I. Name and address of the data controller
II. Name and address of the data protection officer
III.a) Fulfilment of information obligations for customers of Büttenpapierfabrik Gmund GmbH & Co. KG
III.b) Fulfilment of information obligations for users of our social media channels
III.c) Provision of information obligations for organizers of company visits to Büttenpapierfabrik Gmund GmbH & Co. KG
III.d) Provision of information requirements for applicants at Büttenpapierfabrik Gmund GmbH & Co. KG
IV. General information on data processing
V. Provision of the website and creation of log files
VI. Use of cookies
VII. Newsletter
VIII. Registration
IX. Contact forms and email contact
X. The integration of Vimeo
XI. Rights of the data subject

I. Name and address of the data controller

The responsible person within the meaning of the General Data Protection Regulation law and other national data protection laws within Germany's federal states, as well as any other provisions on data protection, is:

Büttenpapierfabrik Gmund GmbH & Co. KG
Mangfallstraße 5
83703 Gmund
Deutschland
Tel.: 08022 75000
E-Mail: [email protected]
Website: world-en.gmund.com

 

II. Name of the data protection officer

You can reach our data protection officer by phone at +49 89 904 204 975 and by e-mail at [email protected].

 

III.a) Fulfilment of information obligations for customers of Büttenpapierfabrik Gmund GmbH & Co. KG

Information on collecting your personal data in accordance with article 13 of the General Data Protection Regulation (GDPR):

The purpose of the processing of your personal data is to fulfill the contract / contractual measures. (Article 6 par. 1 lit. b) EUDataP). If necessary for fulfilling the contract, your data are handed off to printers for order fulfillment, and will not be disclosed to third countries.

We delete unneeded personal data (designs, layouts) three months after performance of the contract. If we are allowed to keep your data for reorders longer, so you have below the possibility to contact us for this. We save personal data of the contract 10 years (§ 257 HGB, § 147 AO, § 14 UStG).

If you, as a customer, have provided your email address as part of your order and have not objected to the sending of advertising, we will send advertising for other similar products of our own to this email address on the basis of Art. 6 (1) p. 1 lit. f DSGVO as part of our legitimate interest in selling our products and in accordance with Section 7 (3) UWG. If you no longer wish to receive advertising from us, you can object to the use of your email address at any time by clicking on the unsubscribe link contained in the emails or by sending an email to [email protected].

You have the following rights in the processing of personal data:

Information (Art. 15 EUDataP)
Correction (Art. 16 EUDataP)
Deletion (Art. 17 EUDataP)
Constraint processing (Art. 18 EUDataP)
Object to the processing (Article 21 EUDataP)
Data portability (Art. 20 EUDataP).

You have the right to lodge a complaint with a supervisory authority:

Bayerisches Landesamt für Datenschutzaufsicht
Promenade 27 (Schloss)
91522 Ansbach

The provision of personal data is necessary for the contract otherwise we cannot fulfill the contract. There is no automated decision making / profiling. If you want a longer storage of your personal data for a later order, please inform us by email to: [email protected] .

 

III.b) Fulfilment of information obligations for users of our social media channels

Logos of social media providers are displayed on our website. These logos or icons act as external links, so that no personal data is transmitted to any of these providers without clicking on one of the icons. If the user clicks on one of the logos, the user will be redirected to the website of the respective provider. Information about the processing of personal data by the respective providers can be found in their privacy statements:
a) Meta/Facebook: https://de-de.facebook.com/policy.php
b) Instagram: https://help.instagram.com/519522125107875

III b.1 Our use of the Meta/Facebook platform

The following Facebook fan pages are covered by this privacy information:
https://www.facebook.com/gmundpaper

The company responsible for processing the personal data provided by the visitor when visiting the Facebook company fan page (hereinafter referred to as “fan page”) is Meta Platforms Inc. with its registered office at 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are a resident of the EU, Meta Platforms Ireland Ltd. with its registered office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as “Facebook”). A contract required by data protection law has been concluded with Facebook.

1. General information about data processing
Facebook collects personal data in order to evaluate user behavior. Facebook provides the operators of Facebook profiles, such as us, with the following data in anonymized and aggregated form. These are demographic data such as age, gender, place of residence, country or native language, without any reference to identifiable persons. Thus, we cannot identify any visitor to the Facebook profile.

