Privacy policy

Information on the collection of personal data In the following, we provide information on the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior. If you would like to find out about our data processing outside the use of the website, please use this data protection declaration. The controller pursuant to Art. 4 (7) of the EU General Data Protection Regulation (hereinafter “GDPR”) is CREFORM Technik GmbHWolfsburgerStr. 10 34225 BaunatalTel.: 0561 475967 0 E-Mail: info@creform.de

We have appointed an external data protection officer to protect your rights and to ensure that your data is processed in accordance with the law. These are the contact details: You can reach our data protection officer at: gds – Gesellschaft für Datenschutz Mittelhessen mbHTel.: +49 6421 80413 – 10E-Mail: datenschutz@gdsm.deCollection of personal data when visiting our website When using the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security on the basis of Art. 6 para. 1 lit. f GDPR and in accordance with § 25 TDDDG:

  • IP address
  • Date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • Amount of data transferred in each case
  • Website from which the request comes
  • Browser
  • Operating system and its interface
  • Language and version of the browser software.

Use of cookies: This website uses the following types of cookies, the scope and function of which are explained below:

  • Transient cookies (see b)
  • Persistent cookies (see c).

Transient cookies are automatically deleted when you close the browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in your browser’s security settings. We use cookies that are technically necessary and that make your visit to our website possible in the first place. If we use cookies that are not technically necessary, we will obtain your consent for this. When using technically necessary cookies for the presentation and necessary functions of our website, the legal basis is § 25 para. 2 TDDDG and Art. Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest). Insofar as we do not use cookies that are technically absolutely necessary for the presentation and necessary functions of our website, we will obtain your consent. The legal basis for the use of these cookies is § 25 para. 1 sentence 1 TDDDG and Art. 6 para. 1 sentence 1 lit. a GDPR. You can give any necessary consent in our Consent Manager when you first visit our website and then manage it at any time: Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a message always appears before a new cookie is created. However, completely deactivating cookies may mean that you cannot use all the functions of our website. The list of all cookies used, the description of the legally required information on the individual cookies and the (de)activation of your consent(s) can be found below:

Data security The personal data collected and stored by us is treated confidentially and protected against loss and alteration as well as unauthorized access by third parties by means of suitable technical and organizational precautions. Your personal data is transmitted over the Internet in encrypted form. We use SSL encryption (Secure Socket Layer) for data transmission.

Automated decisions, profiling We do not carry out any automated decisions (including profiling) with the personal data that we collect when you visit our website. Your rights You have the following rights vis-à-vis us with regard to your personal data:

  • Right to information (Art. 15 GDPR),
  • Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
  • Right to restriction of processing (Art. 18 GDPR),
  • Right to object to the processing (Art. 21 GDPR)
  • Right to data portability (Art. 20 GDPR).

You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us (Art. 77 GDPR).

Legal bases for processing If we obtain your consent for the processing of personal data or other information, the processing is based on Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 sentence 1 TDDDG. If we obtain your consent for the processing of other information, the processing is based on Section 25 (1) sentence 1 TDDDG. If processing is necessary for the fulfillment of a contract or for pre-contractual measures, the processing is based on Art. 6 para. 1 lt. b GDPR. If processing operations of personal data are necessary to fulfill legal obligations, the processing is based on Art. 6 para. 1 lit. c GDPR. In the event that vital interests of natural persons require the processing of personal data, the processing is based on Art. 6 para. 1 lit. d GDPR. If processing is necessary for reasons of public interest, the processing is based on Art. 6 para. 1 lit. e GDPR. If the processing is necessary to safeguard the legitimate interests of the controller or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, the processing is based on Art. 6 para. 1 lit. f GDPR. Objection or revocation against the processing of your data If you have given your consent to the processing of your data, you can revoke this at any time. Such a revocation affects the permissibility of the processing of your personal data after you have expressed it to us. Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the performance of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and will either discontinue or adapt the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing. Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. General storage period Personal data of data subjects will be deleted or blocked as soon as the purpose of storage no longer applies. Your personal data will also be deleted or blocked if you assert a justified request for deletion or revoke your consent. In many cases, we are bound by the statutory retention periods. Your data will be deleted once this maximum storage period has expired, unless there is an important reason to the contrary. Transfer of data Your personal data will not be transferred to third parties for purposes other than those listed below. We only pass on your personal data to third parties if:

  • you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR,
  • the disclosure pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
  • in the event that there is a legal obligation for disclosure pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR, and
  • this is legally permissible and necessary for the processing of contractual relationships with you in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR.

