Privacy Policy | HERMA GmbH

As at June 2026

Who we are

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation is:

HERMA GmbH

Heinrich-Hermann-Straße 14

70794 Filderstadt

Germany 

Tel.: +49 711 7702 0 

Email address: mail(at)herma.de

Website: www.herma.de

Contacting the Data Protection Officer

The data protection officer of the data controller is:

DataCo GmbH

Sandstr. 33

80335 Munich

Germany

Tel.: +49 89 7400 45840 

Website: www.dataguard.de

On this page, we provide information about how we process your personal data on our website.

How we collect and use your personal data depends on how you interact with us or which services you use. We only collect, use or share your personal data if we have a legitimate purpose and a legal basis for doing so.

What do we mean by ‘legal basis’?

Consent (Article 6(1)(a) of the GDPR) – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. Further information on how to withdraw your consent can be found in the ‘Exercising your rights’ subsections in the following sections of this Privacy Policy.

Contract (Article 6(1), first sentence, point (b) of the GDPR) – We need to use your data to fulfil a contract you have with us. Alternatively, it is necessary to use your data because we have asked you to do so or because you yourself have taken certain steps prior to entering into this contract.

Legal obligation (Art. 6(1)(c) GDPR) – We need to use your data to comply with the law.

Vital interests (Article 6(1), first sentence, point (d) of the GDPR) – The processing of your data is necessary to protect your vital interests or those of another person. For example, to protect you from serious physical harm.

Public task (Article 6(1), first sentence, point (e) of the GDPR) – The processing of your data is necessary for the performance of a task carried out in the public interest or because it is covered by a statutory duty, e.g. for a statutory function. 

Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR) – The processing of your data is necessary to support a legitimate interest that we or another party have, provided that your own interests do not override those interests.

Please note that we may not be able to provide you with our website services if your data is processed to fulfil a contract or a legal obligation and you do not provide the requested data.

Data sharing and international transfers

As explained in this privacy policy, we use various service providers who help us to deliver our services and ensure the security of your data. When we use these service providers, it is necessary for us to share your personal data with them.

We have entered into agreements with all service providers to whom we disclose your data, obliging them to protect your data.

If your personal data is transferred outside the EU, we ensure that your personal data receives an equivalent level of protection, either because the country to which your data is transferred has an ‘adequate’ data protection standard as defined by the European Commission, or by applying another safeguard, such as an enhanced contractual arrangement, i.e. the Standard Contractual Clauses (SCCs) adopted by the European Commission.

For example, when we use US service providers, we rely either on the SCCs or the EU-US Data Privacy Framework, depending on the provider. You can request a copy of the SCCs we have entered into with our service providers by sending an email to the email address specified in this Privacy Policy.

Your rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. The right of access (Article 15 of the GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to access this data and to receive the following information:

• Purposes of processing
• Categories of personal data
• Recipients or categories of recipients
• The envisaged period for which the data will be stored, or the criteria used to determine that period The existence of the rights to rectification, erasure, restriction of processing or objection
• Right to lodge a complaint with the relevant supervisory authority
• Where applicable, the source of the data (if collected from a third party)
• Where applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope and the expected consequences
• Where applicable, transfer of personal data to a third country or an international organisation

2. Right to rectification (Article 16 of the GDPR)

If your personal data is inaccurate or incomplete, you have the right to request that it be rectified or supplemented without delay.

3. Right to restriction of processing (Art. 18 GDPR)

Provided that one of the following conditions is met, you have the right to request that the processing of your personal data be restricted:

• You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
• In the event of unlawful processing, you object to the erasure of the personal data and instead request that the use of the personal data be restricted.
• We no longer require your personal data for the purposes of processing, but you require your personal data to establish, exercise or defend your legal claims, or
• after you have objected to the processing, for the duration of the assessment as to whether our legitimate grounds override your interests.

4. Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)

If any of the following grounds apply, you have the right to request the immediate erasure of your personal data:

• Your data is no longer necessary for the purposes for which it was originally collected.
• You have withdrawn your consent and there is no other legal basis for the processing.
• You have objected to the processing and there are no overriding legitimate grounds for the processing, or you have objected in accordance with Article 21(2) of the GDPR.
• Your personal data is being processed unlawfully.
• Erasure is necessary to comply with a legal obligation under Union law or the law of the Member State to which we are subject.
• The personal data was collected in connection with information society services offered in accordance with Article 8(1) of the GDPR.

Please note that the above grounds do not apply where processing is necessary:

• To exercise the right to freedom of expression and information.
• To fulfil a legal obligation or to carry out a task carried out in the public interest to which we are subject.
• For reasons of public interest in the area of public health.
• For archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes.
• To establish, exercise or defend legal claims.

5. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format, or to request that it be transferred to another controller.

6. Right to object to certain processing (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1), first sentence, points (e) or (f) of the GDPR. This also applies to profiling based on these provisions.

Where personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing. 

7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

A list of the locally competent supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

Provision of the website and creation of log files

1. Description and scope of data processing

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data is collected in this process:

• Information about the browser type and version used
• The user’s operating system
• The user’s internet service provider
• Date and time of access
• Websites from which the user’s system accesses our website
• Web pages accessed by the user’s system via our website

This data is stored in our system’s log files.

This data is not stored together with any other personal data relating to the user.

2. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. To this end, the user’s IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the website functions properly. The data also helps us to optimise the website and ensure the security of our IT systems. The data is not analysed for marketing purposes in this context.

3. Legal basis for data processing

The legal basis for the temporary storage of the data and log files is Article 6(1)(f) of the GDPR.

4. Duration of storage

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this is the case once the relevant session has ended.

Where data is stored in log files, this occurs after seven days at the latest. Storage for a longer period is possible. In this case, users’ IP addresses are removed or anonymised so that it is no longer possible to identify the client making the request.

5. Right to object

The collection of data for the purpose of providing the website and the storage of data in log files is strictly necessary for the operation of the website. The user may object to this. Whether the objection is successful must be determined by weighing up the respective interests.

Use of technically necessary cookies

1. Description and scope of data processing

When you visit our website, we use technical tools for various functions, in particular cookies, which may be stored on your device. When you access our website, and at any time thereafter, you have the choice of whether to allow cookies in general or which specific additional functions you wish to select. You can make changes in your browser settings or via our Consent Manager. To do so, simply click on the fingerprint icon at the bottom left of the website. A pop-up will open where you can manage or withdraw your consents individually.

Cookies are text files that are stored on your hard drive and associated with the browser you are using, so that certain information can be sent to the party setting the cookie. Below, we describe the types of cookies we use:

We use technically necessary cookies, which are required for the technical structure of the website. Without these cookies, our website cannot be displayed (correctly in full) or the support functions will not work.