In addition, we are provided with statistics about the source of access to the Facebook profile, the type of terminal device used for access, and the number of page views. As the operator of this Facebook profile, we also receive anonymized statistical data (so-called “Insights”) from Facebook. These data do not allow any conclusions to be drawn about the respective visitor, subscriber or registered user (hereinafter collectively referred to as “visitor”; in individual instances, only the group of persons to whom the respective facts relate will be named below). These received statistical data can also not be linked to the profile data of our subscribers. 

We can only define the data and visitor categories according to which Facebook evaluates its data collection and makes it available as anonymized statistics. We use this data exclusively to analyze user behavior, so that we can better tailor our Facebook profile and our offers to satisfy the needs and interests of our visitors. We use the data provided on Facebook under “Insight” to select relevant information for our posts on Facebook or to publish targeted posts for corresponding groups on the platform.

We only use the data provided by Facebook that are necessary for the purposes stated here. If further data are provided, they are not retrieved and thus not processed by us. We only receive anonymized information and statistics if the visitor to our Facebook profile is registered with Facebook. However, we would like to point out that by directly accessing our Facebook profile, e.g., by reading log files (e.g., IP address) or setting cookies, Facebook itself can collect these data.

The uses of the data provided to us by Facebook are based on Art. 6 para. 1 lit. f DSGVO:
- to carry out data analyses,
- to statistically record the use of our Facebook page and evaluate it for the purpose of optimizing our offers for you, and
- to continuously improve and modify our offers and our marketing activities.

Our legitimate interest according to Art. 6 para. 1 lit. f DSGVO results from the aforementioned points.

We have neither influence on data collection by Facebook nor on data processing operations at Facebook. We also have no knowledge of the scope of data collection, the purposes of processing and the storage periods. A transfer of data to anonymized statistics can therefore not be excluded.

2. Information for registered users
If you follow our Facebook profile as a registered user (Facebook also calls this “subscribing”), Facebook adds your profile to the list of all followers/subscribers of our fan page. Facebook then makes our posts available to you in your newsfeed. Facebook provides us with the list of our subscribers. However, this list only contains data that are public, i.e., information that the visitor voluntarily provides via their Facebook settings. The user themself decides which data they want to make public in their Facebook settings. In addition, each visitor has the option to individually set their privacy in their Facebook settings (https://www.facebook.com/settings?tab=privacy).
Furthermore, every visitor has the option in their Facebook settings to actively hide their Likes or to no longer follow the fan page. In this case, their profile will no longer appear in the list of fans of our pages. In addition, we can also assign comments and likes to our Facebook posts, as well as activities on our profile pages, to individual users.
The processing of this data serves the aforementioned purpose and is based on Art. 6 para. 1 lit. a DSGVO on the basis of your voluntarily given consent by registering and logging in to Facebook.
The complete data collection, i.e., which data of a visitor Facebook collects in total and for which purposes these data are processed by Facebook, is not known to us. The necessary information was not provided to us by Facebook. We ask for your understanding that we can only inform you to the extent of our knowledge of the data processing in our area of responsibility and our influence on the data processing.

You can reach Meta’s data protection officer at the following link: https://www.facebook.com/help/contact/540977946302970.

Further information on data processing by Facebook can be found at the following links:
- Privacy Policy: https://www.facebook.com/about/privacy/
- Opt-Out: https://www.facebook.com/settings?tab=ads
- For joint processing pursuant to Art. 26 DSGVO,

Facebook has provided corresponding regulations: https://www.facebook.com/legal/terms/page_controller_addendum.

III b.2 Our use of Instagram

The following Instagram page is covered by this privacy information:
https://www.instagram.com/gmundpaper/

Meta Platforms Inc. located at 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are a resident of the EU, Meta Platforms Ireland Ltd. located at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Facebook”) is responsible for processing the personal data that visitors provide when visiting the Instagram website.

