Sto data protection notice

This privacy statement explains how we process your personal data (hereinafter referred to as “data”).

1. Data controller

In accordance with the provisions in the General Data Protection Regulation (GDPR), the data controller is:

Sto SE & Co. KGaA

Ehrenbachstr. 1

79780 Stühlingen, Germany

Tel.: +49 77 44 57-0

Web: https://www.sto.de

E-mail: infoservice[at]sto.com

2. Contact details for our data protection officer

Matthias Rosa as an ext. data protection officer

Am Winterhafen 78

D-55131 Mainz

datenschutzbeauftragter[at]sto.com

3. General information on data processing

We process data as part of our business and website activities.

This includes disclosing data by transferring it to third parties and, where applicable, to non-member countries outside the European Union (hereinafter referred to as the “EU”) and the European Economic Area (hereinafter referred to as the “EEA”). In cases where we transfer data to parties or locations outside the EU or EEA, we identify this as outlined below.

4. Data processing

The specific items of data affected, purposes of processing, legal bases, recipients, and, where applicable, transfers to non-member countries are listed below:

a) Log file from website visit

We log your visit to our website. As part of this, we process:

The name(s) of the page(s) on our website that you visited

The date and time of your visit

The quantity of data transferred

The browser type you used and its version

The operating system you used

The referrer URL (the website you visited before ours)

Your IP address

The requesting provider

The legal basis for this data processing is our overriding legitimate interest in the ongoing provision and security of our website, in accordance with Article 6(1) f) of the GDPR.

The log file is deleted after a period of seven days unless it is required to provide evidence of or verify actual legal infringements that become known during this period.

b) Hosting

To maintain our online presence, we use the services of web hosting providers, which process all the aforementioned data associated with the operation of this website (log file of website visit) on our behalf.

The legal basis for this data processing is our overriding legitimate interest in the provision of our website, in accordance with Article 6(1) f) of the GDPR.

c) Establishing contact

If you establish contact with us, we will process the following data for the purposes of dealing with your request: your name, your contact details (if you provide them), and your message.

The legal basis for this data processing is our obligation to perform a contract and/or fulfil the obligations that apply to us prior to entering into a contract, in accordance with Article 6(1) b) of the GDPR, and/or our overriding legitimate interest in processing your request, in accordance with Article 6(1) f) of the GDPR.

d) Establishing contact in the case of job applications

If you establish contact with us in order to submit an application for employment with us – by e-mail or using a contact form, for example – the data that you have submitted (such as your name, e-mail address, and requested employment location), your message, and the application documents you have submitted will be processed exclusively for the purpose of dealing with your application.

The primary legal basis for this data processing is Section 26 of the BDSG (German Federal Data Protection Act), which states that data that is required in order to make a decision about entering into an employment relationship may be processed.

Should this be necessary on completion of the application process (as part of legal proceedings, for example), data processing to safeguard our legitimate interests is permitted according to Article 6(1) f) of the GDPR, specifically to pursue and/or defend a claim.

e) Contract performance and data management as part of our service provision

We process various items of data when providing our services and for the purposes of initiating and processing contractual relationships between you and us.

If you have assigned us to provide a service, we will process your data (name, contact details, and address, where provided) and all the information required to perform this assignment exclusively for the purpose of handling the contractual relationship.

In particular, this includes consulting services and support, correspondence with you, invoicing, and fulfilling our accounting and tax-related obligations.

Accordingly, the data will be processed on the basis of Article 6(1) b) of the GDPR and for the purpose of complying with our legal obligations in accordance with Article 6(1) c) of the GDPR.

Your data may be passed on to third parties where necessary for the purposes of processing the assignment.

In particular, this may include passing data on to supervisory authorities for correspondence purposes and in order to assert and defend your rights.

In doing so, we will put all suitable measures in place to ensure that personal data is only transferred to the extent necessary for the underlying purpose.

f) Newsletter

We offer you the option of receiving an e-mail newsletter so that we can share regular information about our company and our offers with you. If you subscribe to our newsletter, we will process the data you provide when doing so (e-mail address and other information shared voluntarily). To prevent abuse, once you have subscribed, we will send you an e-mail asking you to confirm your subscription (double opt-in procedure). Your subscription is logged so that we can verify that the subscription process complies with legal requirements. The data that is logged as part of this is the point in time at which you subscribed and confirmed, and your IP address.

The legal basis for sending the newsletter is your consent in accordance with Article 6(1) a) of the GDPR. The legal basis for processing the data connected with sending the confirmation e-mail for your subscription and for the related data logging process is our legitimate interest in verifying that your subscription is correct, in accordance with Article 6(1) f) of the GDPR.

