2. Hosting and Content Delivery Networks (CDN)

External hosting

This website is hosted externally. The personal data collected on this website is stored on the server(s) of the host(s). This can include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access and other data generated via a website.

The external hosting is carried out for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 Para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 Para. 1 lit. f GDPR).

If appropriate consent has been requested, processing is carried out exclusively on the basis of Art. 6 Para. 1 lit . B. Device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Our host(s) will only process your data to the extent necessary to fulfill its service obligations and follow our instructions regarding this data.

We use the following host(s):

Accell IT BV

Industrieweg 4,

NL-8444 AR Heerenveen

Order processing

We have concluded an order processing contract (AVV) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that we only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Unpack

A web service from Npm, Inc., 1999 Harrison Street #1150, CA 94612 Oakland, United States of America (hereinafter: Unpkg) is loaded onto our website. If you have activated Java Script in your browser and have not installed a Java Script blocker, your browser may transmit personal data to Unpkg. Further information on the handling of transferred data can be found in Unpkg's data protection declaration:https://www.npmjs.com/policies/privacy

You can prevent Unpkg from collecting and processing your data by deactivating the execution of script code in your browser or installing a script blocker in your browser.

ELASTIC CLOUD

We use company services Elastic Search BV, United States of America (hereinafter: ELASTIC) in order to be able to provide it as efficiently as possible worldwide and to optimize loading times.

ELASTIC thereby receives knowledge of personal data relating to the call (e.g. IP address). You can find information on how this service provider implements the GDPR here. General information on data protection can be found here.

3. General information and mandatory information

Privacy and data protection

The operators of these sites take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this data protection declaration.

When you use this website, various personal data is collected.

Personal data is data that can be used to personally identify you. This data protection declaration explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We would like to point out that data transmission over the Internet (e.g. when communicating via email) can have security gaps. Complete protection of data from access by third parties is not possible.

Note on the responsible body

The party responsible for processing data on this website is:

WINORA-STAIGER GmbH

Max-Planck-Straße 6

97526 Sennfeld
Phone: +49 9721-65 01-0
Mail: info@winora-group.de

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (names, e-mail addresses, etc.).

Storage period

Unless a specific storage period is specified in this data protection declaration, your personal data will remain with us until the purpose for data processing no longer applies. If you make a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); In the latter case, the deletion takes place after these reasons no longer apply.

General information on the legal basis for data processing on this website

If you have consented to data processing, we will process your personal data on the basis of Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit are processed. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 Para. 1 lit. a GDPR. If you have consented to the storage of cookies or to the access to information on your device (e.g. via device fingerprinting), the data processing will also be carried out on the basis of Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time. If your data is necessary to fulfill the contract or to carry out pre-contractual measures, we process your data on the basis of Article 6 Paragraph 1 Letter b GDPR. Furthermore, we process your data if it is necessary to fulfill a legal obligation on the basis of Art. 6 Para. 1 lit. c GDPR.

Data processing can also be carried out on the basis of our legitimate interest in accordance with Article 6 (1) (f) GDPR. Information about the relevant legal bases in each individual case is provided in the following paragraphs of this data protection declaration.

Data Protection Officer

We have appointed a data protection officer.

Dipl.-Ing. Lars Ebertz on behalf of EBERTZ DATENSCHUTZ GmbH

Above the meadows 17

35756 Mittenaar

E-mail:lars@ebertz-datenschutz.de

Recipients of personal data

As part of our business activities, we work with various external bodies. In some cases, it is also necessary to transmit personal data to these external bodies. We only pass on personal data to external bodies if this is necessary to fulfill a contract, if we are legally obliged to do so (e.g. passing on data to tax authorities), if we have a legitimate interest in accordance with Article 6 Paragraph 1 lit. f DSGVO in the transfer or if another legal basis allows the data transfer. When using

We only pass on our customers’ personal data to processors on the basis of a valid contract for order processing. In the case of joint processing, a joint processing contract is concluded.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke any consent you have already given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.

Right to object to data collection in special cases and to direct advertising (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6 ABS. 1 LITER. E OR F GDPR

IF THIS HAPPENS, YOU HAVE THE RIGHT AT ALL TIMES FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION ARISE AGAINST THE PROCESSING OF YOUR PERSONAL DATA TO OBJECT; THIS ALSO APPLIES TO ANY BASED ON THESE TERMS PROFILING. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED READ THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN HAVE COMPLEX REASONS FOR PROCESSING THAT WOULD BE PROTECTED EVIDENCE THAT OUTWEIGHES YOUR INTERESTS, RIGHTS AND FREEDOM OR THE PROCESSING IS FOR THE ASSERTMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21 (1) GDPR).

