I. Name and address of the responsible entity
Responsible entity within the meaning of the General Data Protection Regulation (RODO) and other national data protection laws of the Member States as well as other regulations in this regard:
Rhenus SE & Co. KG
Rhenus Platz 1
59439 Holzwickede
Germany
Tel: +49 (0)2301 29-0
e-mail: info@de.rhenus.com
II. Name and address of the data protection officer
Designated data protection officer
Data Protection Officer
Rhenus Platz 1
59439 Holzwickede
Germany
Tel: +49 (0)2301 29-1122
e-mail: datenschutz@de.rhenus.com
In order to ensure adequate protection of your private sphere and complete confidentiality when processing your personal data, we would like to provide you with some useful tips and information below:
III. General information on data processing
1. scope of data processing
In principle, we collect and process personal data of our users only to the extent necessary for the preparation of a functional website and our contents and services. The collection and processing of our users’ personal data regularly only takes place with your consent. Exceptions to this are those cases in which it is factually impossible to obtain the user’s consent in advance and the processing is permitted by the relevant legal provisions.
2 Legal basis for processing personal data
Insofar as we obtain the consent of the person concerned to the processing of his or her personal data, Article 6(1)(a) of the EU General Data Protection Regulation (RODO) serves as the legal basis.
If we process personal data required for the performance of a contract to which the person concerned is a party, then Article 6(1)(b) of the RODO regulation serves as the legal basis. This also applies to data processing procedures that are necessary for pre-contractual measures.
If the processing of personal data is necessary to comply with a legal (statutory) obligation to which our company is subject, then Article 6(1)(c) of the RODO Regulation serves as the legal basis.
If the vital interests of the person concerned or of another natural person require the processing of personal data, then Article 6(1)(d) of the RODO Regulation serves as the legal basis.
If the processing of personal data is necessary to defend the legitimate interests of our company or a third party, and if the interests, fundamental rights and fundamental freedoms of the person concerned do not outweigh the interests mentioned first, then Article 6(1)(f) of the RODO Regulation serves as the legal basis for the processing of personal data.
3 Data erasure and storage period
The personal data of the person concerned shall be erased or blocked as soon as the purpose for storing them has disappeared. In addition, data may be stored if this is provided for by the European or national legislator in EU regulations, laws or other legal provisions to which the responsible entity is subject. The blocking or deletion of the data also takes place when the period of storage stipulated by the aforementioned legal acts expires, unless there is a requirement to further store the data for the conclusion of a contract or the performance thereof.
IV. Provision of the website and creation of log files
Collection of anonymous data
In principle, you can visit our web pages without telling us who you are. In this case, we only learn technical data, such as the name of your internet service provider, the address of the website from which you came to us and the pages you visited with us. This information, in combination with the date and time, is used for internal statistical purposes in connection with advertising and the analysis of our web pages in order to adapt them better to your needs. In doing so, you as a user remain completely anonymous. Pseudonymised usage profiles are not created.
2 Legal basis for data processing
The legal basis for the temporary storage of data is Article 6 (1) (f) of the RODO Regulation.
3 Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user’s computer. For this purpose, the user’s IP address must be stored in the system for the duration of the session. In this respect, we have a legitimate interest in processing the data within the meaning of Article 6(f) of the RODO Regulation.
4 Data retention period
Data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected (recorded). In the case of the collection of data for the provision of the website, this happens as soon as the respective session has ended.
5 Possibility to object and delete data
The collection of data to provide the website and its storage in log files is necessary for the proper operation of the website. This results in no possibility of objection on the part of the user.
V. Use of cookies
a.) Description and scope of data processing
We use cookies to improve the quality of the structure and content of our website, as well as to enable user-friendly and as smooth as possible navigation. By limiting ourselves to the time of your visit, we create so-called session cookies. These serve to store information about which content has been viewed on your computer and also help to increase your security when surfing the internet. If you leave our website or do not visit it for some time, these persistent cookies are deleted.
Cookies cannot cause any damage to your computer. They do not represent a risk of computer viruses or theft of data from your computer. You can determine the scope of use of cookies yourself. To allow, reject, view and delete cookies, please use the help function of your internet browser.
We use cookies to make our website as user-friendly as possible. Some elements of our website require that the calling internet browser can also be identified when you navigate to another page. The following data is stored and transmitted in cookies.