In order to send the newsletter, we use service providers to which we transfer the data referred to above.

g) Personalized newsletter

If you agree to this in advance, you will receive a newsletter from us with individualized content.

Through the use of the newsletter, we receive information about when an e-mail was opened. Furthermore, we analyse your user behaviour by determining which links you clicked on in the newsletter. We use this information to further tailor the content of our newsletter to your individual interests.

The legal basis for sending the newsletter is your consent in accordance with Art. 6 (1) a) of the GDPR.

h) Cookies

Our website uses what are known as cookies. These are small text files that are stored on your device (PC, smartphone, tablet, etc.) by your web browser.

(1) Purposes

We use cookies with the technical properties that are required to ensure our web presence operates as best as possible. These cookies make it possible for you to navigate our website, and they provide other basic website functions.

We also use optional cookies that provide us with additional information for the purposes of analysing data traffic or conducting advertising and marketing, for example.

(2) Duration

The cookies that we use remain on your device for different durations:

Session cookies: These cookies are deleted from your device immediately after you close your web browser.

Permanent cookies: These cookies remain on your device even after you have closed your web browser, and enable us to do things like recognise you the next time you visit our website.

(3) Party cookies

First-party cookies refer to cookies that are set directly by us. Third-party cookies, on the other hand, are set by third-party websites when displaying content, for example (advertisements, images, tracking pixels, etc.).

(4) Legal basis for data processing

Fundamentally, the legal basis for processing data by means of cookies is your consent in accordance with Article 6(1) a) of the GDPR or our overriding legitimate interest in optimising and establishing functions on our web presence in accordance with Article 6(1) f) of the GDPR.

(5) Withdrawal and objection

In cases where data is processed on the basis of your consent, you may withdraw your consent (opt out) with effect for the future at any time. In cases where data is processed on the basis of our legitimate interest, you may object to any further data processing with effect for the future. To do this, you can use the options in our cookie settings. You can change or withdraw your consent at any time by clicking on the appropriate icon at the bottom left-hand corner of the website.

You can find more information about objecting to data processing in section 6 b) of this privacy statement.

(6) Cookie settings in your browser

You can also prevent data being processed through cookies in the future or restrict the extent to which this occurs by visiting the appropriate browser settings and making settings such as deactivating the use of cookies. As well as this, you can delete the cookies that are already stored in your browser settings. The following links provide more information about settings in different browsers:

Mozilla Firefox: https://support.mozilla.org/en/kb/

Internet Explorer: https://support.microsoft.com/en-gb/help/17442/

Google Chrome: https://support.google.com/accounts/

Opera: http://www.opera.com/en/help

Safari: https://support.apple.com/kb/PH17191?

(7) Our cookies

Our cookie settings provide additional information on the specific cookies we set, the purposes of doing so, and the duration for which the cookies remain on your device. You can change or withdraw your consent at any time by clicking on the appropriate icon at the bottom left-hand corner of the website.

i) Consent banner from Cookie Information

So that we can document your selections relating to certain data processing procedures and communicate this information to third-party providers, our website uses the Cookie Information service (hereinafter referred to as “Cookie Information”) provided by Cookie Information A/S, Nyhavn 16A, 1051 Copenhagen K, Denmark. Cookie Information uses the data processing procedures you select and communicates this information to third-party providers as appropriate.

This data processing is carried out in order to fulfil our legal obligation to process data in a way that is compliant with data protection requirements, in accordance with Article 6(1) c) of the GDPR.

You can find more information about how Cookie Information processes data at: https://cookieinformation.com/cookie-and-privacy-policy

j) Analysis/Marketing

(1) Google services

Our website uses various services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”). As part of this, there is the potential for data to be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 in the USA. It is not possible to guarantee that an appropriate level of data security will be maintained in the USA.

(2) Google Analytics

Our website uses the tracking tool Google Analytics in order to analyse your use of the website. This makes it possible to compile reports about activity on our web presence, provide further services associated with use of the website, and improve user-friendliness as a result.

The use of Google Analytics primarily involves using cookies to collect data about and systematically evaluate interactions by users of our website.

You can find details of the cookies we use in our cookie settings. You can change or withdraw your consent at any time by clicking on the appropriate icon at the bottom left-hand corner of the website.

We use Google Analytics with the “anonymizeIp()” extension. This truncates IP addresses within member states of the EU or EEA. If data is transferred to Google servers in the USA, the complete IP address is only transferred and truncated there in exceptional cases. In most cases, this prevents the possibility of the data being used to directly identify an individual person. In particular, it makes it impossible to link the data to the computer or other device that the visitor to the website used.