WILL YOUR PERSONAL DATA BE PROCESSED TO OPERATE DIRECT ADVERTISING, SO YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOU AT ANY TIME SUCH PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING TO INSERT; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT SUCH DIRECT ADVERTISING IS INVOLVED CONNECTED. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSE OF DIRECT ADVERTISING (OBJECTION PURSUANT TO ARTICLE 21 (2) GDPR).

Right to lodge a complaint with the responsible supervisory authority

In the event of violations of the GDPR, those affected have the right to lodge a complaint with one

supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the data to be transferred directly to another person responsible, this will only be done if it is technically feasible.

Information, correction and deletion

You have the right to free of charge at any time within the framework of the applicable legal provisions

Information about your stored personal data, its origin and recipient and the purpose of data processing and, if necessary, a right to correct or delete this data. You can contact us at any time about this or if you have any further questions on the subject of personal data.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted. You can contact us at any time about this. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data held by us, we require

usually time to check this. For the duration of the review, you have the right to request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, this data - apart from its storage - may only be used with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the European Union or a member state.

SSL or TLS encryption

This site uses for security reasons and to protect the transmission of confidential content, such as Example orders or inquiries that you send to us as the site operator, an SSL or TLS Encryption. You can recognize an encrypted connection by the browser address line changing from “http://” to “https://” and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising emails

The use of contact details published as part of the imprint obligation to send unsolicited advertising and information materials is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, such as spam emails.

4. Data collection on our website

Cookies

Our websites use so-called “cookies”. Cookies are small data packets and are intended for

will not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser automatically deletes them.

Cookies can come from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services. Third-party companies within websites (e.g. cookies for processing payment services).

Cookies have various functions. Numerous cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies can be used to evaluate user behavior or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions you want (e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the web audience) (necessary cookies). on Based on Article 6 Paragraph 1 Letter f GDPR, unless another legal basis is stated. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimized provision of its services. If there is consent to

If the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TTDSG); consent can be revoked at any time.

You can set your browser so that you are informed when cookies are set and

Only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or generally and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

You can find out which cookies and services are used on this website in this data protection declaration.

OneTrust consent management

We offer you the opportunity to decide in detail in which cases you want to consent to tracking via cookies and other technologies - in order to display content relevant to you and offers tailored to you.

The processing of your data for the purposes mentioned here is partly based on legitimate interest, but partly we also need your consent. For this purpose, we use the Consent Management Platform (CMP) of OneTrust, LLC, 1350 Spring St NW, Atlanta, GA 30309, as a processor.

Onetrust's CMP enables you to give us data protection-compliant and self-determined consent to the processing of your data and to revoke it at any time. You can also object to data processing based on our legitimate interest. Further information on data protection and Onetrust's CMP can be found here:https://www.onetrust.de/datenschutzerklaerung/

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

This data will not be merged with other data sources.

This data is collected on the basis of Article 6 Paragraph 1 Letter f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of his website - for this purpose the server log files must be recorded.

contact form

If you send us inquiries using the contact form, your details will be taken from the Inquiry form including the contact details you provided there for the purpose of processing the inquiry and stored with us in case of follow-up questions. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6 Para. 1 lit. b GDPR, provided your request is related to the fulfillment of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest effective processing of inquiries addressed to us (Art. 6 Para. 1 lit. f GDPR) or on your consent (Art. 6 Para. 1 lit. a GDPR) if this was requested; consent can be revoked at any time.

The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions – in particular retention periods – remain unaffected.

Inquiries by email, telephone or fax

If you contact us by email, telephone or fax, your request, including all resulting personal data (name, request), will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6 Para. 1 lit. b GDPR, provided your request is related to the fulfillment of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest effective processing of inquiries addressed to us (Art. 6 Para. 1 lit. f GDPR) or on your consent (Art. 6 Para. 1 lit. a GDPR) if this was requested; consent can be revoked at any time.

The data you send to us via contact requests will remain with us until you request us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

Salesforce Sales Cloud

We use Salesforce Sales Cloud to manage customer data. The provider is salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich (hereinafter “Salesforce”).

Salesforce Sales Cloud is a CRM system and allows us, among other things, to manage existing and potential customers as well as customer contacts and to organize sales and communication processes. The use of the CRM system also enables us to analyze our customer-related processes. The customer data is stored on Salesforce’s servers. Personal data may also be transmitted to the parent company of salesforce.com Germany GmbH, salesforce.com inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA.

Details about Salesforce Sales Cloud features can be found here:https://www.salesforce.com/de/products/sales-cloud/overview/.

