1 Scope

1.1 This information on the collection and further processing of personal data applies to the business activities of the controller (hereinafter also referred to as “we” / “us”):

p-square GmbH
- Data Protection -
Wittener Str. 106
44789 Bochum
info@p-square.de

1.2 This information serves to fulfill the requirements of Articles 13 and 14 of the GDPR (information obligations) for the business activities of the controller, including related transactions. This only concerns the data processing procedures associated with visiting the websites.

1.3 The data protection information provided on the websites of other providers to which links are provided on our company websites applies to the content of those websites. In particular, these providers are responsible for their own content and the data processing carried out there.

1.4 We will provide information outside of this policy at the appropriate time regarding the processing of personal data in connection with the establishment of a contractual or contractual relationship within the scope of our activities.

2 Contact details of the data protection officer

Frank Hillmer
External data protection officer
SIKKER GmbH
Kreuzstr. 10, 04103 Leipzig, Germany
info@sikker.de

3 Purposes for which the personal data is to be processed and legal basis for the processing

We use our company websites for informational purposes only and to make it easier for you to contact us.

3.1 Processing of personal data when contacting us

You can contact us via the telephone number, fax number, and email address provided on our company websites. We collect personal data when you actively contact us, i.e., if you provide your name, address, communication data, etc., this is done expressly and voluntarily by you as the user. No link is made to the access data mentioned below. If you contact us by telephone as described above, we may also collect personal data for other purposes that will only be communicated to us during the telephone call. If we collect personal data from you via these communication channels that you have not yet been informed about, we will inform you separately if necessary. Your data will be processed for the purpose of processing your request regarding the implementation of pre-contractual measures, the fulfillment of a contract, or to protect our legitimate interests or those of a third party. The legal basis for this processing is Art. 6 (1b) and Art. 6 (1f) GDPR. Our legitimate interest in data processing lies in processing your request, insofar as this is not based on the implementation of pre-contractual measures or the fulfillment of a contract. This processing does not conflict with your legitimate interests, fundamental rights, and freedoms, as the provision of data is based on your free decision and your rights as a data subject are guaranteed.

3.2 Processing of personal data for the fulfillment of legal obligations

In addition, we process your personal data to fulfill legal obligations, such as regulatory requirements and commercial and tax retention obligations. In this case, the respective legal provisions in conjunction with Art. 6 para. 1c) GDPR serve as the legal basis.

3.3 Processing of personal data for system security (log files)

No personal data is collected during normal operation when you access our company websites.

Only to resolve technical problems may it be temporarily necessary to process the following data: IP address of the host used, date and time of the request, the client software of the requesting computer, i.e. usually the browser type and the desired access method/function, the input values transmitted (e.g., the target file), the access status of the web server (e.g., file transferred, file not found, command not executed) and the name of the requested file.

In this case, the data is stored in a log file and deleted immediately after the technical problem has been resolved. Where necessary, we process your data to ensure IT security and IT operations. The legal basis for this processing is Art. 6 (1) f) GDPR. This processing does not conflict with your legitimate interests, fundamental rights, and freedoms, as the use of the company websites is based on your free decision and your rights as a data subject are guaranteed.

If we wish to process your personal data for a purpose not mentioned above, we will inform you of this in advance in accordance with the statutory provisions.

3.4 Processing of personal data during web analysis with Matomo

We use the open source software Matomo on our website for statistical analysis of visitor traffic. Matomo is operated on our own servers within the European Union. No data is transferred to third parties or to third countries.

The purpose of data processing is to analyze user behavior on our website in order to continuously improve our offering.

The IP address is anonymized before storage by removing the last two bytes. This means that it cannot be clearly assigned to a specific device or user.

The following data may be processed when using Matomo:

- The anonymized IP address of the requesting system

- Pages accessed and length of stay

- Referrer URL (the previously visited page if a link was followed)

- Information about the operating system, browser, and screen resolution

- Time of access

Matomo does not use cookies unless you expressly consent to this. If cookies are set, this is done exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.

3.5 Processing of personal data via LinkedIn Insight Tags

We use the LinkedIn Insight Tag on certain pages of our company websites. This is an analysis tool provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. The LinkedIn Insight Tag enables us to perform statistical analyses of the use of our websites by LinkedIn members and to measure the effectiveness of our LinkedIn advertisements.

When you visit a page where the LinkedIn Insight Tag is implemented, a cookie is set in your browser. This cookie collects information such as your IP address, device and browser characteristics, timestamps, and page activity and transmits it to LinkedIn. This data is pseudonymized by LinkedIn within seven days and deleted after 180 days at the latest.

Further information on data processing by LinkedIn can be found in LinkedIn's privacy policy: linkedin.com.