The following data is stored and transmitted by technically necessary cookies:

• Language settings
• Items in the shopping basket
• Log-in details
• Search terms entered
• Frequency of page views
• Use of website functions

We use cookies on our website that are not technically necessary. Text files that are not solely intended to ensure the functionality of the website, but also collect other data, are regarded as technically non-essential cookies.

The following data is processed when non-technically necessary cookies are set:

• IP address
• Location of internet users
• Date and time of the website visit
• Tracking of browsing behaviour
• Linking the website visit to other social media platforms

2. Purpose of data processing

The purpose of using technically necessary cookies is to ensure the functionality of our website. Some features of our website cannot be provided without the use of cookies. For these, it is necessary for the browser to be recognised even after a page has been changed.

We require technically necessary cookies for the following applications:

• Applying language settings
• Website functionality
• Shopping basket

Non-technically necessary cookies are used to improve the quality of our website, its content and, consequently, our reach and cost-effectiveness. By setting these cookies, we learn how the website is used and can thus continuously optimise our offering. In particular, these cookies serve the following purposes:

Analytics and tracking cookies enable us to collect and analyse statistics on the usage behaviour of visitors to our online services, i.e. to measure reach and analyse usage for the purpose of website optimisation (tracking). They are not strictly necessary for the website’s core functions, and the tracking data may be linked to or shared with other data and services where applicable. By incorporating cookies that are not technically necessary, our aim is to be able to present visitors with various features (videos, chat function, etc.) on our website.

3. Legal basis for data processing

The provisions of the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG) apply to the storage of information on the end user’s device and/or access to information already stored on the end user’s device. Where the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your terminal equipment is carried out on the basis of Section 25(2)(2) of the TDDDG. This storage and access to the information on your terminal equipment serve to facilitate your use of our website and to enable us to offer you our services as you have requested. Some features of our website also do not work without the use of these cookies and could therefore not be provided. Cookies are generally deleted at the end of the session (e.g. when you log out or close your browser) or after a specified period has elapsed. Information on different retention periods for cookies can be found in the following sections of this privacy policy. 

Where cookies are used that are not technically necessary, this is done on the basis of your explicit consent, which you can give via the cookie banner. In this case, the legal basis for the storage of and access to information is Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) and Article 7 of the GDPR. You may withdraw your consent at any time with future effect or

re-grant it retrospectively by configuring your cookie settings accordingly. Alternatively, you can prevent the storage of cookies by adjusting the settings in your web browser. Please note that the browser settings you make only apply to the browser you are currently using. If personal data is processed following the storage of and access to the information on your device, the provisions of the GDPR apply. You can find further information on this in the following sections of this privacy policy.

4. Exercising your rights

You may withdraw your consent to the use of cookies at any time and manage your consent preferences via the following link: https://www.herma.de/

To do this, simply click on the fingerprint icon at the bottom left of the website. A dialogue box will open where you can manage or withdraw your consents individually.

Email contact

1. Description and scope of data processing

It is possible to contact us via the email address provided on our website. In this case, the user’s personal data transmitted with the email will be stored.

The data is used exclusively for the purpose of handling the correspondence.

2. Purpose of data processing

Where contact is made via email, this also constitutes the necessary legitimate interest in processing the data.

3. Legal basis for data processing

The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing the best possible response to your enquiry sent by email.

If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data sent by email, this is the case once the relevant conversation with the user has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved.

5. Exercising your rights

If a user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

The objection must be made by email to the email address specified in this privacy policy.

In this case, all personal data stored in the course of the contact will be deleted.

Use of company profiles on professional networking sites

1. Scope of data processing

The company website is used for recruitment, employer branding, brand presence, visibility, communication and PR, as well as active sourcing. We do not have any information regarding the processing of your personal data by the companies jointly responsible for the company website. Further information on this can be found in the privacy policy of:

• LinkedIn
• XING

On our site, we provide information and offer users the opportunity to communicate.

LinkedIn: https://www.linkedin.com/legal/privacy-policy

XING: https://privacy.xing.com/de

Glassdoor

If you carry out an action on our company page (e.g. comments, posts, likes, etc.), you may thereby make personal data (e.g. your real name or profile photo) publicly available.

2. Legal basis for data processing

The legal basis for the processing of personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is to respond to your enquiry in the best possible way and to be able to provide the requested information.

If the purpose of making contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

3. Purpose of data processing

Our website serves to inform users about our company and products. In doing so, every user is free to disclose personal data through their activities. 

4. Duration of storage

The data generated by the company website is not stored in our own systems.

5. Exercising your rights

You may object at any time to the processing of your personal data that we collect in connection with your use of our corporate website and exercise your rights as a data subject, as set out in the ‘Your Rights’ section of this privacy policy. To do so, please send us an informal email to the email address specified in this privacy policy.

Further information on exercising your rights can be found here:

LinkedIn:

https://www.linkedin.com/legal/privacy-policy

XING:

https://privacy.xing.com/en

Hosting

The website is hosted on servers by a service provider commissioned by us.

Our service provider is:

• plusserver GmbH, Welserstraße 14, 51149 Cologne

Further information can be found in the provider’s privacy policy: www.plusserver.com/datenschutzerklaerung/

The servers automatically collect and store information in so-called server log files, which your browser transmits automatically when you visit the website. The information stored is:

• Information about the browser type and version used
• The user’s operating system
• The user’s internet service provider
• Date and time of access
• Web pages accessed by the user’s system via our website

This data is not combined with other data sources. The collection of this data is based on Article 6(1)(f) of the GDPR. Our legitimate interest in processing this data is to ensure our website is displayed correctly and to optimise its functions.

The website’s server is physically located in Germany.

Registration and application for access

1. Description and scope of data processing

On our website, we offer users the option to register by providing personal data. The data is entered into a form, transmitted to us and stored. The following data is collected as part of the registration process:

• Email address
• Surname
• First name
• Address
• Telephone/mobile number
• VAT number 
• IP address of the accessing computer
• Date and time of registration

As part of the registration process, the user’s consent to the processing of this data is obtained.

2. Purpose of data processing

User registration is required in order to provide certain content and services on our website. In particular, user registration is required for the following purpose:

• Provision and use of certain digital services, such as the label design software (HERMA Label Assistant Online), including advanced features for registered users (e.g. saving and managing your own templates).
• Setting up and managing a user account.
• Applying for access to shop functions, in particular to place orders via our online shops.