The use of Salesforce Sales Cloud is based on Art. 6 Para. 1 lit. f GDPR. The

Website operator has a legitimate interest in the most efficient customer management and customer communication possible. If appropriate consent has been requested, processing is carried out exclusively on the basis of Art. 6 Para. 1 lit . B. DeviceFingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Salesforce has Binding Corporate Rules (BCR) approved by the French Data Protection Agency. These are binding internal company regulations that legitimize internal company data transfer to third countries outside the EU and the EEA. Details can be found here:https://www.salesforce.com/de/blog/2020/07/die-binding-corporate-rules-von-salesforce-erfüellenhighest-da.html.

For details, see Salesforce’s privacy policy:https://www.salesforce.com/de/company/privacy/.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzLyAAK&status=Active

Order processing

We have concluded an order processing contract (AVV) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that we only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

5. Analysis tools and advertising

Google DoubleClick

This website uses functions from Google DoubleClick. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland, (hereinafter “DoubleClick”).

DoubleClick is used to show you interest-based advertisements across the Google advertising network. With the help of DoubleClick, the advertisements can be tailored specifically to the interests of the respective viewer. For example, our advertising may be displayed in Google search results or in advertising banners connected to DoubleClick.

In order to be able to display advertising tailored to users' interests, DoubleClick must comply with the relevant Recognize the viewer and provide him with the websites visited, clicks and other information Assign user behavior. For this purpose, DoubleClick uses cookies or similar ones Recognition technologies (e.g. device fingerprinting). The information collected becomes summarized in a pseudonymous user profile in order to display advertising tailored to the interests of the user concerned.

The use of this service is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time.

Further information on how to object to the advertisements displayed by Google can be found at the following links:https://policies.google.com/technologies/adsandhttps://adssettings.google.com/authenticated.

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that we use to provide tracking or statistical tools and others. We can integrate technologies on our website. Google Tag Manager itself does not create one. User profiles, does not store cookies and does not carry out any independent analyses. It only serves that Management and deployment of the tools integrated via it. However, Google Tag Manager collects your IP address, which may also be transferred to Google's parent company in the United States.

The use of the Google Tag Manager is based on Art. 6 Para. 1 lit. f GDPR. The Website operators have a legitimate interest in quickly and easily integrating and managing various tools on their website. If appropriate consent has been requested, processing is carried out exclusively on the basis of Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior of website visitors. The website operator receives various usage data, such as: E.g. page views, length of stay, operating systems used and origin of the user. This data is sent to the respective end device assigned to users. There is no assignment to a user ID.

Furthermore, we can use Google Analytics to record, among other things, your mouse and scrolling movements and clicks. Furthermore, Google Analytics uses various modeling approaches to complement the data sets collected and uses machine learning technologies in data analysis.

Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the USA and stored there.

The use of this service is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's standard contractual clauses.

Details can be found here:https://privacy.google.com/businesses/controllerterms/mccs/.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

IP anonymization

Google Analytics IP anonymization is activated. This means that your IP address will be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide further information

To provide services related to website use and internet use to the website operator. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

Browser plugin

You can prevent Google from collecting and processing your data by downloading and installing the browser plug-in available at the following link:https://tools.google.com/dlpage/gaoptout?hl=de.

You can find more information about how Google Analytics handles user data in Google's privacy policy:https://support.google.com/analytics/answer/6004245?hl=de.

Order processing

We have concluded an order processing contract with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program from Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads allows us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be based on the user data available on Google (e.g. Location data and interests) are displayed (target group targeting). As website operators, we can evaluate this data quantitatively, for example by analyzing which search terms led to our advertisements being displayed and how many advertisements led to corresponding clicks.

The use of this service is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's standard contractual clauses. Details can be found here: https://policies.google.com/privacy/frameworksandhttps://privacy.google.com/businesses/controllerterms/mccs/.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

Google Ads Remarketing

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing we can assign people who interact with our online offering to specific target groups in order to then display interest-based advertising to them in the Google advertising network (remarketing or retargeting).

Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google's cross-device functions. In this way, interest-based, personalized advertising messages that have been adapted to you on one device (e.g. cell phone) depending on your previous usage and surfing behavior can also be displayed on another of your devices (e.g. tablet or PC).

If you have a Google account, you can object to personalized advertising using the following link:https://www.google.com/settings/ads/onweb/.

The use of this service is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time.

Further information and the data protection regulations can be found in Google's data protection declaration at:https://policies.google.com/technologies/ads?hl=de.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

Target group formation with customer comparison

To create target groups, we use, among other things, customer matching from Google Ads Remarketing.

We transfer certain customer data (e.g. email addresses) from our customer lists to Google. If the customers in question are Google users and are logged into their Google account, they will

Suitable advertising messages within the Google network (e.g. on YouTube, Gmail or in the search engine) are displayed.

Google conversion tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognize whether the user has carried out certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently. This Information is used to create conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

The use of this service is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time.

