies store the so-called session ID, which is used to allocate different requests of your browser to the joint session. This allows recognition of your computer when you return to the website. The session cookies are deleted when you log out or close your browser.

(d)        Persistent cookies are automatically deleted after a specified time, which may vary depending on the cookie. You can use the security settings of your browser to delete the cookies at any time.

(4)         Matomo Analytics

In addition, after you have given your consent, we use a cookie that enables us to analyse your surfing behaviour so that we can continuously optimise our website with regard to its quality, content and user-friendliness. For this purpose, we use the open source software tool Matomo, a service of InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, NZBN 6106769 (hereinafter "Matomo").

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 clause 1 p. 1 lit. a GDPR as well as § 25 clause 1 p. 1 TTDSG.

With Matomo, no data is transmitted to servers that are outside of our control. The data processing takes place exclusively on the servers of our website. We use Matomo with the addition "anonymised-IP", whereby your IP address is shortened at Matomo, so that an allocation of the data to you is then not possible.

If you agree to web analysis using Matomo, the following data will be collected and processed:

Your IP address (which is shortened by Matomo and then does not allow any inference to your person)

• the website you accessed
• the website from which you accessed the website you are visiting
• the sub-pages that are visited from the called-up website
• the time spent on the website
• the frequency with which the website is accessed

The data is deleted as soon as it is no longer required for our analysis purposes. Depending on the type of cookie, the data will be stored for the following period of time:

• Visitor Cookie: 13 months
• Referral Cookie: 6 months
  
• Session Cookie: 30 minutes

§ 4       Further functions and offers by our website

(1)        Our website offers other services aside from just informational use that may be of interest to you.  To make use of these, generally, you must provide further personal data for which the aforementioned data processing principles apply.

(2)        In some cases, we may use external service providers to process your data. These service providers are carefully selected and contracted by us, are bound to our instructions, and are monitored regularly.

(3)        Furthermore, we may pass your personal data on to third parties in cases of campaigns, raffles, joint contracts, or similar activities offered jointly with service partners. You are offered more details when asked to enter your personal data or in the respective participation conditions of the individual activities.

(4)        If our service partner is seated outside of the European Economic Area (EEA), we will provide information accordingly in the service description. 

§ 5       Objection or revocation of the processing of your data

(1)        If you have consented to the processing of your data, you can revoke it at any time. Such a revocation affects the permissibility of processing your personal data after you have withdrawn your consent.

(2)        If the processing of your personal data is based on a weighing of interest, you may object to the processing of your personal data. This is especially the case if processing the data is not necessary for fulfilling the contract with you, which we explain in the following descriptions of the functions below.  When exercising an objection, please offer your reasons why your personal data should not be processed, as we have described. In case of a justified objection, we will examine the situation and will either stop, adjust, or offer compelling protective reasons why we would continue processing the data. 

(3)        You may revoke the processing of your personal data for purposes of advertisement or data analysis at any time. You can contact info@bahlsen.com for further information about this.

§ 6       Social media

(1)        Use of social media plug-ins

(a)        We currently use the following social media plug-ins: Facebook, Google+, Twitter, Instagram, Pinterest. We use the so-called two-click solution. This means that when you visit our website, no personal data is initially transferred to the plug-in provider. You can recognize the provider of the plug-in by the button with either its beginning letter or its logo on it. We offer the option to communicate directly with the plug-in provider via that button. Only if you click the button, thereby activating it, and by agreeing to the use of cookies, will the plug-in service provider receive the information that you were using our website. The data described in § 3 of this declaration will be transferred. In the case of Facebook, in Germany, the IP address is anonymized directly upon collection. By activating the plug-in, your personal data will be transferred to the respective plug-in provider and stored there (in case of US providers, storage is in the USA). Since the plug-in provider uses cookies to collect the data, we recommend deleting all cookies using the security settings of your browser before activating the settings, or to not select the plug-in cookies when activating the cookies for the Bahlsen website, thereby, not agreeing to their use.

(b)        We have no influence over the collected data or the data processing procedures, nor are we familiar with the full extent of the data processing, the purposes of the data processing, or the duration of storage of the collected data by the plug-in provider. We also have no information on the deletion of collected data by the plug-in provider.

(c)        The plug-in provider stores the collected data to create user profiles for advertisement and market research purposes, and/or to design their website as needed. Such processing especially takes place to display needs-based advertisements and to inform other users of the social network about your activities on our website. You have the right to object to the creation of such a user profile, whereby you must seek out the plug-in provider to do so. We offer the use of plug-ins so that you have the option to interact with the users of the social network if and to improve our offers to make them more attractive to you. The legal basis for using plug-ins is your agreement pursuant to Art. 6(1), clause 1, lit. a GDPR.

(d)        The data transfer takes place whether you have an account with the plug-in provider or are logged in there. If you are logged in with the plug-in provider, the data collected by us is directly linked to your account with the plug-in provider. Once you activate the button and, e.g., create a link to the plug-in provider site, the plug-in provider stores the information in your user account and provides the information to your public contacts. We recommend that you log out of your social network account regularly, especially before activating the button, to prevent linking to your profile at the plug-in provider.

(e)        Further information about the purpose and the extent of the data collected and processed by the plug-in provider can be found in the privacy policies of that provider. There you will find further information about your respective privacy rights and security options.

(f)         The postal addresses of the plug-in providers, as well as the URLs to their privacy policies, are:

• Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php; further information regarding data processing: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook takes part in the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. 

• Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de. Google takes part in the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. 

• Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter takes part in the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

• Instagram LLC, 1601 Willow Rd, Menlo Park CA 94025, USA; https://help.instagram.com/155833707900388.  

• Pinterest Inc., 651 Brannan Street, San Francisco, CA 94103, USA; https://policy.pinterest.com/de/privacy-policy.

§ 11 Data protection for online job applications and application processing

We collect and process personal data from job applicants for handling job application procedures (legal basis: Art. 6(1), clause 1, lit. b, or lit. f GDPR). Processing can take place electronically. Especially when applicants send their job applications to us electronically, e.g., via e-mail or contact form on our website. If we sign an employment contract with the applicant, the transferred data will be stored for the employment process in adherence to legal regulations. If no employment is offered, the application materials are automatically deleted six months after notifying the applicant of our decision, unless other justified interest on our part remains. Legitimate interest in such a case is, e.g., a burden of proof in a case regarding the General Equal Treatment Act (AGG).