3. Legal basis for data processing

The legal basis for the processing of data is Article 6(1), first sentence, point (f) of the GDPR. We have a legitimate interest in processing your registration data in order to provide you with the content and services you have requested.

4. Duration of storage

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected, or as required by law, e.g. for tax and accounting purposes.

5. Exercising your rights

As a user, you may cancel your registration at any time. You may have the data stored about you amended at any time.

Specifically, you can request deletion in the following ways:

HERMA processes and stores your personal data only for the period necessary to fulfil the purpose of storage or insofar as this is required by a law or regulation to which the relevant HERMA data controller is subject – e.g. statutory retention periods. If the purpose of storage no longer applies or a statutory retention period expires, the personal data will be routinely blocked or deleted in accordance with legal requirements. Specific details regarding the individual deletion periods can be found in the relevant sections of this privacy policy (e.g. log files) and in the Consent Manager tool regarding the retention period for cookies. You may request the erasure of your personal data in accordance with the provisions of Article 17 of the GDPR. Your right to erasure depends, amongst other things, on whether the data concerning you is still required by us to fulfil our legal obligations.

If the data is required to fulfil a contract or to carry out pre-contractual measures, early erasure of the data is only possible insofar as no contractual or statutory obligations preclude such erasure.

Online shop

We operate an online shop on our website.

For this purpose, we use the following online shop software: OXID eShop from the provider OXID eSales AG, Bertoldstraße 48, 79098 Freiburg, Germany (hereinafter referred to as OXID eShop).

Further information can be found in the provider’s privacy policy: https://www.oxid-esales.com/datenschutz/

Payment options in the online shop

1. Description and scope of data processing

We offer our customers various payment options for processing their orders.

Depending on the payment method chosen, we redirect customers to the platform of the relevant

payment service provider. Once the payment process is complete, we receive the customers’ payment details from the payment service providers or our bank and process them in our systems for invoicing and accounting purposes.

Payment by credit card

It is possible to complete the payment process by credit card.

If you have chosen to pay by credit card, payment details are collected by the payment provider in a separate window. The data is not stored on HERMA’s servers. All payment service providers comply with the requirements of the ‘Payment Card Industry (PCI) Data Security Standards’ and have been certified by an independent PCI Qualified Security Assessor.

The following details are routinely collected when paying by credit card:

• Purchase amount Date and time of purchase
• First name and surname
• Address
• Email address
• Credit card number
• Credit card expiry date
• Security code (CVC)
• IP address
• Telephone number / mobile number
• Payment data is passed on to the following payment service providers:

PAYONE, operated by PAYONE GmbH, Lyoner Straße 15, 60528 Frankfurt am Main. Further information on the processing of your data by PAYONE can be found in PAYONE’s privacy policy at: www.payone.com/DE-de/datenschutz.

Payment in advance

If you have chosen to pay in advance, we do not process any data other than that transmitted by your bank. This data is used solely to verify receipt of payment.

Other payment options 

We also offer the following payment options: Invoice

2. Purpose of data processing

The transfer of payment data to payment service providers serves to process the payment, e.g. when you purchase a product and/or use a service.

3. Legal basis for data processing

The legal basis for data processing is Article 6(1)(b) of the GDPR, as the processing of the data is necessary for the performance of the concluded sales contract.

4. Duration of storage

All payment data, as well as data relating to any chargebacks that may occur, will only be stored for as long as is necessary for payment processing, the handling of any chargebacks and debt collection, and to combat misuse.

Furthermore, payment data may be stored for a longer period where and for as long as this is necessary to comply with statutory retention periods or to investigate a specific case of misuse.

Your personal data will be deleted upon expiry of the statutory retention obligations, i.e. after 10 years at the latest.

5. Exercising your rights

If the data is required to fulfil a contract or to carry out pre-contractual measures, early deletion of the data is only possible insofar as no contractual or statutory obligations preclude such deletion.

Credit checks in the online shop

1. Description and scope of data processing

To assess our customers’ creditworthiness, including an analysis of payment behaviour and credit default risk, we may use the services of rating agencies and credit reference agencies.

We use the services of the following credit reference providers:

• Creditreform Stuttgart Strahler KG, Theodor-Heuss-Str. 2, 70174 Stuttgart

The data provided consists of:

• Company details 

2. Purpose of data processing

We transfer the data for the purpose of carrying out credit checks on our customers. This serves to reduce the default rate and protect against credit risks.

3. Legal basis for data processing

The legal basis for the processing of data for the purpose of assessing the customer’s creditworthiness by the data controller is Article 6(1), first sentence, point (a) of the GDPR, provided the user has given their consent.

The legal basis for processing data for the purpose of assessing a customer’s creditworthiness in the case of high-risk payment methods is Article 6(1), first sentence, point (f) of the GDPR, based on our legitimate interest in safeguarding our advance payments.

4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes. 

Delivery service providers in the online shop

1. Description and scope of data processing

If you order products or services on our website for which a delivery service provider is used, you will receive your order and dispatch confirmation via your email address and, depending on the relevant delivery service provider, notification that your parcel has arrived and/or a parcel notification along with possible delivery options. The data is transferred to the following service providers:

• DHL Paket GmbH, Robert-Bosch-Straße 200, 73257 Köngen
   
• FedEx Express Deutschland GmbH, Ferdinand-Porsche-Str. 10, 71154 Nufringen
   
• DHL Freight GmbH, Industriestraße 28, 71272 Renningen
   
• ERKA Internationale Spedition GmbH, Motorstraße 8, 70499 Stuttgart
   
• Gebrüder Weiss GmbH, Zeppelinstraße 90, 73730 Esslingen
   
• Raben Trans European Germany GmbH, Dieselstraße 20, 70736 Fellbach

The data transmitted usually consists of:

• Name
• Address
• Email address

2. Purpose of data processing

The purpose of processing personal data is to enable delivery service providers to inform recipients of the status of their parcels by email, thereby increasing the likelihood of successful delivery.

3. Legal basis for data processing

The legal basis for the transfer of your email address to the relevant delivery service provider and its

use is your consent in accordance with Article 6(1)(a) of the GDPR. The legal basis for the transfer of your address details (first name, surname, address) to the relevant delivery service provider is Article 6(1), first sentence, (b) of the GDPR, as the processing of the data is necessary for the performance of the concluded sales contract.

4. Duration of storage

The data transmitted will be deleted by the relevant delivery service provider once the parcel has been delivered.

5. Right to object

The notification service provided by the delivery service provider may be cancelled by the data subject at any time. For this purpose, a corresponding opt-out link is included in every email.

Integrated third-party services

We use various service providers to deliver the services we offer on the website.

