The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union, and other provisions with a data protection character is:

CARBOCON GMBH | Mohorner Str. 13 | 01159 Dresden | Germany | Phone: +49 351 48205500 | E-mail: info@carbocon-gmbh.de | Website: www.carbocon.de

Our website uses cookies to provide you with the best possible user experience and to optimally deliver our content and functions. Cookies are small text files stored on your device via your internet browser.

Use of the Real Cookie Banner tool

For the management and collection of your consents to cookies and other tracking technologies, we use the Real Cookie Banner tool provided by devowl.io GmbH, Tannet 12, 94539 Grafling, Germany. This tool helps us document and manage your consents in a manner compliant with Article 6(1)(c) GDPR.

Functionality and data processing

On your first visit to our website, a cookie banner informs you about the use of cookies and allows you to set your preferences. Your selection is stored in a cookie to ensure that you are not asked again on subsequent visits. The following data are processed in connection with the tool:

• Your consent to or rejection of cookies
• Date and time of your selection
• Browser- und Geräteeinstellungen
• Legal basis

The processing of your data within the framework of the cookie banner is carried out pursuant to Article 6(1)(c) GDPR to fulfil legal obligations and, where necessary, pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in ensuring transparent and lawful cookie use. Withdrawal and adjustment of your cookie settings You can adjust your cookie settings at any time via the corresponding button on our website. Alternatively, you can delete cookies in your browser settings and set them again.

Each time the CARBOrefit® website is accessed by a data subject or an automated system, a series of general data and information is collected and stored in the server log files. The data and information collected may include: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrer), (4) the sub-pages accessed on our website by an accessing system, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the internet service provider of the accessing system, and (8) other similar data and information used for security purposes in the event of attacks on our IT systems.

When using these general data and information, CARBOCON GMBH does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimise the content of our website and the advertising for it, (3) ensure the permanent functionality of our IT systems and website technology, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. These anonymously collected data and information are therefore evaluated statistically by CARBOCON GMBH and also with the aim of increasing data protection and data security in our company, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

We offer you the opportunity to subscribe to our newsletter in order to be regularly informed about news, offers, and relevant information regarding CARBOrefit®.

Registration and double opt-in procedure

Registration for our newsletter takes place via a double opt-in procedure. This means that after registering, you will receive a confirmation e-mail in which you are asked to confirm your subscription. Only after this confirmation will your e-mail address be added to our mailing list.

When registering we collect:

• Your e-mail address (mandatory)
• Optional: further details such as name, for the personalization of the newsletter.

In addition, for legal reasons we store:

• Your IP address
• Date and time of registration and confirmation
• Dispatch and service provider

The dispatch of our newsletter is carried out using the tool rapidmail (rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg). Your data are used exclusively for sending the newsletter and are processed on servers within the European Union. Data will not be passed on to third parties.

Content and performance measurement

Our newsletter may contain so-called tracking pixels. These allow us to evaluate, on an anonymised basis, whether and when a newsletter was opened and which links were clicked. We use this data to tailor content even better to your interests.

Withdrawal and cancellation

You can unsubscribe from the newsletter at any time via the unsubscribe link at the end of each newsletter or by contacting us directly. You can also withdraw your consent to the storage of data for newsletter dispatch. After unsubscribing, your data will be deleted unless statutory retention obligations prevent this.

We use the software Moco, a cloud-based solution from Hundertzehn GmbH, Starnberg, Germany, for managing and tracking sales leads. Using Moco, we record and organise contact and communication data of potential customers to make our sales processes more efficient.
 
Purpose and legal basis for data processing
Data processing is carried out on the basis of Article 6(1)(b) GDPR where necessary for pre-contractual measures or performance of a contract, or on the basis of Article 6(1)(f) GDPR where there is a legitimate interest in the efficient and structured management of sales contacts.
 
Data processed
The data collected in connection with the use of Moco include:
Contact details (e.g. name, e-mail address, telephone number)
Company details (e.g. company name, position of the contact)
Notes on conversations and enquiries
Communication history
Hosting and data security
 
Moco is hosted on servers within the European Union and complies with the requirements of the GDPR. Data is protected against loss, misuse, and unauthorised access by appropriate technical and organizational measures.
 
Erasure and storage periods
Lead data for which no contractual relationship is established will be erased as soon as they are no longer required for the processing purposes. Where statutory retention obligations exist (e.g. under tax law), erasure will take place after expiry of the corresponding periods.
 