Language settings
In addition, we use cookies to analyse your surfing behaviour. This makes it possible to transmit the following data:
Phrases entered into the search engine
b.) Legal basis for data processing
The legal basis for the processing of personal data using cookies is Article 6(1)(f) of the RODO Regulation.
c.) Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of our websites by users. Without the use of cookies, certain functions of our website cannot be implemented. This is because they require your browser to be re-identified after a page change. We use cookies for the following purposes:
Override of language settings
User data collected in technically necessary cookies is not used to create user profiles.
Analytical cookies are used to improve the quality of our website and its content. Analytical cookies allow us to learn how our website is used, which enables us to continuously optimise our offering. The following analytical cookies are used:
Storage of search phrases
In this respect, we have a legitimate interest in processing personal data within the meaning of Article 6 (1) (f) of the RODO Regulation.
d.) Data retention period, possibility to object and delete data
Cookies are stored on your computer and from there transmitted to our system. In this way, you as a user have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing the settings of your browser. Cookies already stored on your computer can be deleted at any time. This can also be done by automated means. If you deactivate cookies for our website, it will not be possible to make full use of all functions offered there.
VI. Newsletter
1 Description and scope of data processing
The dispatch of the newsletter takes place on the basis of the registration of user data on the website:
On our website it is possible to subscribe to the free newsletter. The data you provide when subscribing to the newsletter are transmitted to us. In doing so, the following data are processed:
E-mail address
First and last name (optional)
In addition, the following data is collected during subscription:
IP address of the calling computer
Date and time of registration
During the registration process (subscription), consent to the processing of your data is collected from you and reference is made to this data protection declaration.
The dispatch of the newsletter is based on the sale of products or services:
When a user purchases products or services on our website and leaves his or her email address with us, it may be used by us to send the newsletter. In this case, only direct advertising for similar products or services of our own is sent via the newsletter.
No data is passed on to third parties in connection with the processing of data for sending the newsletter. The data is used exclusively to send the newsletter.
2 Description and scope of data processing
The dispatch of the newsletter takes place on the basis of the registration of user data on the website:
Article 6 (1) (a) of the RODO Regulation provides the legal basis for the processing of data after the user subscribes to the newsletter and gives the relevant consent.
The dispatch of the newsletter is based on the sale of products or services:
The legal basis for sending the newsletter as a result of the sale of products or services is Section 7 (3) of the German Unfair Competition Act (UWG).
3 Purpose of data processing
The user’s e-mail address is stored for the purpose of delivering the newsletter.
The dispatch of the newsletter takes place on the basis of the registration of the user’s data on the website:
Other personal data collected as part of the newsletter subscription process is used to prevent abuse of the services or the email address used.
4 Data retention period
Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected (registered). This means that the user’s email address is stored as long as the subscription to the newsletter is active.
The dispatch of the newsletter is based on the registration of the user’s data on the website:
Other personal data collected as part of the newsletter subscription process is generally deleted after seven days.
5 Possibility to object and delete data
The subscription to the newsletter can be cancelled at any time by the user concerned. An appropriate link in each newsletter is provided for this purpose.
The dispatch of the newsletter is based on the registration of the user’s data on the website:
This also allows you to revoke your consent to the storage of personal data collected during the newsletter subscription process.
VII. Registration
1 Description and scope of data processing
On our website, we offer users the opportunity to register with their personal data. When you register, your data is entered in the appropriate form, transmitted to us and stored there. No data is passed on to third parties. The following data is collected during the registration process (login to the online document shredding shop):
User name, password, first name, surname, company, address, place of residence, country, postal code, telephone, e-mail address
At the time of registration, the following data is also saved:
User’s IP address, date and time of registration, queries made
During the registration process, the user gives his consent to the processing of his data.
2 Legal basis for data processing
The legal basis for data processing after the user has given the relevant consent is Article 6(1)(a) of the RODO Regulation.
If the registration serves to perform a contract to which the user is a party or to take pre-contractual action, then Article 6(1)(b) of the RODO Regulation provides an additional legal basis for the processing.
3 Purpose of data processing
The registration of the user is necessary in order to perform the contract concluded with the user or to take pre-contractual measures.
Without registration, the online shop cannot be used.
4 Duration of data storage
In the case of registration for the execution of a contract or pre-contractual measures, the data is deleted as soon as it is no longer required for the execution of the contract. Even after the conclusion of the contract, there may be a requirement to save the personal data of a contractual party in order to fulfil contractual or legal obligations.
5. possibility to object and delete data
The user may unsubscribe from the registration at any time. Furthermore, you can have your data changed at any time.