In general, we have a legitimate interest in sharing your data with the relevant service providers if these services are essential for the provision of the core service offered on the website, in order to provide the relevant website service.

If such services are required for additional services, extended functions or other purposes, your personal data will only be passed on to service providers if you give your consent.

You can withdraw your consent to the use of integrated third-party services and manage your consent settings at any time here: www.herma.de

Use of FACT-Finder

1. Scope of personal data processing

We use the FACT-Finder plug-in from Omikron Data Quality GmbH, Habermehlstr. 17, 75172 Pforzheim, Germany (hereinafter: FACT-Finder). If you have JavaScript enabled in your browser and have not installed a JavaScript blocker, your browser may transmit personal data to FACT-Finder. This involves your shopping history, in particular items and product categories that you have viewed, searched for or purchased. This may result in personal data being stored and analysed, primarily relating to the user’s activity (in particular, which pages have been visited and which elements have been clicked on) as well as device and browser information (in particular, the IP address and the operating system). All information collected for this purpose is stored in anonymised form, and it is not possible to identify you personally.

Further information on the processing of data by FACT-Finder is available here:

https://www.fact-finder.de/datenschutz.html

2. Purpose of data processing

The FACT-Finder plug-in is used to provide personalised product recommendations, to ensure the website functions correctly, and to analyse user behaviour.

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

4. Duration of storage

Your personal information will be retained for as long as is necessary to fulfil the purposes set out in this privacy policy or as required by law. 

5. Exercising your rights

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. You can prevent FACT-Finder from collecting and processing your personal data by blocking third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

Further information on your rights to object to and remove data processed by FACT-Finder can be found at: 
https://www.fact-finder.de/datenschutz.html

Use of Google Ads

1. Scope of the processing of personal data

We use Google AdWords, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its representative in the European Union, Google Ireland Ltd., Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland (hereinafter referred to as ‘Google’). We use this service to display advertisements. In doing so, Google places a cookie on your computer. This may result in the storage and analysis of personal data, in particular the user’s activity (specifically, which pages have been visited and which elements have been clicked on), device and browser information (in particular the IP address and the operating system), data relating to the advertisements displayed (in particular which advertisements were shown and whether the user clicked on them) and, , data from advertising partners (in particular pseudonymised user IDs). 

Further information on Google’s processing of data is available here:

https://policies.google.com/privacy?gl=DE&hl=de

2. Purpose of data processing

We are only informed of the total number of users who have responded to our advert. No information is passed on that would enable us to identify you. The data is not used for tracking purposes.

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.

5. Exercising your rights

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. You can prevent the collection and processing of your personal data by Google by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

You can disable Google’s use of your personal data via the following link:

https://adssettings.google.de

Further information on options for objecting to and removing data held by Google can be found at: https://policies.google.com/privacy?gl=DE&hl=de

Use of Google Analytics 4 (GA 4)

1.  Scope of the processing of personal data

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as ‘Google’).

Google Analytics analyses, amongst other things, how website visitors use our site. In doing so, Google places cookies on your device. During your visit, user behaviour is recorded in the form of ‘events’. This may result in the storage and analysis of personal data, including:

• First visit to the website
• Interaction with the website, usage path
• Clicks on external and internal links
• Video usage
• File downloads
• Advertising impressions and clicks
• Scrolling behaviour 
• Searches on the website
• Language selection
• Page views
• Location (region)
• Your IP address (in truncated/anonymised form)
• Technical information about your browser and the devices you use (e.g. language settings, screen resolution)
• Your internet service provider
• Referrer URL

By default, IP address anonymisation is enabled in GA 4. This means that your IP address is truncated by Google within the Member States of the European Union or other signatory states to the Agreement on the European Economic Area. In exceptional cases only, the full IP address is transmitted to a Google server in the USA and truncated there . Google states that the IP address transmitted by your browser is not merged with other Google data within the context of Google Analytics.

Further information on the processing of data by Google can be found here:

https://policies.google.com/privacy

2. Purpose of data processing

We use GA 4 to analyse the use of our website and to generate reports on activity on our site. These reports are used to analyse our website’s performance and to display targeted advertising to people who have already shown an initial interest by visiting our site.

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1), first sentence, point (a) of the GDPR.

1. 4. Retention period

   Your personal data will be deleted after 14 months. 

2. 5. Exercising your rights

   You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. You can withdraw your consent via our Cookie Consent Tool.

   You can prevent the collection and processing of your personal data by Google by blocking the storage of third-party cookies on your computer, using the ““Do Not Track” function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net) or Ghostery (https://www.ghostery.com) in your browser.

   Further information on options for objecting to and removing data processed by Google can be found at: https://policies.google.com/technologies/partner-sites

   You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de

   You can disable the use of your personal data by Google via the following link: https://adssettings.google.de

Use of Google reCAPTCHA

1. Scope of the processing of personal data

We use Google reCAPTCHA provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its representative in the EU, Google Ireland Ltd., Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland. This tool is designed to verify that data entry is legitimate and has not been carried out by a bot.To this end, Google reCAPTCHA analyses and authenticates the behaviour of a visitor to our website with regard to a wide range of characteristics. This may result in the storage and analysis of personal data, primarily the user’s activity (in particular, mouse movements and which elements have been clicked) and device and browser information (in particular, the time, the IP address and the operating system).

The data is not linked to any data that may be collected or used in connection with the concurrent use of authenticated Google services such as Gmail.

Further information on the processing of data by Google is available here:

https://policies.google.com/privacy?gl=DE&hl=de

2. Purpose of data processing

The use of Google reCAPTCHA serves to protect our website from misuse.

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.

5. Exercising your rights

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal.

You can prevent the collection and processing of your personal data by Google by blocking the storage of third-party cookies on your computer, using the ““Do Not Track” function of a compatible browser , disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

You can use the link below to opt out of Google’s use of your personal data:

https://adssettings.google.de

Further information on your options to object to and have your data removed by Google can be found at:

https://policies.google.com/privacy?gl=DE&hl=de "

Use of Google Web Fonts 

1. Scope of the processing of personal data

We use Google Web Fonts provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its representative in the European Union, Google Ireland Ltd., Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland (hereinafter referred to as ‘Google’). When the page is accessed, the web fonts are transferred to the browser’s cache so that they can be used to improve the visual presentation of various pieces of information. If the browser does not support Google Web Fonts or blocks access to them, the text will be displayed in a standard font. No cookies are stored on the visitor’s device when the page is accessed. Data transmitted in connection with the page visit is sent to resource-specific domains such as https://fonts.googleapis.com or https://fonts.gstatic.com. This may result in personal data being stored and analysed, primarily relating to the user’s activity – in particular, which pages have been visited and which elements have been clicked on – as well as device and browser information, specifically the IP address and the operating system. The data is not linked to any data that may be collected or used in connection with the concurrent use of authenticated Google services such as Gmail.

