Privacy Policy

We are pleased to welcome you to our website and delighted that you are interested in Deventer Profile GmbH and our services. To ensure that you feel safe and comfortable visiting our website, we take the protection of your personal data and the confidential handling of this data extremely seriously.

In this Privacy Policy, we therefore provide you with information on when we store which data, and the purpose for which we use this data – naturally, in accordance with the applicable data protection regulations.

It may be necessary to make changes to our Privacy Policy on account of technical developments, changes to our services, the legal situation or for other reasons. We therefore reserve the right to amend this Privacy Policy at any time and ask that you regularly check it for the latest information.

Dated: 27<superscript>th</superscript> May 2024

Processing of personal data

This Privacy Policy provides you with information about the processing of personal data. Personal data as defined in Article 4 GDPR means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Contact details of the controller

The entity responsible for data processing in accordance with Article 4(7) GDPR is

Deventer Profile GmbH
Rauchstraße 42 B
13587 Berlin

Germany

+49 30 35 59 07 0
info(at)deventer-seals.com

Contact details of the data protection officer

Please direct any enquiries to the above address, addressed to the “Data protection officer” and marked “Personal/confidential”.

Data recipient

Your personal data will only be shared with third parties for the purposes listed here. Furthermore, it will only be shared if there is a legal basis for doing so.

We only share your personal data with third parties if, for example:

• You have given your express consent for this data to be passed on in accordance with Article 6(1a) GDPR; or
• this is necessary for the performance of a contract to which you are party in accordance with Article 6(1b) GDPR, e.g. to credit institutes or external service providers for the processing of contractually agreed payments, to shipping and transport companies for the purpose of transporting goods including shipment tracking; or
• if there is a legal obligation to pass on this data in accordance with Article 6(1c) GDPR; or
• if passing on this data is necessary for the purposes of the legitimate interest pursued by us in accordance with Article 6(1f) GDPR, for instance to establish, exercise or defend legal claims, unless you have an overriding interest in the non-disclosure of your data which requires protection.

On this legal basis and for the aforementioned purposes, we can share your data with third parties who provide services on our behalf in order to assist us with our business activities. These companies are entitled to use your personal data only in the scope required for them to provide these services on behalf of us.

Deventer and these companies have negotiated agreements to ensure that your data is adequately protected by our service providers too.

Storage period

The personal data of data subjects is erased or blocked as soon as the purpose of storage no longer applies. Once this purpose no longer applies, the data will be erased unless it must be stored in order to fulfil a legal obligation or to establish, exert and defend legal claims.

For us, legal obligations arise in particular from tax and trade law, but also from other legislation. For instance, we are obligated to retain accounting data such as order and payment details or business letters for 10 or 6 years, respectively, in line with the applicable requirements stipulated by tax and trade law. You can find further information about any applicable retention periods in the relevant sections about the individual processing procedures.

Data transmission to third countries

We always choose the services we use in order to ensure the best possible protection for your personal data. With some services, we do not have any influence over whether the data processed by these services is transmitted to the parent companies in the USA or other third countries. If the European Union has not determined that these countries have a data protection level comparable to that of the European Union (referred to as EU adequacy decision), we or our contractual partner have negotiated a separate agreement or binding company regulations which ensure this level of protection through additional measures and guarantees. By doing so, the provider ensures that your personal data is protected as per the contract, even if it is transmitted to the third country.

Your rights

If personal data concerning you is processed, you are a data subject as defined in the GDPR and you shall have the following rights with respect to the controller:

• Right of access by the data subject in accordance with Article 15 GDPR

You can request information from us on whether we are processing personal data that concerns you. If we are, you can request details of the personal data relating to you that we are processing.

• Right to rectification in accordance with Article 16 GDPR

If the data that we have collected relating to you is incorrect or incomplete, you can request that we promptly rectify it in accordance with Article 16 GDPR.

• Right to erasure in accordance with Article 17 GDPR

You have the right to ask us to erase the personal data concerning you without undue delay where one of the grounds defined in Article 17(1) GDPR applies, unless there is an exemption to the erasure obligation in accordance with Article 17(3) GDPR.

• Right to restriction of processing in accordance with Article 18 GDPR

In accordance with the requirements of Article 18 GDPR, you can, under certain circumstances, also request that the processing of your personal data be restricted.

• Right to data portability in accordance with Article 20 GDPR

You have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format or to request that this be transmitted to another controller.