Disclosure of data
Data processed using Moco are not disclosed to third parties unless necessary to fulfil legal obligations or perform a contract.
 
Rights of data subjects
Data subjects have the right to obtain information about the data stored about them, to have such data corrected or erased, and to object to processing. For further information, data subjects may contact the contact options provided in the legal notice (Impressum).

We use the Analytics WP plugin on our website to analyse and evaluate visitor flows. Analytics WP is a WordPress plugin that enables data-protection-compliant analytics directly on our web server. This means that your data are not passed on to third parties or processed externally.

Purpose of data processing

The analysis of visitor flows helps us improve the user-friendliness of our website and to tailor content optimally to the needs of our visitors. The following data are processed:

• Access times
• Pages visited
• Dwell time
• Referring pages (referrers)
• Anonymised IP addresses

No transfer to third parties

Analytics WP operates locally on our server. All data collected remain on our server and are not shared with third parties. No storage or processing takes place outside the European Union.

Anonymisation of IP addresses

Your IP address is anonymised before storage so that no conclusions can be drawn about your identity. This takes place immediately after collection and before the data are analysed.

No use of cookies

Analytics WP does not use cookies to collect user data. The analysis is based solely on the information transmitted directly by your browser.

Legal basis for data processing

Data processing is carried out pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in ensuring an optimised presentation and use of our website.

Objection to data processing

If you do not agree to the anonymised data collection by Analytics WP, you can restrict or block the transmission of certain data in your browser settings (e.g. by activating the “Do Not Track” function). Alternatively, you can contact us directly for more information.

The controller has integrated components of YouTube into this website. YouTube is an internet video portal that enables video publishers to upload video clips free of charge and other users to view, rate, and comment on them, also free of charge. YouTube allows the publication of all kinds of videos, so that complete films and TV programmes, as well as music videos, trailers or videos created by users themselves can be accessed via the internet portal.

The operator of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Each time one of the individual pages of this website operated by the controller and containing a YouTube component (YouTube video) is accessed, the internet browser on the data subject’s information technology system is automatically prompted by the respective YouTube component to download a display of that component from YouTube. Further information about YouTube can be found at https://www.youtube.com/yt/about/. As part of this technical process, YouTube and Google gain knowledge of which specific sub-page of our website is visited by the data subject.

If the data subject is logged into YouTube at the same time, YouTube recognises which specific sub-page of our website the data subject is visiting when a sub-page containing a YouTube video is accessed. This information is collected by YouTube and Google and assigned to the respective data subject’s YouTube account.

YouTube and Google always receive information via the YouTube component that the data subject has visited our website whenever the data subject is logged into YouTube at the time of accessing our website; this occurs regardless of whether the data subject clicks on a YouTube video or not. If such transmission of this information to YouTube and Google is not desired, the data subject can prevent this transmission by logging out of their YouTube account before accessing our website.

The privacy policy published by YouTube, available at https://www.google.com/intl/en/policies/privacy/, provides information about the collection, processing, and use of personal data by YouTube and Google.

The controller processes and stores personal data of the data subject only for the period necessary to achieve the purpose of storage, or where provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage no longer applies, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data will be routinely blocked or erased in accordance with the legal provisions.

a) Right to confirmation

Every data subject has the right granted by the European legislator to obtain from the controller confirmation as to whether personal data concerning them are being processed. If a data subject wishes to exercise this right to confirmation, they may contact an employee of the controller at any time.

b) Right of access

Every data subject affected by the processing of personal data has the right granted by the European legislator to obtain, at any time and free of charge, information from the controller about the personal data stored about them and to receive a copy of that information. Furthermore, the European legislator has granted the data subject access to the following information:

• the purposes of processing
• the categories of personal data being processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
• where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period
• the existence of the right to request rectification or erasure of personal data concerning them, or restriction of processing by the controller, or to object to such processing
• the existence of the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject: any available information as to their source
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR, and — at least in those cases — meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject

Furthermore, the data subject has the right to be informed whether personal data have been transferred to a third country or to an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to exercise this right of access, they may contact an employee of the controller at any time.

c) Right to rectification

Every data subject affected by the processing of personal data has the right granted by the European legislator to obtain the prompt rectification of inaccurate personal data concerning them. Furthermore, taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed — including by means of a supplementary statement.