Other functions and offers on our website In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you must generally provide additional personal data that we use to provide the respective service and to which the aforementioned data processing principles apply. In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored. Furthermore, we may pass on your personal data to third parties if we offer participation in promotions, competitions, contracts or similar services together with partners. You will receive more detailed information on this when you provide your personal data or in the description of the offer below. If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this circumstance in the description of the offer. Contact form If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We will not pass on this data without your consent. This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested. We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Mandatory statutory provisions – in particular retention periods – remain unaffected. Other data collection forms If other forms are included on the website that we use to collect data from you, it is always indicated which data we absolutely require as part of the form and which information you can provide to us on a voluntary basis. As a rule, we use the data provided in these forms exclusively for the obviously recognizable purpose. If either the purpose of the processing is not obviously recognizable or we pursue further purposes beyond the obvious recognizable purpose, you will find the exact explanation regarding the data collection within such a form in a specific data protection notice, which you must confirm by opting in before you can submit the form. If the associated processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR, this data protection notice is not formulated as information, but as consent. In this case, by ticking the opt-in box, you give your consent to the processing. You can revoke this consent at any time with effect for the future. The duration of storage ends with the purpose or if you withdraw your consent. Statutory retention periods remain unaffected. Contact option via e-mail, telephone or fax You have the option of contacting us by e-mail, telephone or fax. You will find the relevant addresses on our website under Contact. If you contact us via the e-mail address provided by us, the personal data transmitted with your e-mail will be stored. The legal basis for the processing of your data in this respect is Art. 6 para. 1 lit. f) GDPR, as we have a legitimate interest in contacting you as a (potential) customer. If the contact via e-mail is in connection with the conclusion or execution of a contract between you and us, Art. 6 para. 1 lit. b) GDPR is also the legal basis for the processing. We process personal data that we store in connection with your contact exclusively for the purpose of processing your contact. The data will not be passed on to third parties in this respect. We delete your data as soon as it is no longer required for the purpose for which it was collected. For personal data transmitted by e-mail, this is the case when the respective correspondence with you has ended and it can be inferred from the circumstances that the matter in question has been conclusively clarified. If the data is required to fulfill a contract or to carry out pre-contractual measures, it can only be deleted if this is permitted by contractual or legal obligations. The storage periods that apply here must be determined individually for the respective contracts and contracting parties. You can revoke your consent to the processing of personal data at any time. If you contact us by e-mail, you can object to the storage of your personal data at any time. To do so, simply send an informal message to the contact details provided at the beginning of this privacy policy. Data processing for applications If you apply to us, we process the information that we receive from you as part of the application process, e.g. through letters of application, CVs, references, correspondence, telephone or verbal information. In addition to your contact details, information about your education, qualifications, work experience and skills is of particular relevance to us. Your data will initially be processed exclusively for the application process. If your application is successful, it will become part of your personnel file and will be used to carry out and terminate the employment relationship and deleted in accordance with the regulations applicable to personnel files. If we are currently unable to offer you employment, we will continue to process your data for up to six months after sending the rejection letter in order to defend ourselves against any legal claims, in particular due to alleged discrimination in the application process. If you receive cost reimbursements or other tax-relevant transactions exist, the corresponding accounting documents will be stored in order to fulfill the budgetary and tax retention obligations in accordance with the respective applicable retention obligations. Our HR department and the specialist department of the position for which you have applied and, if necessary, the accounting department have access to your data. If technically necessary, our administrators and processors have access to data processed via IT. They are strictly bound by our instructions and may not process the data for their own purposes. In certain cases, we must disclose your personal data to third parties, for example to our bank if you receive a reimbursement or to the post office if we communicate with you by letter. The legal basis for data processing in the application process and as part of the personnel file is Section 26 para. 1 sentence 1 BDSG and Art. 6 para. 1 lit. b GDPR and, if you have given your consent, for example by sending information that is not necessary for the application process, Art. 6 para. 1 lit. a GDPR. The legal basis for data processing after a rejection is Art. 6 para. 1 lit. f GDPR. The legal basis for storage under budgetary and tax law is Art. 6 para. 1 lit. c GDPR in conjunction with § SECTION 147 AO. Legitimate interest in processing on the basis of Art. 6 para. 1 lit. f GDPR is the defense against legal claims. As a rule, we do not require any special categories of personal data within the meaning of Art. 9 GDPR for the application process. We ask you not to send us any such information from the outset. If such information is exceptionally relevant to the application process, we will process it together with your other applicant data. This may, for example, concern information about a severe disability, which you can provide to us voluntarily and which we then have to process in order to fulfill our special obligations with regard to severely disabled persons. In these cases, the processing serves the exercise of rights or the fulfillment of legal obligations arising from labor law, social security law and social protection. The legal basis for data processing is then Art. 9 para. 2 lit. b GDPR, §§ 26 para. 3 BDSG, 164 SGB IX. In exceptional cases, it may be necessary to obtain information about your health or a disability or information from the Federal Central Criminal Register, i.e. about previous convictions, in order to assess your suitability for the intended job. The legal basis for this is § 26 BDSG. Your data will not be used by us for automated