1. General information about data processing
Instagram collects personal data in order to evaluate user behavior. Instagram provides the operators of Instagram profiles, such as us, with the following data in anonymized and aggregated form. These are demographic data such as age, gender, place of residence, country or native language, without any reference to identifiable individuals. Thus, we cannot identify any visitor to the Instagram profile.
In addition, we receive statistics about the source of access to the Instagram profile, the type of terminal used for access or the number of page views. As the operator of this Instagram profile, we also receive anonymized statistical data from Instagram (so-called “Insight”).
These data do not allow any conclusions to be drawn about the respective visitor, subscriber or registered user (hereinafter collectively referred to as “visitor”; in individual instances, only the group of persons to whom the respective facts relate is mentioned below). These statistical data obtained can also not be linked to the profile data of our subscribers. We can only specify the categories of data and visitors according to which Instagram evaluates its data collection and makes it available in the form of anonymized statistics. These data are used by us exclusively for the analysis of user behavior, so that we can better tailor our Instagram profile and our offers to satisfy the needs and interests of visitors.
We use the data provided on Instagram under “Insight” to select relevant information for our posts on Instagram or to publish targeted posts for relevant groups on the platform.
We only use the data provided by Instagram that are necessary for the purposes stated here. If further data are provided, these data are not retrieved and thus not processed by us.

We only receive anonymized information and statistics if the visitor to our Instagram profile is registered with Instagram. However, we point out that by directly accessing our Instagram profile, e.g., by reading log files (e.g., IP address) or setting cookies, Instagram itself can collect these data.
The uses of the data transmitted to us by Instagram are based on Art. 6 (1) lit. f DSGVO:
- to perform data analyses,
- to statistically record the use of our Instagram page and evaluate it for the purpose of optimizing our offers for you,
- to continuously improve and control our services and marketing activities, and
- to optimize the addressing of our target group.

Our legitimate interest pursuant to Art. 6 para. 1 lit. f DSGVO results from the aforementioned points.
We have neither influence on the data collection by Instagram nor on the data processing procedures existing at Instagram. We also have no knowledge of the scope of data collection, the purposes of processing and the storage periods. A transfer of data to anonymized statistics can therefore not be excluded.

2. Information for registered users
If you follow our Instagram profile as a registered user (Instagram also calls this “subscribing”), Instagram adds your profile to the list of all followers/subscribers of our profile. Instagram then makes our Stories and Posts available to you in your newsfeed. Instagram provides us with the list of our subscribers. However, this list only contains data that are public, i.e., information that the visitor voluntarily provides via their Instagram settings. The respective user decides for themself which specific data they want to provide in their Instagram settings. In addition, each visitor has the option to individually set their privacy in their Instagram settings (https://www.instagram.com/accounts/privacy_and_security/). In addition, we can also assign comments on our Instagram posts and activities on our Stories and profile pages to individual users.

The processing of these data serves the above purpose and is based on Art. 6 para. 1 lit. a DSGVO on the basis of your voluntarily given consent by registering and logging in to Instagram. We refer to the terms of use and the privacy policy of Instagram.
We have no knowledge of the complete data collection, i.e., which data of a visitor Instagram collects in total and for which purposes these data are processed by Instagram. The necessary information was not provided to us by Instagram. We ask for your understanding that we can only inform you to the extent of our knowledge of the data processing in our area of responsibility and our influence on the data processing.
In addition, we would like to point out that the operators of the platform that can be accessed via the various end devices are mostly U.S. companies and your data may therefore also be processed outside the European Union and the European Economic Area. This may result in risks, as, for example, it may be more difficult to enforce users’ rights. For further details, please refer to the data protection statements of the individual providers.

You can reach Meta’s data protection officer at the following link: https://www.facebook.com/help/contact/540977946302970.

Further information on data processing by Instagram can be found at the following links:
- Privacy Policy: https://help.instagram.com/519522125107875
- Opt-out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

You can reach our data protection officer via our contact information and at [email protected]

 

III.c) Provision of information obligations for organizers of company visits to Büttenpapierfabrik Gmund GmbH & Co. KG

Information on the collection of your personal data in accordance with Art.13 of the General Data Protection Regulation (DS-GVO):

We use your personal data for the purpose of contract performance or precontractual measures according to Art. 6 para. 1 lit. b) DS-GVO. If necessary, your data will be passed on internally to those employees who are responsible for the organization, implementation and billing of company visits, as well as to the restaurant’s operator when booking hospitality through the Mangfallblau factory restaurant, but not to external parties or to third countries. We delete personal data that are no longer required (data from the company tour registration form) twelve months after the contract has been fulfilled. For legal reasons, we retain personal data stored in the context of contract fulfillment for a storage period of up to ten years after the end of the fiscal year of the corresponding data processing (§ 257 HGB, § 147 AO, § 14 UStG). 