You can find more information about Google conversion tracking in Google's data protection regulations:https://policies.google.com/privacy?hl=de.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

SMARTFIT

You can use Smartfit Online Sizing on our website. Smartfit is a solution from Radlabor GmbHHeinrich-von-Stephan-Str. 5c 79100 Freiburg (https://www.onlinesizing.bike/).

You can download the application on our website.

To get a size recommendation for a specific bike, you can submit the following information through the application:

Smartfit calculates a specific size recommendation for a bike using algorithms that find the right bike size based on your anthropometric data and gender. In some cases, you can transfer your preferred bike size from the application to your personal shopping cart using a button on the results screen.

USE OF PERSONAL DATA FROM OUR APPLICATION

We use your personal data from the application exclusively for the following purposes:

All personal data is processed anonymously and Smartfit never collects or processes personal data (e.g. real name, address details, payment information). All data is stored on servers and databases located in either Frankfurt, Germany or Nuremberg, Germany. No data will be transferred outside the European Union. All data is automatically deleted after a certain retention period.

We do not use data for marketing or advertising purposes.

COOKIES

We use a local storage cookie to store the following information:

We store this data in your local storage along with a session identifier. The cookie is considered necessary for technical reasons. Without the cookie, the online sizing widget cannot be used meaningfully. The cookie allows us to identify repeat users so that you do not have to re-enter your basic information when you use the application again. The token (JWT) is renewed after a user has been inactive for 4 hours.

In some cases, the cookie allows size recommendations to be displayed immediately on the product detail pages of our partners' webshops without using the application again. In some cases, our application submits the recommended size to a partner store (i.e. so that the recommended size is automatically selected in a dropdown on the product page). With the Smartfit recommendation engine enabled, you don't need to re-enter your basic information, with recommended bikes appearing in new browser tabs.

SAFETY AND PROTECTION

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss and/or destruction, and against access by unauthorized persons. Our security measures are subject to continuous improvement in line with current technological developments.

Further data processing by Radlabor GmbH – in the sense of independent or instruction-bound data processing – does not take place!

Storyblok

We use the services of the processor Storyblok GmbH, Peter-Behrens-Platz 2, A-4020 Linz, for our CMS and for CDN services. Server connections can be established in the USA. We have concluded a data processing agreement with Storyblok. Storyblok is obliged to conclude EU standard contractual clauses with its subcontractors. This offers sufficient guarantees for adequate data protection within the meaning of Art. 46 GDPR.

6. Data protection Google Lead Ads

PRIVACY POLICY FOR OUR GOOGLE ADS LEAD FORM EXTENSION

General information on data protection

Protecting your private rights and freedoms is important to us; We only use your data for the intended purposes. Since it is important to us that you always know to what extent we collect, use and, if necessary, transfer your data to third parties, we will inform you below in detail about the processing of your personal data (collected via our lead form).

When processing personal data, we strictly adhere to the requirements of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) and, if necessary, other data protection-relevant regulations.

scope

This privacy policy applies exclusively to our Google Lead Form extension. It does not apply to Google's own content; You can find Google’s privacy policy here

Name and address of the person responsible for processing:

WINORA-STAIGER GmbH

Max-Planck-Straße 6

97526 Sennfeld

Phone:09721-65 01-0
Fax:09721-65 01-45
E-mail:info@winora-group.de

Name and address of the data protection officer

Dipl.-Ing. Lars Ebertz on behalf of EBERTZ DATENSCHUTZ GmbH Ober den Wiesen 17 35756 Mittenaar

email: lars(at)ebertz-datenschutz.de

If you have any questions about the processing of your personal data, or if you wish to assert your data subject rights (such as the right to information, correction, blocking or deletion of data) or if you wish to revoke your consent, please contact our data protection officer directly.

Information about Google Ads (provider of the lead form extension)

Google Ireland Limited Gordon House, Barrow Street Dublin 4 Ireland Tel:+353 1 543 1000Fax:+353 1 686 5660Email: support-deutschland(at)google.com

You can find Google's data protection information here.

Google’s data protection officer

To reach Google's data protection officer, you can use the following link fill out a corresponding contact form:

Operation of our Google Ads lead form extension

Within the lead form extension, Google collects personal data for us. In particular, this includes all the data you have entered there.

Interaction with our lead form

As soon as you enter data in our lead form, it will be saved in our Google Ads profile. Through our profile we can download the data in aggregate (manually or automatically) and use it for the purpose stated in the form. The data will not be passed on to third parties.

We transfer the data to our CRM system (see SALESFORECE SALES CLOUD) and also compare it with any existing data records in order to be able to assign them correctly.

As part of the Google Enhanced Conversion Tracking function, Google receives a so-called hash of the email identifier - there is no plain text transmission - for later recognition and correct assignment. See also the general chapter “GOOGLE (ENHANCED) CONVERSION TRACKING”.Data protection.

