1. Name and Address of the Data Controller
The data controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union and other provisions with a statutory data protection character is:
Dietrich Lüttgens GmbH & Co. KG
Hasselbecker Straße 16
Tel.: +49 (0)2056 / 264-0
General partner Lüttgens Verw.-GmbH with registered office in Heiligenhaus
Court of Registry Wuppertal HRB [Commercial Registry number] 17238
Managing Directors: Holger Lüttgens, Peter Oentrich
1.1 Name and Address of the Data Protection Officer
The data protection officer of the data controller is:
Mr Heiko Zündorf
Dietrich Lüttgens GmbH & Co. KG
Hasselbecker Straße 16
Tel.: +49 (0)2056 / 264-34
2 Privacy by Design and Privacy by Default Website Design
For this website we use the “privacy by design and default” settings, which means that data protection is ensured by the design of the technology and data protection-friendly settings.
These are not new terms. However, as part of the GDPR they acquire a new meaning and are anchored in Article 25 of the General Data Protection Regulation (GDPR). Although these terms are often used together, each term stands alone and is accordingly also to be observed separately. This article explains exactly what each of them involves.
2.1 Privacy by Design
Privacy by design means “Data protection by the design of the technology” and takes up the basic principle that data protection is best complied with when it is already technically integrated in the development of a data processing operation. In other words: the protection of personal data within the meaning of the GDPR is ensured by early adoption of technical and organisational measures (TOMs) at the development stage.
2.2 Privacy by Default
Privacy by default means “data protection by data protection-friendly settings” and means that the factory settings are designed to be data protection-friendly. Under the basic principle, the intention is to protect in particular users who are not especially tech-savvy and therefore may not, for example, be inclined to adjust the data protection settings to suit their needs. This principle is behind the term “privacy paradox” whereby users are in principle in favour of the protection of their privacy but do not actively put in place the corresponding settings.
It is possible to reject the placing of cookies at any time by changing the settings to that effect in the web browser. Cookies placed can be erased. Please be aware that if you deactivate cookies, you may not be able to fully use all the functions of our website.
Cookies are stored by Dietrich Lüttgens GmbH only for the duration of the visitor session.
3.1 Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. Google Analytics also uses so-called “cookies”, text files that are stores on your computer and enable an analysis of the use of the website by you. The information generated by the cookie about your use of this website (including your IP address) is transmitted to a Google server in the USA and stored there. Google will use this information to evaluate your use of the website to compile reports about the website activities for the website operators and to provide services connected with the site activity and internet usage. Google may also transfer this information to third parties where this is legally required or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.
By using this website you declare your agreement with the processing of the data collected about you by Google in the aforementioned manner and for the aforementioned purposes. Data collection and data storage can be rejected at any time with future effect.
Please note that this website uses Google Analytics pseudonymised in compliance with data protection with the extension _anonymizeIp() and therefore only further processes IP addresses in truncated form to exclude direct linking to a particular person.
3.2 Google Analytics Remarketing
Our website uses Google retargeting technologies. The provider is Google Inc. 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. This allows us to address targeted personalised advertising to visitors to our website according to their interests. The insertion of the advertising take place by means of a cookie-based analysis of earlier use and surfing behaviour. This process does not involve the storage of any personal data.
For this a cookie is stored to collect anonymised data about the users’ interests and thus to adapt the advertising individually to this information. These cookies are small text files which are stored on your computer or mobile terminal device.
4. Creation of Log Files
Each time the website is visited Dietrich Lüttgens GmbH & Co. KG uses an automated system to collect data and information. These are stored in the server’s log files.
The following data may be is collected:
a. Information on the browser type and the version used
b. The user’s operating system
c. The user’s internet service provider
d. The user’s IP address
e. Date and time of access
f. Web pages from which the user’s system comes to our website (referrer)
g. Web pages accessed by the user’s system via our website.
The data is processed for delivering the content of our website, for ensuring the functionality of our technical IT systems and the optimisation of our website. The log file data is always stored separately from other personal data of the user.
The log file data is automatically erased on a rolling basis every six months.
5. Redirecting (links) to Web Content of Partners in the Business
If the data subject uses the opportunity to go to the websites of partners in the business using the links on our website, the data privacy statement of the respective owner of the website is exclusively applicable.