Further information on the processing of data by Google is available here:

https://policies.google.com/privacy?gl=DE&hl=de

2. Purpose of data processing

The use of Google Web Fonts serves to present our text in an appealing manner. If your browser does not support this feature, a standard font from your computer will be used for display.

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.

5. Exercising your rights

You can prevent the collection and processing of your personal data by Google by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

You can disable Google’s use of your personal data via the following link:

https://adssettings.google.de

Further information on your rights to object to and have your data deleted by Google can be found at: https://policies.google.com/privacy?gl=DE&hl=de

Use of Google Tag Manager

1. Scope of the processing of personal data

We use Google Tag Manager (https://www.google.com/intl/de/tagmanager/) provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its representative in the European Union, Google Ireland Ltd., Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland (hereinafter referred to as ‘Google’). Google Tag Manager enables tags from Google and third-party services to be managed and embedded in a bundled form on a website. Tags are small pieces of code on a website which serve, amongst other things, to measure visitor numbers and behaviour, track the impact of online advertising and social media channels, implement remarketing and target specific audiences, and test and optimise websites. When a user visits the website, the current tag configuration is sent to the user’s browser. It contains instructions on which tags are to be triggered. Google Tag Manager ensures that other tags are triggered, which may in turn collect data. Further information on this can be found in the sections on the use of the relevant services in this privacy policy. Google Tag Manager does not access this data. 

Further information on Google Tag Manager can be found at https://www.google.com/intl/de/tagmanager/faq.html and in Google’s privacy policy: https://policies.google.com/privacy?hl=de

2. Purpose of data processing

The purpose of processing personal data is to ensure the centralised and clear management, as well as the efficient integration, of third-party services.

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy or as required by law.

Advertising data in server logs is anonymised by Google, which, according to its own statements, deletes parts of the IP address and cookie information after 9 or 18 months respectively.

5. Exercising your rights

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal.

You can prevent the collection and processing of your personal data by Google by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), and from processing this data, by downloading and installing the browser plug-in available via the following link:

https://tools.google.com/dlpage/gaoptout?hl=de

You can use the link below to opt out of Google’s use of your personal data:

https://adssettings.google.de
 

Further information on options for objecting to and deleting data held by Google can be found at: https://policies.google.com/privacy?gl=DE&hl=de

Use of lime:

1. Scope of personal data processing

We use features of the Userlike live chat platform provided by Lime Connect (Userlike) GmbH, Im Mediapark 8 50670 Köln, Deutschland (hereinafter referred to as: Lime). You can use the live chat in the same way as a contact form to chat with our staff in near real time. When you start a chat, the following personal data is collected:
 

• Date and time of the session
• Browser type/version
• IP address
• Operating system used
• URL of the previously visited website
• Amount of data transmitted
• First name
• Surname
• E-Mail address
   

Depending on the course of the conversation with our staff, further personal data may be collected during the chat, which you will enter yourself. The nature of this data depends largely on your enquiry or the issue you are describing to us. In addition, Lime stores the history of live chats.

The chat widget is loaded as a JavaScript file from AWS CloudFront, operated by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, United States (hereinafter referred to as ‘Amazon’). The chat widget essentially consists of the source code that runs on your computer and enables the chat. In the process, data may be transferred to AWS CloudFront servers in the USA

Further information on how Lime processes data can be found here:

https://connect.lime-technologies.com/de/legal/privacy-policy/
 

2. Purpose of data processing

We use Lime to facilitate efficient customer communication. The chat history is stored to save our customers from having to provide extensive details regarding the history of their enquiry, and to ensure consistent quality control of our live chat service. 

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy, until consent to storage has been withdrawn, or as required by law.

5. Exercising your rights

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal.

You can prevent Userlike from collecting and processing your personal data by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

You may withdraw your consent to the processing of your data at any time. You may exercise your right to withdraw consent at any time by emailing us or privacy(at)lime-connect.com

Further information on options for objecting to and removing data processed by Lime can be found here: https://connect.lime-technologies.com/de/legal/privacy-policy/

Use of ConsentManager

1. Scope of the processing of personal data

We use the consent management platform consentmanager, provided by consentmanager GmbH, Eppendorfer Weg 183, 20253 Hamburg, Germany. consentmanager enables us to obtain, manage and document, in accordance with the law, users’ consent to the processing of device information and personal data using cookies or other tracking technologies. To this end, consentmanager sets cookies on users’ devices. In particular, the following data is processed:

• Date and time of the visit
• Device information
• Browser information
• Anonymised IP address
• Opt-in and opt-out data

Data processing takes place within the European Union. 
Further information on the processing of personal data by consentmanager can be found at:
https://www.consentmanager.net/en/privacy/

2. Purpose of data processing

Personal data is processed to comply with the legal requirements of the GDPR and the BDSG regarding the collection and management of consent.

3. Legal basis for the processing of personal data

The legal basis for the processing of personal data by consentmanager is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the legally compliant collection, management and documentation of consent for the use of cookies and third-party services.

4. Duration of storage

The personal data collected by consentmanager is stored only for as long as is necessary to fulfil the stated purpose and for as long as there is a legitimate interest in retaining it. As soon as the purpose has been fulfilled or the legitimate interest no longer applies, the data will be deleted or anonymised, provided that no statutory retention obligations prevent this.

5. Exercising your rights

You can prevent the collection and processing of your personal data by consentmanager by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as, for example, NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com).

Further information on options for objecting to and removing consentmanager can be found at:
https://www.consentmanager.net/en/privacy/

10. Corporate Accounts

10.1 Instagram

Instagram, part of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

On our corporate and business unit profiles, we provide information and offer Instagram users the opportunity to communicate.

If you take an action on our Instagram corporate profile (e.g., comments, posts, likes, etc.), you may thereby make personal data (e.g., your real name or user profile photo) publicly available.

However, since we generally have little or no influence over Instagram’s processing of your personal data, we cannot make any binding statements regarding the purpose and scope of that processing.

We use our business profiles on social media to communicate and

exchange information with (potential) customers. In particular, we use our business profiles for:

• Brand presence and visibility
• Employer branding & recruiting
• Communication & PR
• Contests and surveys

Posts on the company’s website may include the following content:

• Information about the company
• Information about products and services
• Latest news, press releases, and industry articles
• Insights into the work environment and corporate culture
• Job openings and information about the application process
• Interaction with users (surveys, reactions, comments)
• Participation in trade shows or events
• Success stories
• Contests

Each user is free to disclose personal data through their activities.