Changes and deletion of saved data can be made on the user settings page (menu item: Edit user account).
If the data is necessary for the performance of a contract or pre-contractual action, premature deletion is only possible if this is not prevented by contractual or legal obligations.
VIII. Contact form and e-mail contact
1 Description and scope of data processing
On one of the pages of our website, there is a contact form that can be used to make contact by e-mail. If the user uses this option, then the data provided in the form is transmitted to us and stored here. This data is as follows:
Company name
First and last name
Position (optional)
Address (optional)
Postal code / city (optional)
Telephone
E-mail
Comments
When sending the contact form, your consent to the processing of your data is obtained and reference is made to this data protection declaration.
Alternatively, it is also possible to contact us via the email address provided. In this case, the personal data of the user sent by e-mail is stored.
However, the data will not be passed on to third parties. The data is used exclusively to process the conversation.
2 Legal basis for data processing
The legal basis for the processing of data after the user has given the relevant consent is Article 6(1)(a) of the RODO Regulation.
The legal basis for the processing of data transmitted by e-mail is Article 6(1)(f) of the RODO Regulation. If the e-mail contact serves to conclude a contract, then Article 6(1)(b) of the RODO Regulation provides an additional legal basis for the processing.
3 Purpose of data processing
The processing of personal data from the contact form serves us exclusively to prepare and send a response to the established contact. When contact is made by email, we are dealing with the required legitimate interest of processing the data.
Other personal data processed during the process of sending the contact form is used to avoid abuse of the contact form and to ensure the security of our IT systems.
4 Data retention period
Data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected (recorded). In the case of personal data from the contact form and those sent by e-mail, this happens when the conversation with the user is ended. The conversation with the user is terminated when the circumstances indicate that the matter is finally resolved.
Personal data collected additionally during the process of sending the contact form are deleted at the latest after seven days.
5. possibility to object and delete data
The user has the opportunity to revoke his consent to the processing of personal data at any time. If you contact us by e-mail, you may object to the storage of your personal data at any time. In this case, the conversation cannot be continued.
Any personal data which has been saved in the context of making contact is deleted in this case.
IX. Google Analytics
This website uses the functions of the web analytics service Google Analytics. Its provider is Google Inc.,1600 Amphitheatre Parkway Mountain View, CA 94043, USA. Google Analytics uses so-called cookies. These are text files that are stored on your computer and enable analysis of your use of our website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there.
a.) Pseudonymisation of IP addresses
We have enabled the pseudonymisation of IP addresses on this website. Google will therefore truncate your IP address within Member States of the European Union or in countries that are signatories to the Agreement on the European Economic Area before transferring it to a server in the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted from your browser within the scope of Google Analytics is not combined with other data held by Google.
b.) Browser plug-in
You can prevent the storage of cookies on your computer by configuring your browser accordingly. However, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent. Furthermore, you may prevent the transmission of the data generated by the cookie and related to your use of this website (including your IP address) to Google as well as the processing of these data by Google by downloading and installing the plug-in available at the following address in your browser:
c.) Objection to data collection
The user can prevent the collection of his data by Google Analytics by clicking on the following link. A special “opt-out” cookie is then created, preventing the collection of user data on future visits to this website:
For more information on the processing of user data by Google Analytics, please see the Google data protection declaration:
(d.) Processing of order data
We have concluded a separate agreement with Google on the processing of order data and fully comply with the strict guidelines of the German data protection authorities when using Google Analytics.
(e.) Demographic characteristics in Google Analytics
This website uses the “Demographic Features” function of Google Analytics. This allows us to create reports containing data on the age, gender and interests of visitors to our pages. This data is derived from Google’s interest-based advertising and from visitor databases provided by third party providers. This data cannot be attributed to any specific person. You can deactivate this function in your Google account settings at any time or generally prohibit the collection of your data by Google Analytics by following the steps described under “Objection to data collection”.
X. Facebook plugins
Our website contains plugins of the social network Facebook, whose provider is Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can recognise Facebook plug-ins by their logo or by the “Like button” on our website. An overview of Facebook plug-ins can be found here:
When you visit our website, the plugin establishes a direct connection between your browser and the Facebook server. This tells Facebook that you (your IP address) have visited our site. If the user clicks the “Like” button while logged into his facebook account, he can insert links to content from our sites in his facebook profile. This allows Facebook to associate your visit to our sites with your account. We hereby point out that we, as provider of this website, have no knowledge whatsoever of the content of the data transmitted or how Facebook uses it. For further information, please see Facebook’s data protection declaration, which is available at
If you do not wish Facebook to associate your visit to our website with your Facebook user account, please log out of your Facebook user account.
