Privacy Statement of NORWE GmbH

I. Controller’s name and address

The controller within the meaning of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

NORWE GmbH
Paulstr. 5 51702 Bergneustadt
Germany

Phone +49 (0)27 63-8 070
Fax +49 (0) 27 63 8 07-77
Email verkauf@norwe.de

II. Data protection officer

Our data protection officer is:

Dr. Rüdiger Tutsch
Phone +49 (0) 721 49 70 54
Email rtdgmbh@t-online.de

III. General visit to our website

1. Scope of the processing of personal data

When you visit our websites at www.norwe.de, www.norwe.eu, www.norwe.com the browser on your device automatically sends information to our website’s server. This information is temporarily stored in a log file. The following information is recorded without any action on your part and is stored until it is automatically erased:

  • IP address of the requesting computer
  • date and time of access
  • name and URL of the retrieved file
  • website from which access is made
  • browser used and, if applicable, your computer’s operating system as well as the name of your access provider

2. Purpose and legal basis for data processing

The legal basis for data processing is Art. 6 para. 1 sentence 1 f GDPR. Our legitimate interest is based on the purposes listed below for data collection. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally.

The above mentioned data will be processed by us for the following purposes:

  • to ensure the smooth operation of the website
  • to ensure comfortable use of our website
  • to evaluate system security and stability

IV. Contact forms and contact via email

1. Scope of the processing of personal data

Contact forms are available on our website which can be used to order product brochures and samples. If a user takes advantage of this option, the data entered in the entry fields will be transmitted to us and stored. This data includes:

  • first name, last name
  • email address
  • country
  • company (optional, if ordering digital product information)
  • address (optional, if ordering digital product information)
  • telephone number (optional)

Alternatively, you can contact us via the email address provided. In this case, the user's personal data sent in the email will be stored.

As part of this process, no data is transmitted to third parties. The data is used exclusively for processing the correspondence. In case of an order inquiry, the data will be used to answer the order inquiry, and in case of a later conclusion of contract, for the execution of the contract.

2. Purpose and legal basis for data processing

The processing of this personal data takes place based on your inquiry and is necessary for the purposes specified to process your inquiry:

  • to identify and advise you appropriately
  • to fulfil your request
  • to correspond with you

The legal basis for this processing is Art. 6 para. 1 b GDPR.

The legal basis for processing data transmitted in the course of sending an email is Art. 6 para. 1 f GDPR. If the objective of making contact via email is to conclude a contract, then the legal basis for processing is also Art. 6 para. 1 b GDPR.

V. Storage period in detail

The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected.

In the case of personal data entered into the contact form’s entry fields and of personal data sent by email, the data is erased when the respective conversation with the user ends. The conversation ends when it can be inferred from the circumstances that the facts in question have been conclusively clarified.

In the case of personal data stored in connection with the initiation of contract conclusion, the data is erased when it can be inferred from the circumstances that a contract will not be concluded.

In the case of personal data stored in connection with the conclusion of a contract, the data is erased upon expiry of the warranty periods, but at the latest upon expiry of the statutory (tax law related) retention periods.

VI. Disclosure of data to third parties

Your personal data will not be transmitted to third parties for purposes other than those listed below. We will only transfer your personal data to third parties if

  • you have given your explicit agreement pursuant to Art. 6 para. 1 sentence 1 a GDPR.
  • the transfer pursuant to Art. 6 para. 1 sentence 1 f GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest which requires protection of your personal data.
  • a legal obligation exists to transfer pursuant to Art. 6 para. 1 sentence 1 c GDPR.
  • this is legally permissible and required by Art. 6 para. 1 sentence 1 b GDPR for processing the contractual relationships with you.

VII. Your rights as the data subject

If personal data is processed about you, you are a data subject within the meaning of the GDPR and you hold the following rights vis-à-vis us:

1. Right to information

You can ask the controller to confirm whether personal data concerning you will be processed by us.