The legal basis for processing personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is to respond to your inquiry in the best possible way and to provide the requested information.

If the purpose of contacting us is to enter into a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

The data generated through our company’s website is not stored in our own systems.

For the processing of your personal data in third countries, we have put in place appropriate safeguards in the form of standard data protection clauses pursuant to Article 46(2)(c) of the GDPR. A copy of the standard data protection clauses may be requested from us.

You may object at any time to the processing of your personal data that we collect in connection with your use of our corporate website and exercise your rights as a data subject, as set forth in the “Your Rights” section of this Privacy Policy. To do so, please send us an informal email to datenschutz(at)herma.de. For more information on the processing of your personal data by Instagram and the corresponding options for objecting, please see here:

Instagram: help.instagram.com/519522125107875

10.2 Pinterest

Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

On our company and business unit profiles, we provide information and offer Pinterest users the opportunity to communicate.

If you take an action on our Pinterest company page (e.g., comments, posts, likes, etc.), you may thereby make personal data (e.g., your real name or user profile photo) publicly available.

However, since we generally have little or no influence over the processing of your personal data by Pinterest, we cannot make any binding statements regarding the purpose and scope of the processing of your data.

We use our corporate presence on social media to communicate and exchange information with (potential) customers. In particular, we use our corporate presence for:

• Brand presence and visibility
• Employer branding & recruiting
• Communication & PR
• Contests and surveys
   

The content published on the company’s website may include the following:

• Information about the company
• Information about products and services
• Latest news, press releases, and industry articles
• Insights into the work environment and corporate culture
• Job openings and information about the application process
• Interaction with users (surveys, responses, comments)
• Participation in trade shows or events
• Success stories
• Contests

Each user is free to disclose personal data through their activities.

The legal basis for processing personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is to respond to your inquiry in the best possible way and to provide the requested information.

If the purpose of establishing contact is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

The data generated through our corporate website is not stored in our own systems.

For the processing of your personal data in third countries, we have put in place appropriate safeguards in the form

of standard data protection clauses pursuant to Article 46(2)(c) of the GDPR. A copy of the standard data protection clauses can be requested from us.

You may object at any time to the processing of your personal data that we collect in connection with your use of our corporate website and exercise your rights as a data subject, as set forth in the “Your Rights” section of this Privacy Policy. To do so, please send us an informal email to datenschutz(at)herma.de. For more information on the processing of your personal data by Pinterest and the corresponding options for objecting, please see here:

Pinterest: policy.pinterest.com/de/privacy-policy

10.3 YouTube

YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, United States

On our corporate and business unit profiles, we provide information and offer YouTube users the opportunity to communicate.

If you take any action on our YouTube corporate page (e.g., comments, posts, likes, etc.), you may thereby make personal data (e.g., your real name or user profile photo) publicly available.

However, since we generally have little or no influence over YouTube’s processing of your personal data, we cannot make any binding statements regarding the purpose and scope of that processing.

We use our corporate presence on social media to communicate and exchange information with (potential) customers. In particular, we use our corporate presence for:

• Brand presence and visibility
• Employer branding & recruiting
• Communication & PR
• Contests and surveys 

Posts on the company’s website may include the following content:

• Information about the company
• Information about products and services
• Latest news, press releases, and industry articles
• Insights into the work environment and corporate culture
• Job openings and information about the application process
• Interaction with users (surveys, reactions, comments)
• Participation in trade shows or events
• Success stories
• Contests

Each user is free to disclose personal data through their activities.

The legal basis for processing personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is to respond to your inquiry in the best possible way and to provide the requested information.

If the purpose of contacting you is to enter into a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

For the processing of your personal data in third countries, we have put in place appropriate safeguards in the form

of standard data protection clauses pursuant to Article 46(2)(c) of the GDPR. A copy of the standard data protection clauses can be requested from us.

You may object at any time to the processing of your personal data that we collect in connection with your use of our company website and exercise your rights as a data subject, as set forth in the “Your Rights” section of this Privacy Policy. To do so, please send us an informal email to datenschutz(at)herma.de. For more information on the processing of your personal data by YouTube and the corresponding options for objection, please see here:

YouTube: policies.google.com/privacy

10.4 Facebook

As of August 2021

10.4.1 Principles

10.4.1.1 Joint Controllers for the Processing of Personal Data

The purposes and means of processing personal data when visiting our Facebook page de-de.facebook.com/herma/ (“Facebook Page”) are determined jointly by HERMA GmbH, Heinrich-Hermann-Straße 14, 70794 Filderstadt, Germany (“HERMA GmbH”) and Facebook Ireland Ltd. (“Facebook”) within the meaning of Article 26 of the EU General Data Protection Regulation (GDPR). This results from the fact that HERMA GmbH, as the operator of the Facebook page, by creating such a page, enables Facebook to place cookies on the computer or any other device of the person visiting the Facebook page (“visitor”), regardless of whether the visitor has a Facebook account.

Under the joint controller arrangement, Facebook assumes primary responsibility under the GDPR for the processing of Insights data and fulfills all obligations under the GDPR with regard to the processing of Insights data (including Articles 12 and 13 of the GDPR, Articles 15 through 22 of the GDPR, and Articles 32 through 34 of the GDPR). In addition, Facebook makes the key provisions of this Page Insights Addendum available to data subjects (the corresponding “Page Insights Controller Addendum” can be found here: www.facebook.com/legal/terms/page_controller_addendum)..

Below you will find a description of how HERMA GmbH and Facebook handle personal data when you visit the Facebook page. However, since HERMA GmbH generally—or to a large extent—has no influence over the data collected by Facebook or its processing by Facebook, we are currently unable to provide definitive information regarding the purpose and scope of Facebook’s processing of your data. However, we will monitor further developments in this regard and update this privacy policy accordingly if necessary.

Please note that you use this Facebook page and its features at your own risk. This applies in particular to the use of interactive features (such as commenting, sharing, and rating).