Dietrich Lüttgens GmbH & Co. KG assumes no liability for the data processing and any storage of personal data of the respective websites of partners in the business operation.
To avoid abuse, the IP address of the user as well as the date and time of registration are stored. This is intended to prevent abuse of the services. The data will not be disclosed to third parties. An exception to this is if there is a statutory requirement for disclosure.
6. Options for Contact
On the Dietrich Lüttgens GmbH & Co. KG website there is a contact form which can be used for online contact. Alternatively it is possible to make contact using the email address provided. If the data subject makes contact with the data controller using one of these channels, the personal data sent by the data subject will be automatically stored. Storing the data is solely for the purpose of processing or contacting the data subject. The data will not be disclosed to third parties.
7. Routine Erasure and Blocking of Personal Data
The data controller processes and stores personal data of the data subject only for as long as is necessary to achieve the purpose of the storage. It may be stored for longer than that where this is laid down by the European or national legislator in EU regulations, laws or other provisions to which the data controller is subject.
As soon as the purpose of storage no longer exists or a storage period laid down by the aforementioned regulations expires, the personal data will be routinely blocked or erased.
8. Rights of the Data Subject
If your personal data is processed, you are the data subject within the meaning of the GDPR and the data controller must grant you to the following rights:
8.1 Right to Information
You can require confirmation from the data controller whether personal data relating to you is being processed by us.
If such processing is present, you can require the data controller to provide you with information on the following matters:
a. the purposes for which the personal data is being processed;
b. the categories of personal data that are being processed;
c. the recipients or the categories of recipients to whom the personal data relating to you has been or is still being disclosed;
d. the planned storage period of the personal data relating to you or, if no specific details on this are possible, criteria for the determination of the storage period;
e. the existence of a right to rectification or erasure of the personal data relating to you, a right to restriction to the processing by the data controller or a right to object to the processing;
f. the existence of a right to complain to the supervisory authorities;
g. all available information on the origin of the data if the personal data has not been collected from the data subject;
h. the existence of automated individual decision making including profiling in accordance with Article 22 (1) and (4) GDPR and, at least in these cases, meaningful information on the logic involved as well as the scope of the desired effects of such processing for the data subject.
You have the right to require information about whether the personal data relating to you is transferred to a third country or to an international organisation. In this connection you can require that you are informed about the appropriate safeguards under Article 46 GDPR in connection with the transfer.
8.2 Right to Rectification
You have the right to rectification and/or completion by the data controller if the processed personal data relating to you is incorrect or incomplete. The data controller must carry out the rectification without delay.
8.3 Right to Restriction of Processing
Under the following conditions you can require the restriction of the processing of the personal data relating to you:
a. if you contest the accuracy of the personal data relating to you for a period enabling the data controller to check the accuracy of the personal data;
b. the processing is unlawful and you object to the erasure of the personal data and instead require the restriction of the use of the personal data;
c. the data controller no longer needs the personal data for the purposes of processing but you need it for the establishment, exercise or defence of legal claims or
c. if you have objected to processing in accordance with Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.
If the processing of the personal data relating to you has been restricted, this data may, apart from storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a member state.
If the restriction of processing under the above conditions has been restricted, you will be informed by the controller before the restriction is lifted.
8.4 Right to Erasure
8.4.1. You can require from the data controller that the personal data relating to you is erased without delay and the controller is required to erase this data without delay if one of the following reasons applies:
a. The personal data relating to you is no longer necessary for the purposes for which it was collected or processed in any other way.
b. You withdraw your consent on which the processing under Article 6 (1) (a) or Article 9 (2) (a) GDPR is based and there is no other legal basis for processing.
c. Under Article 21 (1) GDPR you object to the processing and there are no overriding legitimate grounds for the processing or you object to the processing under Article 21 (2) GDPR.
d. The personal data relating to you has been processed unlawfully.
e. The erasure of the personal data relating to you is necessary for fulfilling a statutory obligation under Union law or the law of the member states to which the data controller is subject.
d. The personal data relating to you has been collected relating to the offer of information society services under Article 8 (1) GDPR.