XI. LinkedIn
Our website uses the functions of the social network LinkedIn. Its provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Each time you view one of our pages containing LinkedIn functions on your computer, a connection is established with the LinkedIn servers. LinkedIn is then informed that you (your IP address) have visited our websites. If the user clicks the “Recommend” button from LinkedIn while logged into his or her LinkedIn account, then LinkedIn can attribute the visit to our website to the user’s person and his or her LinkedIn account. We hereby inform you that, as the provider of these pages, we do not obtain any knowledge of the content of the data transmitted or how LinkedIn uses it.
For further information, please refer to LinkedIn’s data protection declaration, available at:
XII. YouTube
Our website uses plugins of the YouTube video service managed by Google. This service is provided by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit one of our websites with a YouTube plug-in, a connection is established with the YouTube server. In doing so, the YouTube server receives information about which of our pages you have visited.
If you are logged into your YouTube account, you allow YouTube to associate your online behaviour directly with your personal profile. You can prevent this by logging out of your YouTube account beforehand.
For more information on the processing of your data, please see the YouTube data protection declaration, available at
XIII. Users’ rights
Right to information
You may request from the responsible entity an answer to the question whether your personal data are processed by this entity (i.e. us).
If such processing takes place, you may request the following information from the responsible entity:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data that are processed;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be made available;
(4) the intended period of storage of the personal data concerning you or, if it is not possible to provide specific information, the criteria for determining the period of storage of the personal data;
(5) whether you have a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the responsible entity and a right to object to the processing of such data
(6) the fact that you have the right to lodge a complaint with a supervisory authority;
(7) any available information on the origin of the data, where the personal data have not been collected from the person concerned;
(8) the existence of automated decision-making, including profiling in accordance with Article 22(1) and (4) of the ROD Regulation and, at least in these cases, the extraction of useful information through an embedded logic system, as well as the meaning and expected results of such processing for the person concerned.
You have the right to request information on whether personal data concerning you are transferred to some other country or to some international organisation. In this context, you may request to be informed about appropriate safeguards in accordance with Article 46 of the RODO Regulation in connection with the transfer of data.
Right of rectification
You have the right to rectify and/or complete your data stored by the responsible entity if the personal data processed is incorrect or incomplete. The responsible entity is obliged to correct the data immediately.
2. right to restrict the scope of processing
You may request the restriction of the processing of your personal data under the following conditions:
(1) if you contest the accuracy of your personal data for a period that allows the responsible entity to verify the accuracy of the personal data;
(2) if the processing is unlawful and you do not agree with the erasure of your personal data but request the restriction of the use of these data;
(3) if the responsible entity no longer needs the personal data for the purposes of the processing but you need them for the assertion, exercise or defence of legal claims; or
(4) if you have objected to the processing in accordance with Article 21(1) of the RODO Regulation and it has not yet been established whether the legitimate grounds of the responsible entity outweigh your grounds.
If the processing of your personal data has been restricted, then the data – with the exception of storage – may only be processed with your consent or for the purpose of asserting, exercising or defending legal claims, or for the purpose of protecting the rights of another natural or legal person, or for reasons of important public interest of the European Union or any of its Member States.
If the processing of your personal data has been restricted according to the above conditions, you will be notified by the responsible entity before the restriction is removed.
3. right to erasure
a) Obligation to erase data
You may request the responsible entity to erase your personal data without delay and the responsible entity is obliged to erase the data without delay if one of the following reasons applies:
(1) Your personal data are no longer required for the purposes for which they were collected or were otherwise processed.
(2) You revoke your consent, which is the basis for the processing of your personal data in accordance with Article 6(1)(a) or Article 9(2)(a) of the RODO Regulation, and there is no other legal basis for the processing.
(3) You object to the processing of your personal data pursuant to Article 21(1) of the RODO Regulation and there are no priority legitimate grounds for further processing of your personal data or you object to the processing of your personal data pursuant to Article 21(2) of the RODO Regulation.
(4) Your personal data has been unlawfully processed.
(5) The erasure of your personal data is necessary to comply with some legal obligation under EU or Member States law to which the responsible entity is subject.
(6) Your personal data were collected in connection with the services offered by the information company in accordance with Article 8(1) of the RODO Regulation.