SALESFORCE SALES CLOUD

We use Salesforce Sales Cloud to manage customer data. provider issalesforce.comGermany GmbH, Erika-Mann-Str. 31, 80636 Munich (hereinafter “Salesforce”).

Salesforce Sales Cloud is a CRM system and allows us, among other things, to manage existing and potential customers as well as customer contacts - such as Google LeadAd accounts - and to organize sales and communication processes. The use of the CRM system also enables us to analyze our customer-related processes. The customer data is stored on Salesforce’s servers. Personal data may also be sent to the parent companysalesforce.comGermany GmbH, thesalesforce.cominc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA.

Salesforce has Binding Corporate Rules (BCR) approved by the French Data Protection Agency. These are binding internal company regulations that legitimize internal company data transfer to third countries outside the EU and the EEA.

You can find details here.

You can find details here Data protection from Salesforce:

Salesforce order processing

We have concluded an order processing contract (AVV) with SALESFOREC. This is a contract required by data protection law that ensures that we only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Basic information on the deletion or blocking of personal data

We only store your personal data for the period necessary to fulfill the specified purpose. Once the purpose no longer applies and any existing retention periods have expired, your data will be deleted immediately. If deletion is not possible, the data will be blocked instead.

Rights of data subjects

The EU General Data Protection Regulation (GDPR) provides extensive rights for data subjects in Chapter III, which we will explain to you below with regard to the processing of your personal data:

1) Right to information This requirement applies in particular to information on the following details of data processing:

2) Right to correction if necessary. We will correct incorrect data sets immediately as long as you inform us of the situation accordingly.

3) Right to deletion (right to be forgotten) If the processing is no longer necessary and one of the following conditions is met:

As part of the deletion request, we will, if necessary, pass on your request to those third parties to whom your data was previously transmitted.

4) Right to restriction of processing If one of the following conditions is met:

5) Right to data portability If it is technically possible and does not affect the rights and freedoms of other people, we will - at your request - transfer your data to another recipient (person responsible).

6) Right to object If we collect or have collected and process personal data from you (on the basis of Art. 6 Para. 1 e or f or Art. 9 Para. 2 a GDPR), you have the right to to object to data processing (including profiling) at any time (with effect for the future). In exceptional cases the objection may be invalid, e.g. B. if we can demonstrate compelling legitimate interests for the processing that outweigh your interests or the processing serves to assert, exercise or defend legal claims. If we process your personal data to conduct direct advertising, you have the right to object to this processing at any time. This also applies to profiling insofar as it is connected to such direct advertising. You also have the right to object to the processing of your data concerning you, which is carried out by us for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 GDPR, unless such processing is necessary Fulfillment of a task in the public interest is required.

7) Automated decisions in individual cases, including profiling If we collect or have collected and process personal data from you, you have the right not to be subject to a decision based solely on automated processing - including profiling - that has legal effect on you or significantly affects you in a similar way. Exceptions to this requirement apply if the decision is necessary for the conclusion or performance of a contract between you and us or if you have expressly consented to the processing. In any case, we will take appropriate measures to protect your rights and freedoms as well as your legitimate interests, which include at least the right to obtain human intervention on our part, to express one's own point of view and to challenge the decision.

8) Right to revoke your data protection consent You have the right to revoke your consent to the processing of personal data at any time.

9) Right to complain to a supervisory authority You can find a list of the supervisory authorities responsible in Germany on the website of the Federal Commissioner for Data Protection or under the following link:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/AufsBehordFuerDennichtOeffRaum/AufsichtsbehoerdennichtOeffRaum_liste.html

Legal basis for processing

We process personal data in accordance with the requirements of the GDPR, depending on the type and purpose of processing as follows:

Informed consent

Art. 6 Para. 1 a

Safeguarding our legitimate interest

Art. 6 Para. 1 f

Our legitimate interest

Our legitimate interest, as defined in Article 6 Para. 1 f GDPR, is based on carrying out our business activities to maintain our operational capability and secure the employment of our employees.

Existence of automated decision making

We do not use automatic decision-making and do not use techniques to carry out profiling measures.

Google marketing service provider

If we use service providers to process the data on our Google lead forms, we conclude corresponding contracts for order processing (AVV) with them. In the course of this, we regulate to what extent and under what security conditions the data is processed and determine the necessary authority to issue instructions in accordance with Art. 28 GDPR

GOOGLE (ENHANCED) CONVERSION TRACKING

This website uses Google Conversion Tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognize whether the user has carried out certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently.

Information is used to create conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

If you give your consent, we will transmit the email address provided when purchasing one of our products to Google using a secure (hashed) process in order to be able to carry out a possible conversion (so-called ENHANCED CONVERSION). This conversion can then, for example, generate statistics that give us information about the course and development of a purchase in order to optimize our processes.