• Right to object in accordance with Article 21 GDPR

Under certain circumstances, you can lodge an objection against the processing of your personal data on the basis of Article 6(1e) GDPR (in the public interest) or object to the processing of your personal data in accordance with Article 6(1f) GDPR (for the purposes of legitimate interests), or against processing for the purposes of direct marketing;

• Right of withdrawal in accordance with Article 7(3) GDPR

Under data protection legislation, you are entitled to withdraw your consent at any time by notifying Deventer Profile GmbH accordingly. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

• Right to lodge a complaint with a supervisory authority in accordance with Article 77 GDPR

You have the right to lodge a complaint with a supervisory authority at any time, without prejudice to any other administrative or judicial legal remedy.

To enforce your legal rights as a data subject and for any other questions about data processing, please write to the address given above for Deventer Profile GmbH or send an e-mail to info@deventer-profile.com. Exercising the aforementioned rights is always free of charge for you.

Provision of our website

If you only use our website for information purposes, we will only collect the personal data that is transmitted by your browser to our server and that is technically required to display our website and to ensure stability and security.

In order to access the website, the IP number must be registered temporarily. The IP address is the globally applicable, unique identifier of a computer and is made up of four blocks of numbers separated by decimal points. Private users are not usually assigned a fixed IP address by the provider, but only a temporary IP address which changes on a regular basis. In principle, clear assignment of user data is still possible using this feature, as for static IP addresses. The external web servers save IP address for a maximum of 14 days. After this time, the access data will be anonymised.

The data that we collect for the aforementioned purposes is:

• The type of web browser,
• the operating system used,
• the domain name of the Internet service provider,
• the IP address of the computer used,
• the website from which you accessed our website,
• the pages that you visit on our website
• , and the date and duration of the visit.

The legal basis for the storage of the data / log files is our legitimate interest in accordance with Article 6(1f) GDPR. The collection of the data is essential for technical reasons in order to provide the website and the storage of the data in log files is essential for technical reasons in order to operate the website and to prevent misuse, meaning that we have a legitimate interest in data processing in this instance.

Cookies and other technologies

The website uses cookies and other technologies for the various purposes listed below.

Cookies are small text files which make it possible for a website to identify a browser. Cookies are saved in a text file on the computer and are called up and read the next time the computer contacts the web server.

There are different types of cookies. Session cookies are temporary cookies which are saved in the user’s web browser until the browser window is closed and the session cookies are erased. Permanent cookies are used for repeated visits and are saved in the user’s browser for a predefined period. First-party cookies are created by the website that the user visits. With these cookies, the user can only be recognised by the website where the cookie originates. Only this website is permitted to read the information from the cookies.

In contrast, third-party cookies originate from a third party, in other words not the website that the visitor is currently using. Third-party cookies are often stored by marketing companies who advertise on the website being visited.

If not specified otherwise, cookies can be retained for max. 14 months.

You have the option to contact us via our e-mail addresses on the contact page or by phone. We will, of course, use the personal data transmitted to us in this way solely for the purpose for which you provided the data to us.

The details we asked for when you contacted us help us to find out more about your enquiry and improve how it is processed. These details are solely provided on a voluntary basis and with your consent. If the information relates to communication options (for example, e-mail address, telephone number), you also consent to us contacting you via this means of communication to respond to your enquiry.

You may, of course, withdraw this consent with effect for the future at any time.

You can submit an electronic application to work at our company, either by sending a speculative application by e-mail or by applying for a vacancy via the Roto Job Portal.

Your details will only be used to process your application and make a decision on establishing an employment relationship. The legal basis is Article 6(1b) GDPR. Furthermore, your personal data can be processed if this is necessary to defend against legal claims made against us as a result of the application process. The legal basis for this is Article 6(1f) GDPR. The specified purposes also include the legitimate interest in processing.

If an employment relationship is established between you and us, in accordance with Article 6(1b) GDPR we can process the personal data we already received from you for the purposes of the employment relationship if this is required for maintaining or terminating the employment relationship or for fulfilling rights and obligations of the employee representation resulting from a law or a collective bargaining agreement, a works agreement or service agreement (collective agreement). Your application details will not be processed in any way which goes beyond the described use.

Your personal data will be erased no later than six months following the completion of the application process, unless this erasure is barred by any other legitimate interest on our part or unless you have given your consent for us to store your data for longer.

However, you can withdraw your consent for the processing of your personal data at any time. To do so, you can contact the controller via the means of contact available on the website.

We reserve the right to amend / update this Privacy Policy at any time in compliance with applicable data protection legislation. It was last updated on 27<superscript>th</superscript> May 2024.