If a data subject wishes to exercise this right to rectification, they may contact an employee of the controller at any time.

d) Right to erasure (Right to be forgotten)

Every data subject affected by the processing of personal data has the right granted by the European legislator to obtain from the controller the erasure of personal data concerning them without undue delay where one of the following grounds applies and insofar as processing is not necessary:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• The data subject withdraws consent on which the processing is based pursuant to Article 6(1)(a)GDPR or Article 9(2)(a) GDPR, and where there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
• The personal data have been unlawfully processed.
• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If one of the above reasons applies and a data subject wishes to request the erasure of personal data stored by CARBOCON GMBH, they may contact an employee of the controller at any time. The employee of CARBOCON GMBH will arrange for the request to be complied with promptly.

Where CARBOCON GMBH has made personal data public and is obliged as controller pursuant to Article 17(1) GDPR to erase the personal data, CARBOCON GMBH, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, those personal data, insofar as processing is not required. The employee of CARBOCON GMBH will take the necessary steps in each individual case.

e) Right to restriction of processing

Every data subject affected by the processing of personal data has the right granted by the European legislator to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification of whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by CARBOCON GMBH, they may contact an employee of the controller at any time. The employee of CARBOCON GMBH will arrange for processing to be restricted.

f) Right to data portability

Every data subject affected by the processing of personal data has the right granted by the European legislator to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR, and the processing is carried out by automated means; this shall not apply where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising their right to data portability pursuant to Article 20(1) GDPR, the data subject also has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To assert the right to data portability, the data subject may contact an employee of CARBOCON GMBH at any time.

g) Right to object

Every data subject affected by the processing of personal data has the right granted by the European legislator to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

CARBOCON GMBH shall no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

Where CARBOCON GMBH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing; this includes profiling to the extent that it is related to such direct marketing. If the data subject objects to CARBOCON GMBH to processing for direct marketing purposes, CARBOCON GMBH will no longer process the personal data for such purposes.

In addition, the data subject also has the right, on grounds relating to their particular situation, to object to processing of personal data concerning them by CARBOCON GMBH for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

To exercise the right to object, the data subject may contact any employee of CARBOCON GMBH directly or another employee. The data subject is also free, in the context of the use of information society services, notwithstanding Directive 2002/58/EC, to exercise their right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling

Every data subject affected by the processing of personal data has the right granted by the European legislator not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests, or (3) is based on the data subject’s explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) it is based on the data subject’s explicit consent, CARBOCON GMBH shall implement suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

If the data subject wishes to exercise rights concerning automated decisions, they may contact an employee of the controller at any time.

i) Right to withdraw consent under data protection law

Every data subject affected by the processing of personal data has the right granted by the European legislator to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise the right to withdraw consent, they may contact an employee of the controller at any time.

Article 6(1)(a) GDPR serves as the legal basis for our company for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party — as is the case, for example, with processing operations necessary for the delivery of goods or the provision of another service or consideration — the processing is based on Article 6(1)(b) GDPR. The same applies to such processing operations that are necessary for carrying out pre-contractual measures, for example in the case of enquiries about our products or services. Where our company is subject to a legal obligation which requires the processing of personal data — such as for the fulfilment of tax obligations — processing is based on Article 6(1)(c) GDPR. In rare cases, processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance details or other vital information would have to be passed on to a doctor, hospital, or other third party. Processing would then be based on Article 6(1)(d) GDPR. Ultimately, processing operations could be based on Article 6(1)(f) GDPR. This legal basis applies to processing operations that are not covered by any of the aforementioned legal grounds, where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, provided that the interests, fundamental rights and freedoms of the data subject do not override those interests. Such processing operations are particularly permitted because they have been specifically mentioned by the European legislator, who took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47, sentence 2 GDPR).

We hereby inform you that the provision of personal data may be partly required by law (e.g. tax regulations) or may also result from contractual provisions (e.g. details about the contracting party). Sometimes it may be necessary for the conclusion of a contract that a data subject provides us with personal data which must subsequently be processed by us. For example, the data subject is obliged to provide us with personal data when our company enters into a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Prior to providing personal data, the data subject must contact one of our employees. Our employee will inform the data subject, on a case-by-case basis, whether the provision of personal data is legally or contractually required or necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of failure to provide the personal data.

As a responsible company, we do not use automatic decision-making or profiling.