You have the following rights in the context of the processing of personal data: 
Information (Art. 15 DS-GVO)
Correction (Art. 16 DS-GVO)
Deletion (Art. 17 DS-GVO)
Restriction of processing (Art. 18 DS-GVO)
Objection to processing (Art. 21 DS-GVO) 

You can file a complaint under the DS-GVO with a supervisory authority. Responsible for us is the:
Bavarian State Office for Data Protection Supervision
Promenade 27 (Schloss)
91522 Ansbach 

The provision of your personal data is necessary for the conclusion of the contract, otherwise we cannot execute your order. There is no automated decision making / profiling.

III.d) Provision of information requirements for applicants at Büttenpapierfabrik Gmund GmbH & Co. KG

Information on the collection of your personal data in accordance with Art.13 of the General Data Protection Regulation (DS-GVO):
We use your personal data for the purpose of selecting suitable candidates to fill vacant positions in our company. The legal basis for this lies in Section 26 of the BDSG. Your data will be passed on internally to those employees who are required for personnel selection, but will not be transferred to external parties or to third countries. We delete personal data (applications) that are no longer required six months after the application process has been completed.
You have the following rights in the context of the processing of personal data:
Information (Art. 15 DS-GVO)
Correction (Art. 16 DS-GVO)
Deletion (Art. 17 DS-GVO)
Restriction of processing (Art. 18 DS-GVO)
Objection to processing (Art. 21 DS-GVO)
Data portability (Art. 20 DS-GVO).
Responsible for us is the:
Bavarian State Office for Data Protection Supervision
Promenade 27 (Schloss)
91522 Ansbach
You can file a complaint under the DS-GVO with a supervisory authority.
The provision of your personal data is necessary for the application process, otherwise we cannot process your application. There is no automated decision-making / profiling.

IV. General information on data processing

1. Scope of processing of personal data

We generally only process our users' personal data if we require this data to offer you the full functionality of our website, or if the information is required for access to our content and services. Users' personal data is usually only processed once the user provides their consent. The exception to this rule applies in cases in which it is not possible to obtain prior consent for practical reasons and the processing of this data without permission is permitted by law.

2. Legal basis for processing personal data

Article 6, section 1, item a) of the EU General Data Processing Regulation (GDPR) serves as the legal basis for processing personal data in cases where the user has provided permission for us to do so. In cases where processing personal data is necessary for the performance of a contract that the user in question has signed, article 6, section 1, item b) of the GDPR applies. This also applies for processing procedures that are required for the performance of pre-contractual measures. If the processing of personal data is required for the fulfilment of legal obligations that our company is subject to, article 6, section 1, item c) of the GDPR applies. For cases in which the vital interests of the person concerned, or those of another natural person, make it necessary to process personal data, article 6, section 1, item d) of the GDPR applies. If the processing of personal data is necessary to safeguard the interests of our company or a third party, and the interest, fundamental rights and freedoms of the data subject do not outweigh these interests, article 6, section 1, item f) of the GDPR applies as the legal basis for processing data.

3. Erasure of data and duration of data storage

The personal data of the person concerned is deleted or blocked as soon as the data has served its purpose. Data may be stored beyond this period if provisions are made to this effect by European and national legislators in regulations, laws or other legal texts in accordance with the union law that the data controller is subject to. The data will also be deleted or blocked if the storage period specified in these regulations expires, unless the storage of this data for a longer period is required for the conclusion of a contract or the fulfilment of contractual obligations.

 

V. Provision of the website and creation of log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the user accessing the site. The following data is collected as part of this process:

(1) Information on the browser type and version

(2) The user's operating system

(3) The user's internet service provider

(4) The user's IP address

(5) The date and time of website access

(6) Website from which the user's system directs the user to our website

(7) Any websites the user's system accesses via our website

Data is also stored in log files on our system. Neither this data nor any other personal data about the user is stored.

2. Legal basis for processing data

The legal basis for temporary storage of data and log files can be found in article 6, section 1, item f) of the GDPR.

3. Purpose of processing personal data

Temporary storage of IP addresses on the system is necessary in order to make the website available on the user's computer. The user's IP address must be stored for the duration of the session.
IP addresses are stored in log files to ensure the functionality of the website. This data also helps us to optimise our website and ensure the security of our IT systems. Data stored in this way is not evaluated for marketing purposes.
These purposes also constitute legitimate interest for processing data within the meaning of article 6, section 1, item f) of the GDPR.