You can find more information about Google conversion tracking in the Privacy Policy from Google: The use of this service is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time with future effect.

7. Newsletter

Newsletterdata

If you would like to receive the newsletter offered on the website, we need an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. No further data is collected or only collected on a voluntary basis. We use this data exclusively to send the requested information and do not pass it on to third parties.

The data entered into the newsletter registration form is processed exclusively

Basis of your consent (Art. 6 Para. 1 lit. a GDPR). You can revoke your consent to the storage of data, the e-mail address and their use to send the newsletter at any time, for example via the “unsubscribe” link in the newsletter. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

The data you provide to us for the purpose of subscribing to the newsletter will be stored by us until you receive it

Unsubscription from the newsletter is stored by us or the newsletter service provider and deleted from the newsletter distribution list after unsubscribing from the newsletter or after the purpose no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest in accordance with Article 6 (1) (f) GDPR.

Data stored by us for other purposes remains unaffected.

After you have been unsubscribed from the newsletter distribution list, your email address will be sent to us

Newsletter service providers may be stored in a blacklist if this is necessary to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 Para. 1 lit. f GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interests.

We use the Salesforce Sales Cloud to send our newsletter emails. Further information on this can be found in the chapter Salesforce Sales Cloud.

8. Plugins and Tools

Vimeo

This website uses plugins of the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our pages equipped with a Vimeo video, a connection to the Vimeo servers is established. The Vimeo server is informed which of our pages you have visited. Vimeo also obtains your IP address. This also applies if you are not logged in to Vimeo or do not have an account with Vimeo. The information collected by Vimeo is transmitted to the Vimeo server in the USA.

If you are logged into your Vimeo account, you enable Vimeo to associate your surfing behavior directly with your personal profile. You can prevent this by logging out of your Vimeo account.

To recognize website visitors, Vimeo uses cookies or comparable recognition technologies (e.g. device fingerprinting).

The use of Vimeo is in the interest of an appealing presentation of our online offers.

This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding

If consent has been requested, the processing takes place exclusively on the basis of Art. 6 para. 1 lit. a

GDPR and § 25 Abs. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission and, according to Vimeo, on "legitimate business interests". Details can be found here: https://vimeo.com/privacy.

Further information on the handling of user data can be found in Vimeo's privacy policy at: https://vimeo.com/privacy.

YouTube

This website embeds videos from the YouTube website. The website operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our websites on which YouTube is integrated, a connection to YouTube's servers is established. The YouTube server is informed which of our pages you have visited.

Furthermore, YouTube can store various cookies on your device or use comparable technologies for recognition (e.g. device fingerprinting). In this way, YouTube can receive information about visitors to this website. This information is, among other things, used to collect video statistics, improve user experience and prevent fraud attempts.

If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

The use of YouTube is in the interest of an attractive presentation of our online offerings. This represents a legitimate interest within the meaning of Article 6 Paragraph 1 Letter f of the GDPR. If there is a corresponding one

If consent has been requested, processing is carried out exclusively on the basis of Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Further information on how to handle user data can be found in YouTube's privacy policy at:https://policies.google.com/privacy?hl=de.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The

DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

Google Fonts

This site uses so-called Google Fonts, which are provided by Google, for the uniform display of fonts. When you access a page, your browser loads the required fonts into your browser cache in order to display texts and fonts correctly.

For this purpose, the browser you use must connect to Google's servers. This gives Google knowledge that this website was accessed via your IP address. The use of Google Fonts is based on Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on his website. If appropriate consent has been requested, processing is carried out exclusively on the basis of Art. 6 Para. 1 lit . B. Device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

If your browser does not support Google Fonts, a standard font will be used by your computer.

For more information about Google Fonts, seehttps://developers.google.com/fonts/faqand in Google's privacy policy:https://policies.google.com/privacy?hl=de.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

In order to use the functions of Google Maps, it is necessary to save your IP address. This

Information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. If Google Maps is activated, Google can use Google Fonts for the purpose of uniform font display. When you access Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

The use of Google Maps is in the interest of an attractive presentation of our online offerings and to make it easy to find the places we indicate on the website. This represents a legitimate interest within the meaning of Article 6 Paragraph 1 Letter f of the GDPR. If there is a corresponding one

If consent has been requested, processing is carried out exclusively on the basis of Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

 Data transfer to the USA is based on the EU Commission's standard contractual clauses.

Details can be found here:

https://privacy.google.com/businesses/gdprcontrollerterms/andhttps://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You can find more information about how we handle user data in Google's privacy policy:https://policies.google.com/privacy?hl=de.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to check whether data entry on this website (e.g. in a contact form) is done by a human or by an automated program. To do this, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. Evaluated for analysis reCAPTCHA collects various information (e.g. IP address, length of time the website visitor stays on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyzes run completely in the background. Website visitors are not informed that an analysis is taking place.