8.4.2. Where the data controller has made the personal data relating to you public and is required to erase it under Article 17 (1) GDPR, the controller must, taking into account the available technology and the implementation costs, take reasonable steps including technical measures, to inform controllers that are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, this personal data.
8.4.3. There is no right to erasure where the processing is necessary
a. for exercising the right to freedom of expression and information;
b. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c. on public interest grounds in the area of public health under Article 9 (2) (h) and (i) as well as Article 9 (3) GDPR;
d. for archive purposes in the public interest, scientific or historical research purposes or for statistical purposes under Article 89 (1) GDPR where the right in (1) is likely to make impossible or seriously impair the achievement of the aims of this processing or
e. for the establishment, exercise or defence of legal claims.
8.5 Right to Notification
If you have asserted the right to correction, erasure or restriction of the processing by the data controller, the latter is required to inform all recipients to which the personal data relating to you has been disclosed of this rectification or erasure of the data or restriction of processing, unless it proves impossible or associated with disproportionate expense.
You have the right to be notified by the data controller about these recipients.
8.6 Right to Data Portability
You have the right to receive the personal data relating to you that you have provided to the data controller in a structured, commonly used and machine-readable format. In addition you have the right to send this data to another data controller without hindrance from the controller to which the personal data has been provided if
a. the processing is based on consent under Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR or on a contract under Article 6 (1) (b) GDPR and
b. the processing is carried out with the aid of an automated procedure.
Furthermore, in the exercise of this right, you have the right to have the personal data relating to you transmitted directly from one data controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task that is in the public interest or carried out in the exercise of official authority vested in the data controller.
8.7 Right to Object
You have the right on grounds relating to your particular situation to object at any time to the processing of the personal data relating to you carried out on the basis of Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on those provisions.
The controller may no longer process the personal data relating to you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data relating to you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, the personal data must no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
8.8 Right to withdraw the data protection declaration of consent
You have the right to withdraw your consent to the processing of your data at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
8.9 Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
a. is necessary for entering into, or performance of, a contract between you and a data controller,
b. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests or
c. is based on your explicit consent.
However these decisions must not be based on special categories of personal data referred to in Article 9 (1) GDPR, unless point (a) or (g) of Article 9 (2) applies and suitable measures to safeguard your and freedoms and legitimate interests are in place.
In the cases referred to in points (a) and (c), the data controller must implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
8.10 Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged must inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy under Article 78 GDPR.
9. Disclosure of personal data to third parties
It is not planned to disclose the data to third parties and this will not take place.
It may happen that third party content such as videos from YouTube, map material from Google Maps, RSS feeds or graphics from other websites are integrated within this web content. This always requires that the providers of this content (“third-party providers”) are aware of the IP address of the users. Without the IP address they would not be able to send the content to the respective user’s browser. The IP address is thus necessary to display this content. We endeavour only to use such content where the respective providers use the IP address solely to supply the content. However we have no influence over whether the third-party providers save the IP address e.g. for statistical purposes. Where we are aware of this, we inform the user about it.
10. Legal basis for the processing
Where we obtain the consent of the data subject for processing operations, Article 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
In the processing of personal data that is necessary for the performance of a contract to which the data subject is party, Article 6 (1) (b) GDPR forms the legal basis. This also applies to processing operations necessary prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6 (1) (c) GDPR forms the legal basis.
In the event that processing personal data is necessary in order to protect the vital interests of the data subject or of another natural person, Article 6 (1) (d) GDPR forms the legal basis.
If processing is necessary for the purposes of the legitimate interests of our company or a third party, and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6 (1) (f) forms the legal basis for the processing. The legitimate interests of our company lie in the execution of our business activity.
11. Storage Period for Personal Data
Personal data will be stored for the respective statutory retention period. After the end of the period the data will be routinely erased if not required for contract initiation or contract performance.
Personal data for which no retention periods apply (visitor tracking) are erased on a rolling basis every six months.
12. Social media plugins
To keep the use of the data that you send to us to a minimum, we do not use social media plugins of the following companies:
Facebook, Google +1, Google Adsense, Instagram, LinkedIn, Pinterest, Piwik, Tumblr, Twitter, Xing, Amazon