4. Duration of storage
Data is deleted as soon as the purposes it has been collected for have been fulfilled. If the collection of data is necessary for the provision of the website, data is deleted as soon as the respective session is complete.
If data is stored in log files, data will be deleted no more than two months after the website is accessed. It is possible that data will be stored for a longer period. In this case, the user's IP address is deleted or distorted, to ensure that the customer accessing the site can no longer be identified.

5. Revocation and deletion
The collection of data for the provision of the website and the storage of data in log files is essential to the operation of the website. There is therefore no possibility for the user to opt out.

VI. Use of cookies

a) Description and scope of data processing

Our website uses cookies. Cookies are small text files stored in your website browser/in the website browser of the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a unique string of characters that make it possible to identify the browser if the user accesses the website again.

We use cookies to make our website more user-friendly. Certain elements on our website require us to be able to identify the browser of the user accessing the website even if the user comes back to the site after leaving.

The following data is therefore stored and transferred in our cookies:

 

Name des Cookies, Trackers, Social Media Plugins…	Typ	Kategorie	Funktion	Anbietername, Adresse, Land	Welche personenbezogenen Daten werden erhoben?	Speicherort der erhobenen Daten	Übertragungsart	Speicherdauer
GeoCountryId	Cookie	Erforderlich	Redirect zum korrekten StoreView je nach Land	Eigenes Cookie	personenbezogene Daten (Ländercode des Besuchers)	lokaler PC	verschlüsselt nach Stand der Technik	24 Stunden
GeoCountryIdOrig	Cookie	Erforderlich	Redirect zum korrekten StoreView je nach Land	Eigenes Cookie	personenbezogene Daten (Ländercode des Besuchers)	lokaler PC	verschlüsselt nach Stand der Technik	24 Stunden
GeoStoreViewId	Cookie	Erforderlich	Redirect zum korrekten StoreView je nach Land	Eigenes Cookie		lokaler PC	verschlüsselt nach Stand der Technik	24 Stunden
GeoStoreViewUrl	Cookie	Erforderlich	Redirect zum korrekten StoreView je nach Land	Eigenes Cookie		lokaler PC	verschlüsselt nach Stand der Technik	24 Stunden
frontend	Cookie	Erforderlich	Session-Cookie um z. B. den Warenkorb zu speichern oder den Kunden eingeloggt zu lassen	Eigenes Cookie		lokaler PC	verschlüsselt nach Stand der Technik	12 Stunden
external_no_cache	Cookie	Erforderlich	Gibt an, das manche Teile der Seite nicht aus dem Cache geladen werden sollen	Eigenes Cookie		lokaler PC	verschlüsselt nach Stand der Technik	1 Stunde

 

Our website also uses cookies that enable us to analyse the browsing behaviours of users.
As a result, the following data may be transmitted:

(1) Search terms entered
(2) Frequency of access
(3) Use of website functions

User data collected in this way is pseudonymised by means of technical procedures. This means it is no longer possible to attribute the data to the user accessing the website. The data is not stored together with the user's other personal data.

When our website is accessed, the user is informed of the use of cookies on the website for the purposes of analysis and a link to this data protection declaration is provided. Information is also provided on how the storage of cookies can be prevented in their browser settings.

Each time a user accesses our website, they are informed of the use of cookies for the purpose of analysis and are requested to provide permission for their personal data to be processed in this way. They are also provided with a link to this data protection declaration.

Name des Cookies, Trackers, Social Media Plugins…	Typ	Kategorie	Funktion	Anbietername, Adresse, Land	Welche personenbezogenen Daten werden erhoben?	Speicherort der erhobenen Daten	Übertragungsart	Speicherdauer
Google Analytics	Tracker	Statistik		Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States	anonymisierte Daten	Außerhalb EU (USA)	verschlüsselt nach Stand der Technik	2 Jahre
cookieNoticeClosed	Cookies	Komfort	Cookie-Notice wird nicht mehr angezeigt, wenn Besucher schließt	Eigenes Cookie		lokaler PC	verschlüsselt nach Stand der Technik	1 Jahr

 

b) Legal basis for processing data

The legal basis for processing personal data using cookies can be found in article 6, section 1, item f of the GDPR.

c) Purpose of processing personal data

The purpose of using technical cookies is to make the website easier for the user to navigate. Certain functions on our website cannot be provided without the use of cookies. For these functions, it is necessary for the website to be able to recognise the browser even after the user navigates away from the website.