If such processing has taken place, you can request the following information from us:

(1) the purposes for which the personal data is processed;

(2) the categories of personal data being processed;

(3) the recipients or categories of recipients to which the personal data concerning you have been or are still being disclosed;

(4) the period for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used for determining that period;

(5) the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;

(6) the existence of a right to lodge a complaint with a supervisory authority; and

(7) any available information on the origin of the data if the personal data is not collected from the data subject. You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. The right to rectification

You have the right to obtain from the controller without undue delay the rectification of inaccurate or incomplete personal data concerning you.

Under the following conditions, you may request that the processing of personal data concerning you will be restricted:

(1) if you dispute the accuracy of the personal data concerning you for a period that enables the controller to verify the accuracy of the personal data;

(2) the processing is unlawful and you oppose the erasure of the personal data and request restriction of its use instead;

(3) the controller no longer needs the personal data for the purposes of the processing, but you need it to assert, exercise or defend legal claims, or

(4) if you have filed an objection to the processing pursuant to Art. 21 para. 1 GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds.

If the processing of personal data concerning you has been restricted, such personal data may only be processed – with the exception of storage – with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest of the EU or a Member State.

If the processing has been restricted according to the above mentioned conditions, you will be informed by the controller before the restriction is lifted.

3. Right to erasure

a) Duty to erase

You have the right to have the controller erase the personal data concerning you without undue delay and the controller is obligated to erase this personal data without undue delay if one of the following reasons applies:

(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.

(2) You withdraw your consent, on which the processing was based pursuant to Art. 6 para. 1 a or Art. 9 para. 2 a GDPR, and there is no other legal ground for the processing.

(3) You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.

(4) The personal data concerning you has been processed unlawfully.

(5) The erasure of the personal data relating to you is necessary to fulfil a legal obligation under EU law or the Member State law to which the controller is subject.

(6) The personal data concerning you was collected in relation to the offer of information society services pursuant to Art. 8 para. 1 GDPR.

b) Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 para. 1 GDPR, it shall undertake reasonable measures, including technical measures, taking into account the available technology and the implementation costs, to inform the controllers which are processing the personal data that you as the data subject have requested the erasure of any links to this personal data or copies or replications of this personal data.

c) Exceptions

The right to erasure does not exist if processing is necessary

(1) for exercising freedom of expression and information;

(2) for compliance with a legal obligation which requires processing by EU law or the Member State law to which the controller is subject, or for performing a task carried out in the public interest or in exercising official authority vested in the controller;

(3) for reasons of public interest in the area of public health pursuant to Art. 9 para. 2 h and i and Art. 9 para. 3 GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 para. 1 GDPR, to the extent that the law stipulated in a) is likely to make impossible or to seriously impair the achievement of the objectives of the processing, or

(5) to assert, exercise or defend legal claims.

4. Right to information

If you have asserted the right to have the controller rectify or erase personal data or restrict the processing, it is obliged to inform each recipient to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction on processing, unless this proves impossible or involves disproportionate effort.

You are entitled to receive information about the recipients from the controller.

5. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. In addition, you have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where

(1) processing is based on consent pursuant to Art. 6 para. 1 a GDPR or Art. 9 para. 2 a GDPR or on a contract pursuant to Art. 6 para. 1 b GDPR and

(2) processing is carried out by automated means.

In exercising this right, you also have the right to request that the personal data concerning you be transmitted directly from one controller to another controller, as far as this is technically feasible. The freedoms and rights of others may not be affected by this.

The right to portability shall not apply to processing personal data necessary for performing a task carried out in the public interest or in exercising official authority vested in the controller.

6. Right to object

You have the right to object at any time for reasons related to your particular situation to the processing of your personal data in accordance with Art. 6 para. 1 e or f GDPR.

The controller no longer processes the personal data concerning you, unless it demonstrates compelling legitimate grounds for the processing, which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for the purpose of marketing of this kind.

If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You are entitled to exercise your right to object by automated means using technical specifications in the context of the use of information society services, notwithstanding Directive 2002/58/EC.

7. Right to withdraw the data protection declaration of consent

You have the right to withdraw your data protection declaration of consent at any time. The withdrawal of consent shall not affect the legality of the processing carried out on the basis of the consent until withdrawal.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of personal data concerning you infringes upon the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and results of the complaint including the possibility of a judicial remedy pursuant to Article 78.

© 12/2019 NORWE GmbH