Google Analytics processes the following data:

Three bytes from the IP address of the system used by the website visitor (anonymised IP address)

The website visited

The website from which users access our website (referrer)

The individual pages visited on our website

The duration for which users remain on the website

The frequency with which the website is visited

Google has itself stated that it will never unite your IP address with other Google data.

The legal basis for this data processing is your prior consent in accordance with Article 6(1) a) of the GDPR.

(3) Withdrawing your consent

You can withdraw your consent with effect for the future at any time. To do this, you can use the options in our cookie settings. You can change or withdraw your consent at any time by clicking on the appropriate icon at the bottom left-hand corner of the website. You can also amend these settings at https://www.google.com/ads/preferences.

Please also note the supplementary information about Google’s use of data in the Google Partner Network, which is available here: https://www.google.com/intl/en-gb/policies/privacy/partners/

k) External content

We use dynamic content (hereinafter referred to as “content”) from third parties to optimise the appearance and content of our website. When you visit our website, a request is sent automatically to the corresponding content provider’s server via an interface. Certain log data (e.g. the user’s IP address) is transferred in this request. The dynamic content is then transferred to our website, where it is displayed.

We use external content in conjunction with the following functionalities:

(1) Integration of YouTube videos

We have integrated videos from the YouTube portal operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter referred to as “YouTube”) into our website. When videos are played back, log data is transferred to YouTube’s servers in the USA. It is not possible to guarantee that an appropriate level of data security will be maintained in the USA.

The legal basis for this data processing is our overriding legitimate interest in optimising the marketing of our web presence in accordance with Article 6(1) f) of the GDPR.

More information is available at: https://policies.google.com/privacy?hl=en-gb&gl=en-gb

(2) Google Maps

Our website uses Google’s map service Google Maps to provide you with an interactive map. When the map is displayed, data including your IP address and location is transferred to Google’s servers in the USA and stored there. This data is processed on the basis of our overriding legitimate interest in optimising the marketing of our offer in accordance with Article 6(1) f) of the GDPR.

There is the possibility of data being transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. It is not possible to guarantee that an appropriate level of data security will be maintained in the USA.

More information about data protection is available at: https://policies.google.com/privacy?hl=en-gb&gl=en-gb

(3) reCAPTCHA

We use the external service reCAPTCHA to protect the forms on our website against spam and abuse. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”). reCAPTCHA makes it possible to distinguish between input made by humans and fraudulent input made by automated software (also known as bots).

It processes the following data from you: the referrer URL, user’s IP address, user’s input actions, mouse movements around the reCAPTCHA checkboxes, detection and association with a Google account if the user is logged into this at the same time, information about the browser being used, browser size, browser resolution, browser plugins, language settings, date, scripts, and display instructions from the website.

This data is processed on the basis of our overriding legitimate interest in maintaining the security of our website in accordance with Article 6(1) f) of the GDPR.

5. Data retention duration

We retain personal data only for as long as is necessary for the purposes for which it is being processed or until you withdraw your consent. Insofar as statutory retention requirements need to be complied with, the retention period for certain data can be up to 10 years, regardless of the purposes for which the data is being processed.

6. Your rights as a data subject

a) Information and access

You can request information about/access to all personal data we are holding for you, free of charge and at any time.

b) Rectification, erasure, restriction of processing (blocking), objection

If you no longer agree to your personal data being stored or if your personal data is no longer correct, on receipt of a corresponding instruction from you, we will have your data erased or blocked or make the necessary corrections (insofar as this is possible under applicable law). The same applies if we are to restrict the processing of your data in the future. In particular, you have the right to object in cases where your data is necessary for the performance of a task in the public interest or our legitimate interest, including any profiling that is based on this. You also have the right to object in cases where data is processed for direct marketing purposes.

c) Your right to withdraw consent with effect for the future

You can withdraw consent with effect for the future at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

d) Data portability

If data is being processed on the basis of a contract or negotiations prior to entering into a contract, on the basis of consent, or using automated methods, you have the right to data portability. On request we will provide your data to you in a commonly used, structured, and machine-readable format so that you can transfer this data to another controller should you wish to do so.

e) Right to lodge a complaint

You also have the option to lodge a complaint with a supervisory authority in relation to your rights as a data subject:

(https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html).

f) Restrictions

The above rights do not apply to data where we are not able to identify the data subject (if the data has been anonymised for analysis purposes, for example). It may be possible for you to exercise your right to access/be informed, right to erasure, right to block, right to rectification, or transfer to another organisation in relation to this data if you provide us with additional information that will enable us to identify you.

7. Exercising your rights as a data subject

If you have any questions about the processing of your personal data or if you wish to exercise your right to access/be informed, right to rectification, right to block, right to object, or right to erasure, or should you wish to submit a request for your data to be transferred to another organisation, please contact datenschutzbeauftragter[at]sto.com.