The use of cookies is required for the following applications:

(1) Shopping basket
(2) Updating language preferences
(3) Remembering search terms

User data collected using technical cookies is not used to create user profiles.

The purpose of analytical cookies is to improve the quality and content of our website. Using analytical cookies, we can learn about how our website is used in order to continuously improve it.

These purposes also constitute legitimate interest for processing of personal data within the meaning of article 6, section 1, item f) of the GDPR.

d) Duration of storage/revocation and deletion options

Cookies are stored on the user's computer before being transferred to our website. Users therefore have full control over how cookies are used. By changing the settings in your internet browser, you can deactivate or limit the transmission of cookies. Stored cookies can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it is possible that certain functions will no longer be available.

 

VII. Newsletter

1. Description and scope of data processing

Our website provides users the option to sign up for our free newsletter. When users subscribe to our newsletter, the data they provide on the subscription form is sent to us.

This data is: Email address.

The following additional information is collected during the subscription process:

(1) IP address of the computer from which the website is accessed

(2) The date and time of subscription

During the subscription process, the user is asked to provide their consent for their data to be processed. A link to this data protection declaration is also provided.

None of the data processed as part of the subscription to our newsletter is shared with third parties. The data is used exclusively for the purpose of sending you our newsletter.

2. Legal basis for processing data

The legal basis for processing data as part of our newsletter subscription process can be found in article 6, section 1, item a) of the GDPR.

3. Purpose of processing personal data

We collect users' email addresses for the purposes of delivering our newsletter.

Any other personal data collected as part of the subscription process is used to prevent the misuse of services or the email address provided.

4. Duration of storage

Data is deleted as soon as the purposes it has been collected for have been fulfilled. Users' email addresses are stored for as long as they remain subscribed to our newsletter. Any personal data collected as part of the subscription process is generally deleted after 2 months.

5. Revocation and deletion options

Users can unsubscribe from our newsletter at any time. A link is provided in each newsletter that users can click on to unsubscribe.

The option is also provided to revoke permission for the storage of any personal data collected during the subscription process.

 

VIII. Registration

1. Description and scope of data processing

We provide users with the option to register on our website by entering their personal data. This data is entered into an online registration form before being transferred to us and stored on our system. This data is not shared with any third parties. The following data is collected as part of the registration process:

Business type (voluntary information)
Salutation
First name, last name
email address
Company name
Zip code
City
Telephone number
Country
VAT number (voluntary information)

At the time of registration, the following additional data is collected:

(1) The user's IP address
(2) The date and time of subscription

Users are asked to provide their consent for this data to be processed as part of the registration process.

2. Legal basis for processing data

The legal basis for processing data once consent has been provided can be found in article 6, section 1, item a) of the GDPR.

If registration is required for the fulfilment of a contract the user is party to, or for the implementation of pre-contractual measures, an additional legal basis for the processing of this data can be found in article 6, section 1, item b) of the GDPR.

3. Purpose of processing personal data

If registration is required in order to conclude a contract with the user:

Users are required to register on our website for the purposes of concluding contracts or for the implementation of pre-contractual measures.

The registration is necessary for processing an order in the webshop.

4. Duration of storage

Data is deleted as soon as the purposes it has been collected for have been fulfilled.

This applies to data collected during the registration process in order to conclude a contract or for the implementation of pre-contractual measures, if the data is no longer required for the fulfilment of the contract. Even once the contract has been concluded, it may be necessary to store the contractual partner's personal data in order to meet contractual or statutory obligations.

5. Revocation and deletion options

As a user, you have the option to cancel your registration at any time. You also have the option to modify the data you have provided at any time.

If you want to modify the data you provided, you can do this by yourself online in your account. Go to world-en.gmund.com and click on “Log In”. Enter your login data and klick on “My account”. Here you can modify the data you provided.

For deleting your account please contact:

Büttenpapierfabrik Gmund GmbH & Co. KG
Mangfallstraße 5
83703 Gmund am Tegernsee
Deutschland
E-Mail: [email protected]

If the data is required for the fulfilment of a contract or for the implementation of pre-contractual measures, data can only be deleted if there are no legal requirements preventing the deletion of this data. 

 

IX. Contact forms and email contact

1. Description and scope of data processing

A contact form is available on our website that can be used to get in touch with us online. If a user takes advantage of this service, the data entered into the contact form is transferred to us and stored on our system. This data includes:

First name, last name
Email address
Company name
Address
Telephone number
Country
Free text field

At the time at which the message is sent, the following additional data is collected:

(1) The user's IP address
(2) The date and time of subscription

During the subscription process, the user is asked to provide their consent for their data to be processed. A link to this data protection declaration is also provided.