(b) Information to third parties
If the responsible entity has made your personal data public and if it is obliged under Article 17(1) of the RODO Regulation to delete them, then, taking into account the technology available and the costs of its implementation, it should take appropriate steps, also of a technical nature, to inform the entities responsible for the processing of these data that you, as a data subject, have requested it to delete any links to these personal data, as well as any copies or replications of these data.
(c) Exceptions
The right to erasure shall not exist if the processing is necessary
(1) for exercising the right to freedom of expression and information;
(2) for compliance with a legal obligation which requires processing under Union or Member State law to which the responsible body is subject or for the performance of a task carried out in the public interest or in the exercise of official authority and attributed to the responsible body;
(3) for reasons of public interest relating to public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the RODO Regulation;
(4) for public interest purposes of archiving, scientific or historical research or for statistical purposes in accordance with Article 89(1) of the RODO Regulation, insofar as the right mentioned in paragraph (a) is likely to prevent or seriously restrict the purposes of that processing; or
(5) to assert, exercise or defend legal claims.
4 Right to notification
If you have successfully exercised your right to rectification, erasure or restriction of the processing of your personal data, then the responsible party is obliged to inform all recipients to whom your data have been disclosed of the rectification, erasure or restriction of the processing, unless this proves impossible or involves a disproportionate effort.
You have the right to receive notification from the responsible entity to inform such recipients.
5. right to data portability
You have the right to receive your personal data that you have provided to the responsible entity in a structured, common and machine-readable format. In addition, you have the right to transfer this data to another responsible body without hindrance from the responsible body to which the personal data was provided, as long as
(1) the processing is carried out on the basis of expressed consent pursuant to Article 6(1)(a) of the RODO Regulation or Article 9(2)(a) of the RODO Regulation, or on the basis of a contract pursuant to Article 6(1)(b) of the RODO Regulation and
(2) the processing is carried out using automated processes.
When exercising this right, you furthermore have the right to cause your personal data to be transferred directly from one responsible party to another, insofar as this is technically feasible. The aforementioned measures must not infringe on the freedom or rights of others.
The right to data portability does not apply to the processing of personal data which is necessary for the performance of a task which is in the public interest or which is carried out in the exercise of public authority and which has been entrusted to the responsible entity.
6 Right to object
For reasons arising from your particular situation, you have the right to object to the processing of your personal data that takes place on the basis of Article 6(1)(e) or (f) of the RODO Regulation; this also applies to data profiling based on these provisions.
The Responsible Entity shall then cease processing your personal data unless there are compelling legitimate grounds for further processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
If your personal data are processed for direct advertising purposes, you have the right to object at any time to the processing of such data for the purpose of such advertising; this also applies to data profiling insofar as it is related to direct advertising.
If you object to the processing of your personal data for direct advertising purposes, your personal data will no longer be processed for these purposes.
In connection with the use of the services of the information company, you have the opportunity – without prejudice to Directive 2002/58/EC – to exercise your right to object by means of automated processes that use technical specifications.
7. Right to revoke granted consent to the processing of personal data
You have the right to revoke your consent given to the responsible entity for the processing of personal data at any time. The revocation of your consent shall not affect the lawfulness of the data processing carried out on the basis of the consent granted until it is revoked.
8. automated decision-making in individual cases, including data profiling
You have the right to refuse to be subject to a decision-making process based solely on automated data processing (including profiling), which produces any legal consequences for you or similarly places you in an aggrieved position. This does not apply if the decision
(1) is necessary for the conclusion or performance of some contract between you and the responsible party,
(2) is authorised under the provisions of Union law or the law of the Member States to which the responsible body is subject and those provisions include appropriate measures to safeguard your rights and freedoms and legitimate interests; or
(3) with your explicit consent.
However, these decision-making processes may not be based on special categories of personal data pursuant to Article 9(1) of the RODO Regulation unless Article 9(2)(a) or (g) of the RODO Regulation applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.
In relation to the cases set out in subsections (1) and (3), the responsible entity shall take appropriate measures to protect your rights, freedoms and legitimate interests, which include at least the right to have a person from the responsible entity intervene, to present his or her own position (point of view) and to contest the decision.
9. right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, especially in the Member State where your residence, place of work or the place of the alleged offence is located, if you consider that the processing of your personal data violates the provisions of the RODO Regulation.
The supervisory authority with which the complaint is lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the RODO Regulation.