decision-making or profiling. Your data will be processed by us or on our behalf exclusively in Germany. Hosting The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a technical service provider on our behalf and in accordance with our specifications. The personal data collected on this website is stored on the hoster’s servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website. The hoster is used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). Our hoster will only process your data to the extent necessary to fulfill its performance obligations and follow our instructions with regard to this data. Cookie consent When you enter our website, we inform you about the types of cookies we use and give you the option of agreeing or disagreeing to individual types of cookies. We only load non-essential cookies once you have consented to their use. Our website uses Borlabs’ cookie consent technology to obtain your consent within the meaning of Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG to store certain cookies in your browser and to document them in accordance with data protection regulations. The provider of this technology is Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany. When you enter our website, a cookiebot cookie is stored in your browser, in which the consent you have given or the revocation of this consent is stored. The data collected will be stored until you ask us to delete it or delete the Cookiebot cookie yourself or until the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected. Details on Cookiebot’s data processing can be found at https://www.cookiebot.com/de/privacy-policy/. Cookiebot cookie consent technology is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR. Competitions If you would like to take part in one of our competitions, we will process your data for the purpose of running the competition and sending out prize notifications and competition prizes. We process the following personal data: First and last name, as well as the postal address (street, house number, OLZ, city) or your e-mail address. Occasionally, we may need to identify you as our customer. For this purpose, we will check whether the data you have provided can be found in our customer database. The legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will generally be deleted one month after the end of the respective competition, unless you have been determined as the winner. If you are selected as a winner, we are legally obliged to retain the data for up to 10 years due to retention periods under tax and commercial law (Section 147 (1) AO, Section 257 (1) HGB). Google Analytics 4 This website uses Google Analytics 4, a web analytics service provided by Google LLC. (for Europe: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland – “Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. IP anonymization is activated by default in Google Analytics 4. This means that your IP address is truncated. Complete IP addresses are therefore not recorded or logged. Nevertheless, a rough localization of your location is possible. If you have given your consent in accordance with Art. 6 para. 1 lit. a GDPR i.V.m. § Section 25 (1) TDDDG, the following information about you will be collected: Date and time of the visit, technical browser settings, demographic characteristics, your internet provider if applicable, page views and internal search queries. We cannot rule out the possibility that data may be transferred from Google to the USA. For such cases, Google has been certified in accordance with the EU-US Privacy Framework (adequacy decision of the EU Commission), so that a possible transfer of data to the USA is currently considered permissible. We would like to point out that Google servers are distributed worldwide, so that a transfer to other unsafe third countries cannot be ruled out. Currently, the possible transfer of data to third countries is based on the standard contractual clauses (SCCs) provided by Google. We reserve the right to deactivate Google Analytics if a court or supervisory authority decision finds that these SCCs and the adequacy decision do not comply with data protection regulations. Further information on Google Analytics 4 can be found here: [GA4] EU-focused data and privacy – Analytics Help (google.com)[GA4] Data redaction – Analytics Help (google.com)Use of Google Maps On this website, we use the Google Maps service via an API on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. This allows us to show you interactive maps directly on the website and enables you to conveniently use the map function Provider is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. To ensure data protection on this website, Google Maps is deactivated when you enter this website for the first time. A direct connection to Google’s servers is only established when you activate Google Maps yourself. This prevents your data from being transmitted to Google the first time you enter the site. After activation, Google Maps will save your IP address and your location information. This is then usually transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer once Google Maps has been activated. For cases in which personal data is transferred to the USA, Google has submitted to the EU-U.S. Data Privacy Framework, https://www.dataprivacyframework.gov/s/. You can find more information on the handling of user data in Google’s privacy policy: https://www.google.de/intl/de/policies/privacy/. Google Tag Manager This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. With Google Tag Manager, website tags are managed via an interface and other services can be integrated into our online offering. The Tag Manager itself (which implements the tags) therefore does not create user profiles or store cookies, for example. Google only learns the IP address of the user, which is necessary to run the Google Tag Manager. The legal basis for data processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. For cases in which personal data is transferred to the USA, Google has submitted to the EU-U.S. Data Privacy Framework , https://www.dataprivacyframework.gov/s/. Further information on Google Tag Manager can be found on the website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products and standard contractual clauses for third country transfers of data: https://business.safety.google/adsprocessorterms. Adobe Fonts We use Adobe Fonts fonts on our website. The service provider is Adobe Inc. 345 Park Avenue, San Jose, California, 95110-2704 San Jose, USA. We use the service for the visual design of our website. To integrate the fonts, your server must establish a connection to one of the service provider’s servers so that the fonts can be downloaded. This provides the service provider with the information that our website has been accessed from your IP address. The legal basis for the processing is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw this consent at any time with effect for the future. If you withdraw your consent or do not give your consent, a standard font will be used by your end device. We would like to point out that your data will be transferred to the USA. The service provider is certified according to the Data Privacy Framework, so that the data transfer is currently classified as non-critical. Information on how Adobe handles your personal data can be found here: https: //www.adobe.com/de/privacy/policies/adobe-fonts.html .