Alternatively, it is possible to contact us using the email address provided. In this case, the personal data transferred when the email was sent is stored on our system.

None of the data collected for these purposes is shared with third parties. The data is used exclusively for the purpose of processing the conversation.

2. Legal basis for processing data

The legal basis for processing data once consent has been provided can be found in article 6, section 1, item a) of the GDPR.

The legal basis for processing data transferred when a user sends an email can be found in article 6, section 1, item a) of the GDPR. If the email is sent for the purposes of concluding a contract, the legal basis for processing this data can also be found in article 6, section 1, item b) of the GDPR.

3. Purpose of processing personal data

The sole purpose of processing personal data provided in our on-line form is to process any communication between our company and the respective user. If a user contacts us by email, this also constitutes a legitimate interest for processing data. Any other data processed when a user sends an email is used to prevent the misuse of our contact form and ensure the security of our IT systems.

4. Duration of storage

Data is deleted as soon as the purposes it has been collected for has been fulfilled. In the case of personal data entered into the contact form, as well as any data sent to us by email, data is deleted once the respective conversation with the user is terminated. The conversation is deemed as terminated once the respective situation is resolved. Any additional personal data collected when an email is sent is generally deleted no later than 2 months after being stored.

5. Revocation and deletion options

The user has the option to revoke their consent for their data to be processed at any time. If the user contacts us by email, they can revoke their consent for their data to be stored at any time. In this case, the conversation cannot be carried on any further.

To revoke your consent for processing and storing your data, please contact:

Büttenpapierfabrik Gmund GmbH & Co. KG
Mangfallstraße 583703 Gmund am Tegernsee
Deutschland
E-Mail: [email protected]

In this case, all personal data provided during the contact procedure is deleted.

 

X. The integration of Vimeo

1. Description and scope of data processing

Our website uses plug-ins from the provider Vimeo LLC, 555 West 18th Street, New York 10011, USA (hereinafter referred to as “Vimeo”) to integrate videos. The content of the plug-in is transmitted by Vimeo directly to your browser and integrated by Vimeo into the website.

If you are logged in to Vimeo with your user account, Vimeo can assign the information obtained through the use of the plug-in to your account. In this case, the information is transmitted to your personal user account with Vimeo and stored there. Since Vimeo collects data in particular via cookies, we also recommend that you delete all cookies via your browser’s security settings.

We have provided our videos with the “Do-Not-Track” setting by default. This prevents Vimeo from setting third-party cookies on your device via the plug-in. We have no control over the data and data processing operations collected by Vimeo, nor are we aware of the full extent of the data collection, the purposes of the processing, the storage periods and the storage location. There is also no information about the deletion of the collected data by the provider. For more information on the purpose and scope of data processing, as well as your rights in this regard and setting options for protecting your privacy, please refer to Vimeo’s terms of use and privacy policy at https://vimeo.com/privacy.

2. Purpose and legal basis for data processing

The legal basis for the processing of personal data is based on your consent, which you give when you voluntarily use or click on the content provided or when you give your consent via the cookie banner (Art. 6 para. 1 p. 1 lit. a DSGVO).

3. Possibility of objection and elimination

You can revoke your consent to data processing by Vimeo via the cookie banner provided by us at any time for the future. By changing the check mark at Vimeo under “Marketing” in the cookie banner, you prevent technical measures from being carried out. You can access the cookie settings at any time via the link described in the privacy policy under “Cookies” (“Change consent”).

 

XI. Rights of the data subject

If your personal data is processed, you are deemed a 'data subject' within the meaning of the GDPR and have the following rights.

1. Right to information

You may ask the data controller to confirm whether any personal data concerning you is processed by us.
If this is the case, you can request the following information from the data controller:

(1) the purposes for which the personal data is processed;
(2) the categories of personal data processed;
(3) the recipient or categories of recipients the respective personal data has been shared with or continues to be shared with;
(4) the planned storage duration of the respective personal data or, if no specific information is available, the criteria for determining storage duration;
(5) whether you have the right to rectification or erasure with regard to the respective personal data, the right to restriction of processing carried out by the data controller or the right to object to processing;
(6) whether you have the right to appeal to a supervisory authority;
(7) all available information regarding the origin of the data, if the personal data has not been collected from the data subject;
(8) whether an automated individual decision-making process including profiling exists in accordance with article 22, sections 1 and 4 of the GDPR and, in this case, what authoritative information is available on the logic involved, as well as the scope and intended effects of this type of processing on the data subject.