The storage and analysis of the data is based on Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its web offerings from abusive automated spying and SPAM. If appropriate consent has been requested, processing is carried out exclusively on the basis of Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Further information about Google reCAPTCHA can be found in the Google Privacy Policy and the Google Terms of Use under the following links: https://policies.google.com/privacy?hl=deandhttps://policies.google.com/terms?hl=de.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=Active

9. Processing of data (customer and contract data)

We collect, process and use personal data only insofar as they are necessary for the establishment, content design or change of the legal relationship (inventory data). This is done on the basis of Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. We collect, process and use personal data about the use of this website (usage data) only to the extent necessary to enable or bill the user for the use of the service.

The collected customer data will be deleted after completion of the order or termination of the business relationship. Legal retention periods remain unaffected.

Data transmission upon conclusion of contract for online shops, dealers and shipping of goods

We only transfer personal data to third parties if this is necessary in the context of contract processing, for example to the companies entrusted with the delivery of the goods or the credit institution commissioned with payment processing.

Your personal data provided in the context of a contract will be processed by our contract data processors for the purpose of processing the legal transaction. This processing may take place partially or completely outside the EU, in particular in the USA. This is formally a transfer of data to a third country.

See also:

A further transmission of the data does not take place or only if you have expressly consented to the transmission.

If you use our Click & Collect service, the specialist dealer you have selected will be informed by email about the purchase process and your customer data (for contacting and making an appointment).

Your data will not be passed on to third parties without express consent, for example for advertising purposes.

The basis for data processing is Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures or, in the event of the transmission of your personal data, Art. 49 para. 1 a GDPR (express consent).

Ingenico / PAYONE

On this website, we offer, among other things, payment with the services of PAYONE. The provider is PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt am Main (hereinafter referred to as "PAYONE").

PAYONE offers various payment options (e.g. hire purchase). If you decide to pay with PAYONE (Klarna checkout solution), Klarna will collect various personal data from you. Details can be found in PAYONE's privacy policy under the following link: https://www.ingenico.de/payment-services/footer/datenschutzerklarung.

The transmission of your data to PAYONE takes place on the basis of Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing for the performance of a contract). You have the possibility to revoke your consent to data processing at any time. A revocation does not affect the effectiveness of data processing operations in the past.

Clear

On this website we offer, among other things, payment with the services of Klarna. The provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter referred to as "Klarna").

Klarna offers various payment options (e.g. hire purchase). If you choose to pay with Klarna (Klarna checkout solution), Klarna will collect various personal data from you. Details can be found in Klarna's privacy policy under the following link: https://www.klarna.com/de/datenschutz/.

Klarna uses cookies to optimize the use of the Klarna checkout solution. The optimization of the checkout solution represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. They remain on your device until you delete them. Details on the use of Klarna cookies can be found at the following link: https://cdn.klarna.com/1.0/shared/content/policy/cookie/de_de/checkout.pdf.

The transmission of your data to Klarna takes place on the basis of Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing for the performance of a contract).

PayPal

On this website we offer, among other things, payment via PayPal. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as "PayPal").

If you choose to pay via PayPal, the payment data you enter will be transmitted to PayPal.

The transmission of your data to PayPal takes place on the basis of Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing for the performance of a contract). You have the possibility to revoke your consent to data processing at any time. A revocation does not affect the effectiveness of data processing operations in the past.

10. Own Services

Handling of applicant data

We offer you the opportunity to apply to us (e.g. by e-mail, post or via online application form). In the following we inform you about the scope, purpose and use of your personal data collected during the application process. We assure you that the collection, processing and use of your data is carried out in accordance with applicable data protection law and all other legal provisions and that your data will be treated as strictly confidential.

Scope and purpose of data collection

If you send us an application, we process your associated personal data (e.g. contact and communication data, application documents, notes in the context of job interviews, etc.), insofar as this is necessary to decide on the establishment of an employment relationship.

The legal basis for this is § 26 BDSG-neu according to German law (initiation of an employment relationship), Art. 6 para. 1 lit. b GDPR (general contract initiation) and – if you have given your consent – Art. 6 para. 1 lit. a GDPR. The consent can be revoked at any time.

Your personal data will only be passed on within our company to persons who are involved in processing your application.

If the application is successful, the data submitted by you will be processed on the basis of § 26 BDSG-neu and Art. 6 para. 1 lit. b GDPR for the purpose of carrying out the employment relationship in our data processing systems.