Data processing by social networks We maintain publicly accessible profiles in social networks. The individual social networks we use are listed below. Social networks such as Facebook etc. can generally analyze your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations. In detail: If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies that are stored on your device or by recording your IP address. With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are logged in or have been logged in. Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals. Legal basis Our social media presences are intended to ensure the broadest possible presence on the internet. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a GDPR). Controller and assertion of rights If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can assert your rights (information, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. Facebook). Please note that, despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider. Storage period The data collected directly by us via the social media presence is deleted from our systems as soon as the purpose for its storage no longer applies, you request us to delete it, you revoke your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory provisions – in particular retention periods – remain unaffected. We have no influence on the storage period of your data that is stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below). Social networks indetailFacebook We have a profile on Facebook. The provider is Facebook Inc, 1 Hacker Way, Menlo Park, California 94025, USA. We have concluded an agreement with Facebook on joint processing (Controller Addendum). This agreement specifies which data processing operations we or Facebook are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum. You can adjust your advertising settings yourself in your user account. To do this, click on the following link and log in: https://www.facebook.com/settings?tab=ads. Details can be found in Facebook’s privacy policy: https://www.facebook.com/about/privacy/. LinkedIn We have a profile on LinkedIn. The social network LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Details on how they handle your personal data can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policyYouTube We have a channel on YouTube. The operator of the YouTube service is Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland. We integrate at least one YouTube plugin on our website. When you access the relevant pages, your IP address is transmitted and, in particular, you are informed which of our websites you have visited. As soon as you start playing an embedded video by clicking on it, YouTube stores cookies on your end device. For details on how YouTube handles your personal data, please refer to YouTube’s privacy policy: https: //policies.google.com/privacy?hl=de&gl=de . X (formerly Twitter) We have a profile on X. The operator of the social network is Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland. Details on how they handle your personal data can be found here: X Privacy Policy. Instagram We have a profile on Instagram. The operator of the Instagram social network is Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. Details on how they handle your personal data can be found in Instagram’s privacy policy: https://help.instagram.com/581066165581870. XING We have a profile on XING. The provider is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany. Details on how they handle your personal data can be found in XING’s privacy policy: https://privacy.xing.com/de/datenschutzerklaerung