4 Recipients or categories of recipients of personal data

4.1 The personal data of the data subject will only be disclosed or transferred to third parties for purposes other than those described in this information if:

• the disclosure is permitted by law and necessary for the preparation or execution of contractual relationships in accordance with Art. 6 para. 1 sentence 1 letter b GDPR, or the data subject has given their express consent in accordance with Art. 6 para. 1 sentence 1 letter a GDPR,
• the disclosure is necessary in accordance with Art. 6 para. 1 sentence 1 letter f GDPR for the assertion, exercise or defense of legal claims and there is no reason to assume that the data subject has an overriding interest in the non-disclosure of their data or
• there is a legal obligation for disclosure in accordance with Art. 6 para. 1 sentence 1 letter c GDPR.

4.2 Within our company, access to the data of the data subject is granted to those persons who need it to fulfill our contractual and legal obligations. Processors and service providers (in particular for IT systems and document destruction) that we may use may also receive data for these purposes if they comply with our data protection instructions. We use processors in particular for our IT services and for document destruction.

4.3 Within the scope of web hosting for our company websites, we use our web host as a processor and have concluded a contract with them for order processing.

5 Intended transfer to third countries

5.1 The processing of personal data on or via our company websites takes place on servers located in Germany.

5.2 There is no intention to transfer personal data to a third country (a country outside the European Union or the European Economic Area).

6 Storage period

6.1 We store the personal data we collect for as long as it is necessary for our purposes or until you have consented to further storage in accordance with the provisions of the GDPR.

6.2 In the provisions of this privacy policy, we have already provided area-specific information on the storage period or the criteria for determining this period in various places.

6.3 Personal data collected for the purposes of a contract will also be stored until the expiry of the statutory retention periods applicable to our activities. After that, it will be deleted unless processing is still necessary to fulfill a legal obligation to which we are subject.

6.4 The personal data collected by us for the order/contract will be stored until the expiry of the statutory retention obligations (6 years after the end of the calendar year in which the contract was terminated) and then deleted, unless we are obliged to store it for a longer period in accordance with Article 6 (1) sentence 1 lit. c of the GDPR due to tax and commercial law retention and documentation obligations (from the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)) or you have consented to further storage in accordance with Art. 6 para. 1 sentence 1 lit. a of the GDPR.

6.5 The applicable tax and commercial law retention and documentation obligations provide for a retention period of six or ten years for the commercial documents specified in Sections 238 and 257 of the German Commercial Code (HGB). Section 147 of the German Fiscal Code (Abgabenordnung) contains corresponding provisions for the retention of the documents specified therein.

6.6 The expiry of the retention period does not automatically result in an obligation to delete the data, as there may still be a legitimate interest in archiving it, e.g. in order to be able to provide information in the event of legal disputes.

7 Rights of data subjects

As a data subject, you have the right:

• pursuant to Art. 15 GDPR, to request information about the processing of personal data with the information specified in Art. 15 (1) and (2) GDPR,
• pursuant to Art. 16 GDPR, to request the correction of inaccurate personal data concerning you,
• pursuant to Art. 17 GDPR, to request that personal data concerning you be deleted immediately, and we are obliged to delete personal data immediately if one of the reasons specified in the provision applies
• pursuant to Art. 18 GDPR, to request restricted processing if one of the reasons specified in the provision applies
• in accordance with Art. 21 GDPR, to object at any time to the processing of personal data concerning them on grounds relating to their particular situation, if the processing is based on our legitimate interests. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defense of legal claims,
• in accordance with Art. 20 GDPR, to receive the personal data concerning them, which they have provided to us, in a structured, commonly used and machine-readable format and to transmit this data to another controller without hindrance by us, provided that the processing is based on consent or on the basis of a contract and the processing is carried out by automated means.

8 Right to object in individual cases based on a balancing of interests

8.1 You have the right to object to the processing of your personal data for reasons arising from your particular situation.

The prerequisite for this is that the data processing is based on our balancing of interests in accordance with Art. 6 para. 1 letter f GDPR.

8.2 These cases have been described in this privacy policy.

In the event of an objection, we will no longer process the personal data. Unless we can demonstrate compelling legitimate grounds for the processing of such data that override the interests, rights, and freedoms of the data subject. This is also the case if the personal data serves to assert, exercise, or defend legal claims.

8.3 The objection can be made informally with the subject line “Objection” and stating the name, address, and date of birth of the person concerned and should be sent to:

p-square GmbH

- Data Protection -

Wittener Str. 106

44789 Bochum

info@p-square.de

9 Right to lodge a complaint

You have the right to complain to a supervisory authority about us with regard to our handling of your personal data.

10 Obligation to provide data

There is no obligation to provide us with data when using our company websites.

11 Data security

We use the widely used SSL (Secure Socket Layer) procedure to protect communication with us via our company websites.

12 Changes to this privacy policy

This general privacy policy does not require your consent and is subject to regular review for changes.

The previous version will be archived by us if it is replaced by a new version.

Version 11/23/2022