Data retention period

If we are unable to make you a job offer, reject a job offer or withdraw your application, we reserve the right to store the data transmitted by you on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). Subsequently, the data will be deleted and the physical application documents destroyed. The storage serves in particular for purposes of proof in the event of a legal dispute. If it can be seen that the data will be required after expiry of the 6-month period (e.g. due to an imminent or pending legal dispute), deletion will only take place when the purpose for further storage no longer applies.

A longer storage may also take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if statutory storage obligations preclude deletion.

Inclusion in the applicant pool

If we do not make you a job offer, it may be possible to include you in our applicant pool.

In the event of admission, all documents and information from the application will be transferred to the applicant pool in order to contact you in the event of suitable vacancies. Admission to the applicant pool takes place exclusively on the basis of your express consent (Art. 6 para. 1 lit. a GDPR). The submission of consent is voluntary and is not related to the ongoing application process. The data subject may revoke his consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, unless there are legal storage reasons.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been given.

11. Social Media

This data protection declaration applies to the following social media sites

https://www.facebook.com/winorabikes

https://www.instagram.com/winorabikes/

https://www.youtube.com/@winora_bikes

https://vimeo.com/user103969233

Data processing through social networks

We maintain publicly accessible social network profiles. You can find the social networks we use in detail below.

Social networks such as Facebook, X etc. can usually comprehensively analyze your user behavior when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presence triggers numerous data protection-relevant processing operations. In detail:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account on the respective social media portal. In this case, this data is collected, for example, via cookies that are stored on your device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be shown to you inside and outside of the respective social media presence. If you have an account with the relevant social network, interest-based advertising can be displayed on all devices on which you are logged in or were logged in.

Please also note that we cannot understand all processing processes on the social media portals. Depending on the provider, further processing operations may therefore be possible operators of the social media portals. Details can be found in the terms of use and data protection regulations of the respective social media portals.

Legal basis

Our social media presence is intended to ensure the broadest possible presence on the Internet. This is a legitimate interest within the meaning of Article 6 (1) (f) GDPR. Those from the social

Analysis processes initiated in networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 Para. 1 lit. a GDPR).

Responsible person and assertion of rights

If you visit one of our social media sites (e.g. Facebook), we, together with the operator of the social media platform, are responsible for the data processing operations triggered by this visit. In principle, you can exercise your rights (information, correction, deletion, restriction of processing, data portability and complaint) both. us as well as against the operator of the respective social media portal (e.g. Facebook).

Please note that despite our shared responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options depend largely on the corporate policy of the respective provider.

Storage period

The data we collect directly via the social media presence will be deleted from our systems as soon as you request us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Saved cookies remain on your device until you delete them. Mandatory legal provisions – especially retention periods – remain unaffected.

We have no influence on the storage period of your data, which is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their data protection declaration, see below).

Your rights

You have the right to obtain information about the origin, recipient and purpose of your data free of charge at any time

to receive stored personal data. You also have the right to object

Data portability and a right to complain to the responsible supervisory authority. You can also request the correction, blocking, deletion and, under certain circumstances, the restriction of the processing of your personal data.

Social networks in detail

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter Meta). According to Meta, the collected data will also be transferred to the USA and other third countries.

We have entered into a joint processing agreement (Controller Addendum) with Meta. This agreement specifies which data processing operations we or Meta are responsible for when you visit our Facebook page. You can view this agreement at the following link:https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. To do this, click on the following link and log in:https://www.facebook.com/settings?tab=ads.

Data transfer to the USA is based on the EU Commission's standard contractual clauses.

Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendumandhttps://de-de.facebook.com/help/566994660333381.

Details can be found in Facebook's privacy policy:https://www.facebook.com/about/privacy/.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt0000000GnywAAC&status=Active

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Data transfer to the USA is based on the EU Commission's standard contractual clauses. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum,

https://privacycenter.instagram.com/policy/andhttps://de-de.facebook.com/help/566994660333381.

Details on how they handle your personal data can be found in Instagram's privacy policy:https://privacycenter.instagram.com/policy/.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt0000000GnywAAC&status=Active

Vimeo

Functions of the Vimeo service are integrated on our pages. The provider is Vimeo LCC, 555 West 18th Street, New York, New York 10011, USA.

As soon as you visit a page of our website equipped with a Vimeo plugin, a connection to the Vimeo servers is established. The Vimeo server is informed which specific page of our website you have visited. If you are logged in with your Vimeo account, you would enable Vimeo to assign your surfing behavior directly to your personal profile. You can disable this possibility of assignment if you log out of your account beforehand. Further information on the collection and use of your data by Vimeo can be found in their privacy policy at: https://vimeo.com/privacy

YouTube

We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on how they handle your personal data can be found in YouTube's privacy policy:https://policies.google.com/privacy?hl=de.

The company is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF certified company undertakes to comply with these data protection standards. Further information can be obtained from the provider using the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt0000000GnywAAC&status=Active