10.4.1.2 Name and Address of the Joint Controllers

a) The primary controller is:
Facebook
Facebook Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2 Ireland

b) The additional data controller is:
HERMA GmbH
Heinrich-Hermann-Straße 14
70794 Filderstadt
Deutschland
Tel.: +49 711 7702-0
Email: mail@herma.de
Webseite: https://www.herma.de

10.4.1.3 Contact Information for the Data Protection Officer of the Primary Data Controller, Facebook

You can contact the Data Protection Officer of the primary data controller, Facebook, via the following link: www.facebook.com/help/contact/540977946302970

10.4.1.4 Name and Address of the Data Protection Officer of the Additional Data Controller

You can contact the Data Protection Officer of the additional controller, HERMA GmbH (as specified in 2.b), at:

DataCo GmbH

Dachauer Str. 65

80335 Munich

Germany

Phone: +49 89 7400 45840

Website: www.dataguard.de

10.4.1.5 Legal Basis for the Processing of Personal Data

To the extent that consent is obtained from the data subject for the processing of personal data, Article 6(1), sentence 1, subparagraph (a) of the GDPR serves as the legal basis for the processing of personal data.

When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1), first sentence, subparagraph (b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of precontractual measures.

To the extent that the processing of personal data is necessary to comply with a legal obligation to which HERMA GmbH or Facebook is subject, Article 6(1), sentence 1, subparagraph (c) of the GDPR serves as the legal basis.

In the event that the vital interests of the data subject or another natural person necessitate the processing of personal data, Article 6(1), first sentence, letter d of the GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of HERMA GmbH, Facebook, or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, Article 6(1), sentence 1, letter f of the GDPR serves as the legal basis for the processing.

10.4.1.6 Right to Object and Right to Erasure

Visitors may revoke their consent to the processing of their personal data at any time (see also Rights of Data Subjects). If a visitor contacts us via email, they may object to the storage of their personal data at any time.

The collection of data for the purpose of providing the Facebook page and the storage of data in log files is absolutely necessary for the operation of the Facebook page. Consequently, visitors have no right to object.

10.4.1.7 Rights of Data Subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the data controllers:

• The right to access the personal data stored about you by HERMA GmbH or Facebook;
• The right to have your personal data corrected, deleted, or to restrict its processing;
• Right to object to processing that serves the legitimate interests of HERMA GmbH or Facebook, a public interest, or profiling, unless HERMA GmbH or Facebook can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims;
• Right to data portability;
• Right to lodge a complaint with a supervisory authority;
• Right to withdraw your consent to the collection, processing, and use of your personal data at any time with future effect.

If you wish to exercise your rights, you may direct your request to either HERMA GmbH or Facebook. To do so, you may, for example, use the contact options listed above. If you contact us, we will forward your request to Facebook if it concerns the processing of Insights data. Facebook will respond to requests in accordance with the obligations imposed on us under the Page Insights Addendum.

10.4.2 Processing of Personal Data by HERMA GmbH

10.4.2.1 Purpose of Data Processing

HERMA GmbH maintains online presences on social networks to communicate with prospective customers and users active on those platforms and to inform them about our products, events, and news. When you visit our Facebook page (regardless of whether you are logged into your Facebook account or not), your browser automatically transmits certain data to the web server operated by Facebook. In addition, Facebook uses so-called “cookies.” Cookies are small text files that are stored on your device via your browser. Cookies set by Facebook are intended, among other things, to enable HERMA GmbH, as the operator of the Facebook page, to obtain statistics—generated by Facebook based on visits to this page—for the purpose of managing the marketing of our activities.

10.4.2.2 Description and Scope of Data Processing

As the operator of the Facebook page, HERMA GmbH can obtain anonymized statistical data regarding visitors to its Facebook page using the "Facebook Page Insights" function—provided by Facebook free of charge as an integral part of the terms of use. This data is collected via cookies placed by Facebook; each cookie contains a unique user code that Facebook stores on the visitor's device. This user code—which can be linked to the login details of users registered with Facebook—is collected and processed when the Facebook page is accessed.

In particular, the fan page operator can receive demographic data about its target audience provided by Facebook (and thus the processing of this data). This includes, among other things, trends regarding age, gender, relationship status, and professional situation; information on the lifestyle and interests of the target audience; and information on purchases and online purchasing behavior, the categories of goods or services of greatest interest to visitors, and geographic data indicating where to run specific promotions or organize events—thereby enabling the operator, in general, to tailor its information offerings as precisely as possible. Although the visitor statistics generated by Facebook are transmitted to HERMA GmbH (as the Facebook page operator) solely in anonymized form, the creation of these statistics relies on the prior collection—via cookies placed by Facebook on visitors' devices—and processing of those visitors' personal data for these statistical purposes. Further information on Facebook Page Insights can be found at:

de-de.facebook.com/legal/terms/information_about_page_insights_data

de-de.facebook.com/help/pages/insights

Data regarding the Facebook groups linked to our Facebook page is also provided in this manner. Due to the continuous development of Facebook, the availability and presentation of data change; for further details, we therefore refer to the Facebook privacy notices mentioned in the previous paragraph and below under the section "PROCESSING OF PERSONAL DATA BY FACEBOOK."

We use this data—available in aggregated form—to make our posts and activities on our Facebook page more appealing to users. For example, we use age and gender breakdowns to tailor our communication and analyze users' preferred visiting times to optimize the scheduling of our posts. Information regarding the types of devices used by visitors helps us adapt the visual design of our posts accordingly. In accordance with the Facebook Terms of Use—which every user agrees to when creating a Facebook profile—we are able to identify the page's subscribers and fans and view their profiles as well as other information they have shared.

In addition to this automatically collected, anonymized data, we also process data that you have voluntarily provided to us, for instance, through comments on posts or when contacting us.

If you click the link www.herma.de/datenschutz/ (the page you are currently viewing), which is posted on HERMA GmbH’s Facebook fan page, you will be directed to a subpage of the HERMA GmbH website. Personal data is also processed on that page. The privacy policy applicable to these pages can be found here: www.herma.de/datenschutz/.

10.4.2.3 Data deletion and storage period

Personal data is deleted or blocked as soon as the purpose for storage ceases to apply. Storage may also be required if mandated by European or national legislators in EU regulations, laws, or other provisions to which HERMA GmbH is subject. Data is also blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless continued storage of the data is necessary for the conclusion or performance of a contract.

10.4.3 Processing of personal data by Facebook

Facebook does not clearly or conclusively state how it uses data from visits to Facebook pages for its own purposes, the extent to which activities on the Facebook page are linked to individual users, how long Facebook stores this data, or whether data from a visit to the Facebook page is passed on to third parties; nor are we fully aware of these details. However, we will monitor further developments in this regard. However, we will monitor further developments in this regard and, if necessary, adjust this privacy policy accordingly. The information below is based on information publicly provided by Facebook regarding the processing of personal data when using Facebook products.