You have the right to request information regarding whether your personal data is shared with another country or state, or to an international organisation. In this regard, you may request information on the appropriate guarantees in accordance with article 46 of the GDPR in relation to transfer of data.

2. Right to rectification

You have the right to obtain from the data controller rectification and/or completion of your data if the processed data concerning you is inaccurate or incomplete. The data controller is required to make the correction without undue delay.

3. Right to restriction of processing

Under the following circumstances, you may request the restriction of processing of any of your personal data:

(1) if you contest the accuracy of your personal data for a period of time that enables the data controller to verify the accuracy of your personal information;
(2) if the processing is unlawful and you refuse the erasure of the personal data in favour of restricted use of the personal data;
(3) the data controller no longer requires the personal data for processing purposes, but you require it for the establishment, exercise, or defence of legal claims;
(4) You have objected to processing pursuant to article 21, section 1 of the GDPR pending verification of whether the legitimate grounds of the controller override your own.

If the processing of your data is restricted, this data will – with the exception of storage – only be processed with your consent or for the establishment, exercise of defence of legal claims or for the protection of the rights of another natural person or for reasons of important public interest of the Union or of a member state.

If you have obtained restriction of processing pursuant to the aforementioned provisions, you will be informed by the controller before the restriction of processing is lifted.

4. Right to erasure

a) Erasure obligation

You may request from the data controller that your personal data be deleted without undue delay. The data controller is under obligation to delete the data without undue delay if any of the following points apply:

(1) the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
(2) the data subject withdraws consent on which the processing is based according to article 6, section 1, item a), or article 9, section 2 GDPR, and where there is no other legal ground for the processing;
(3) the data subject objects to the processing pursuant to article 21, section 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to article 21, section 2 GDPR;
(4) the personal data has been unlawfully processed;
(5) the personal data has to be deleted for compliance with a legal obligation in the Union or Member State law to which the controller is subject;
(6) the personal data has been collected in relation to the offer of information society services referred to in article 8, section 1.

b) Information for third parties

Where the data controller has made the personal data public and is obliged pursuant to article 17, section 1 GDPR to delete the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers who are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

c) Exceptions

Right to erasure does not apply to the extent that processing is necessary

(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with article 9, section 2, items h), and i), and article 9, section 3 of the GDPR.
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89, section 1 of the GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
(5) for the establishment, exercise or defence of legal claims.

5. Right to notification

If you have the right to notification, erasure or restriction of processing, the data controller is required to communicate this rectification, erasure or restriction to all recipients to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the data controller about these recipients.

6. Right to data portability

You have the right to receive any personal data you have provided to the data controller in a structured, commonly used, machine-readable format. You also have the right to transmit this data to another data controller without hindrance from the controller to which you have provided your data, if

(1) the processing is based on consent pursuant to article 6, section 1, item a) of the GDPR or article 9, section 2, item a) of the GDPR or on a contract pursuant to article 6, section 1, item b) of the GDPR; and
(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data based on article 6 section 1 item e) or f) of the GDPR, including profiling based on those provisions.

The data controller will no longer process the personal data unless they demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

In the context of the use of information society services and notwithstanding Directive 2002/58/EC, you have the option to exercise your right to object by automated means using technical specifications.

8. Right to revoke the data protection consent declaration

You have the right to revoke your data protection consent declaration at any time. Revocation of consent does not affect the legality of any processing carried out on the basis of consent prior to revocation.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects that concern you or affects you in a similarly significant way. This does not apply if the decision

(1) is necessary for entering into, or performance of, a contract between you and the data controller;
(2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your own rights and freedoms and legitimate interests or
(3) is based on your explicit consent.

These decisions must be not be based on special categories of personal data referred to in Article 9, section 1 of the GDPR, unless article 9, section 2, item a) or g) of the GDPR apply and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in points (1) and (3), the data controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority, in particular in the member state you are a resident of, your place of work, or place of alleged infringement if you believe that the processing of your personal data violates the provisions of the GDPR.

The supervisory authority to which the complaint has been submitted must inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to article 78 of the GDPR. 

September 21st, 2018.