10.4.3.1 Purpose of data processing

According to its own statements, Facebook processes visitors' personal data for the following purposes:

• Provision, personalization, and improvement of Facebook products;
• Provision of measurements, analytics, and other Facebook services; · Promotion of safety, integrity, and security;
• Communication with Facebook users;
• Research and innovation for social purposes.
• Further information regarding the purposes of data processing by Facebook can be found in the Facebook Data Policy: de-de.facebook.com/policy.php
• Further details regarding Facebook's legitimate interests concerning the processing of personal data can be found here: de-de.facebook.com/about/privacy/legal_bases

When you visit our Facebook page (regardless of whether or not you are logged into your Facebook account), your browser transmits certain data to the web server operated by Facebook for technical reasons. In addition, Facebook uses "cookies." Facebook uses cookies, among other things, to provide HERMA GmbH—as the operator of the Facebook page—with statistics for the purpose of managing the marketing of our activities. Further information on Facebook's use of cookies can be found in the Facebook Cookie Policy: de-de.facebook.com/policies/cookies/

10.4.3.2 Description and scope of data processing

a) What types of information does Facebook process?
To provide Facebook products, it is necessary for Facebook to process information about visitors. The types of information collected by Facebook depend on how the visitor uses Facebook products. In this context, the following information may be processed by Facebook:

• Information provided by visitors and others—such as details on how the visitor uses Facebook Products, transactions made on Facebook Products, or information regarding the people, Pages, accounts, hashtags, and groups the visitor is connected to.
• Device information, such as device attributes, identifiers, network and connection details, and cookie data.
• Information from partners—meaning advertisers, app developers, and publishers—who can send data to Facebook via the Facebook Business Tools they use (such as social plugins like the "Like" button, Facebook Login, or the Facebook Pixel). These partners provide Facebook with information about the visitor's activity off-Facebook.
• Additionally, Facebook uses cookies that are placed on the visitor's device when they access a Facebook Page, regardless of whether the visitor is logged into their Facebook account. Facebook also processes the information stored in these cookies when a person visits Facebook Services, services provided by other members of the Facebook group of companies, or services provided by other companies that use Facebook Services. Furthermore, other entities—such as Facebook partners and other third parties—may use cookies on Facebook Services to provide services to Facebook or to companies advertising on Facebook. You can find further information on Facebook's use of cookies in the Facebook Cookie Policy: de-de.facebook.com/policies/cookies/
• When accessing a Facebook Page, the IP address assigned to your device is transmitted to Facebook. According to Facebook, this IP address is anonymized (in the case of "German" IP addresses) and deleted after 90 days. Furthermore, Facebook stores information about its users' devices (particularly in connection with the "Login Notifications" feature); this may enable Facebook to link IP addresses to individual users.
• If you wish to avoid this, you should log out of Facebook (or disable the "Keep me logged in" feature), delete the cookies stored on your device, and close and restart your browser. This removes Facebook information that could be used to identify you directly. You can then use our Facebook page without your Facebook ID being revealed. If you access interactive features on the page (such as "Like," "Comment," "Share," or "Messages"), a Facebook login prompt will appear. Once you log in, Facebook will again be able to identify you as a specific user.
• Information on how to manage or delete information held about you can be found on the following Facebook Support pages: de-de.facebook.com/about/privacy.
• Further information regarding the types of data Facebook processes can be found in the Facebook Data Policy: de-de.facebook.com/policy.php

For further information on the types of information Facebook processes, please refer to the Facebook Data Policy: de-de.facebook.com/policy.php

b) How is the information processed by Facebook shared with others?
Facebook works with third-party partners who help Facebook provide and improve its products or who use Facebook Business Tools to grow their businesses. In this context, Facebook may share information with the following third-party partners:

Partners who use Facebook analytics services;

• Advertisers;
• Measurement partners;
• Partners offering goods and services within Facebook products;
• Vendors and service providers;
• Researchers and academics;
• Law enforcement authorities or in response to legal requests.

For further information on the data Facebook may share with third-party partners, please refer to the Facebook Data Policy: de-de.facebook.com/policy.php

c) How does Facebook process and transfer data as part of its global services?
Facebook shares information globally—both internally among Facebook companies and externally with its partners, as well as with the people or organizations with whom the visitor connects and shares content around the world. This may involve transferring data to the USA or other third countries that do not offer an adequate level of data protection, and processing it there. In this regard, Facebook uses Standard Contractual Clauses approved by the European Commission or relies on adequacy decisions adopted by the European Commission for specific countries.

For further information on data transfers by Facebook, please refer to the Facebook Data Policy: de-de.facebook.com/policy.php

10.4.3.3 Data Deletion and Retention Period

Facebook stores data until it is no longer needed to provide its services and Facebook Products, or until the user's Facebook account is deleted—whichever comes first. This is determined on a case-by-case basis and depends on factors such as the nature of the data, the reason it is collected and processed, and relevant legal or operational retention requirements.

Further information regarding data deletion and retention periods can be found in the Facebook Data Policy: de-de.facebook.com/policy.php

Regarding the retention period for cookies set by Facebook, further information can be found in the Facebook Cookie Policy: de-de.facebook.com/policies/cookies/

10.5 Use of Corporate Presences on Professional Networks

10.5.1 Scope of Data Processing

The corporate presence is used for recruiting, employer branding, brand presence, visibility, communication, PR, and active sourcing. We do not have information regarding the processing of your personal data by the companies that share responsibility for the corporate presence. Further information on this can be found in the privacy policies of:

• LinkedIn
• XING

We provide information on our page and offer users the opportunity to communicate.

LinkedIn: www.linkedin.com/legal/privacy-policy

XING: privacy.xing.com/de

If you perform an action on our corporate presence (e.g., comments, posts, likes, etc.), you may make personal data (such as your real name or user profile photo) publicly visible.

10.5.2 Legal basis for data processing

The legal basis for processing personal data for the purpose of communicating with customers and interested parties is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing an optimal response to your inquiry or in being able to provide the requested information.

If the contact is aimed at concluding a contract, an additional legal basis for processing is Art. 6(1)(b) GDPR.

10.5.3 Purpose of data processing

Our corporate presence serves to inform users about our company and products. Users are free to publish personal data through their activities.

10.5.4 Storage duration

Data generated through the corporate presence is not stored in our own systems.

10.5.5 Exercise of your rights

You may object to the processing of your personal data—collected during your use of our corporate presence—at any time and assert your rights as a data subject, as set out in the "Your Rights" section of this privacy policy. To do so, please send an informal email to the email address specified in this privacy policy.

Further information on exercising your rights can be found here:

LinkedIn: www.linkedin.com/legal/privacy-policy

XING: privacy.xing.com/en