**I. Basic Information**

Here we inform you about the processing of personal data when using our online presences. This online privacy policy therefore applies to our website [www.softomation.de](http://www.softomation.de/) as well as to our profiles on social networks.

Personal data means all data that can be related to you personally, e.g. name, address, email, IP address or user behavior.

With regard to the terms used, such as “processing,” “controller,” or “data subject,” reference is made to the definitions in Art. 4 GDPR. In particular, the following applies there:

“Personal data” means any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (Art. 4 No. 1 GDPR).

“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4 No. 2 GDPR).

“Controller” (or “controller entity”) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4 No. 7 GDPR).

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller (Art. 4 No. 8 GDPR).

In particular, the terms “processing” and “personal data” are very broad, so that almost any handling of data can be understood to fall under them.

**II. Who is the controller?**

We are responsible for the processing of your data:

Softomation GmbH

Siegener Straße 457

57258 Freudenberg

Email: [info@softomation.de](mailto:info@softomation.de)

Managing Director: Dipl.-Ing. Mohamed Salah

Commercial Register: Amtsgericht Siegen Registration Number: HRB 14317

**III. How can you reach our data protection officer?**

*We are not legally obliged to appoint a data protection officer. For questions regarding the processing of your data, you can contact us at any time (contact details above).*

**IV. Who is affected by the data processing?**

If, for example, you visit our website as an interested party, customer, supplier, service provider, or other visitor, the processing of your personal data will be carried out within the framework of the legal provisions and this statement. All visitors to our website are summarized under the term “users.”

**V. What data do we collect from you and for what purposes and on what legal basis do we process them?**

If you visit our website without registering or otherwise transmitting information to us, only those personal data that your browser transmits to our server are processed. To our knowledge, the following data are then processed, which are technically necessary in order to display our website and to ensure its stability and security:

– IP address of the requesting computer

– Date and time of the request

– Name and URL of the retrieved file

– Access status / HTTP status code

– Amount of data transferred

– Website from which the request comes (referrer URL)

– Browser used

– Operating system

The processing of these data in so-called log files is necessary to display our website and to ensure stability and security.

If you also transmit personal data to us, e.g. in the context of an inquiry by email or via our contact form, we will additionally process—depending on your details—the following data:

– Inventory data (e.g. name, address)

– Contact data (e.g. email address, telephone number)

– Content data (e.g. text entries, photos, videos)

– Usage data (e.g. pages visited, access times)

– Communication / metadata (e.g. device information, IP addresses)

We may also process the following personal data for the purposes of providing contractual services, service and customer care, as well as marketing / advertising:

– Contract data (e.g. subject matter of the contract, term, customer number)

– Payment data (e.g. bank details, payment history)

We process your personal data during your visit to our website for the following purposes:

– Providing the functions and content of our online offering

– Ensuring a smooth connection to our website

– Ensuring a comfortable use of our website

– Analysis and ensuring system security and stability as well as general security measures

– Answering any contact requests and communicating with you

– Other administrative purposes

– Provision of contractual services

– Customer service

Unless we specify a special legal basis within this privacy policy, the following applies to the processing of your personal data: The legal basis for obtaining consent arises from Art. 6(1)(a), Art. 7 GDPR. The legal basis for data processing to fulfill our services and to carry out (pre-)contractual measures as well as to answer any inquiries is Art. 6(1)(b) GDPR. For data processing to fulfill legal obligations, Art. 6(1)(c) GDPR is the legal basis. If processing is necessary to protect the vital interests of the data subject or another natural person, the legal basis arises from Art. 6(1)(d) GDPR. Data processing to safeguard our legitimate interests is based on Art. 6(1)(f) GDPR. Our legitimate interest follows from the aforementioned purposes of data collection.

If, in the course of processing your personal data, we disclose them to third parties, transmit them to such parties or otherwise grant them access to the data, this is done exclusively on the basis of a legal permission, insofar as you have consented to it, we are legally obliged to do so, or on the basis of our legitimate interests. A legal permission exists in particular if the transfer of data is necessary for the fulfillment of contractual obligations (e.g. to payment or shipping service providers). A legitimate interest may then exist if we use data for direct advertising or to prevent fraud, or also if you are our customer. A legitimate interest may also exist, for example, when using web or email hosts, cloud providers, or other service providers. Such service providers often act as processors on the basis of an appropriate contract. They are also obliged to comply with data protection requirements and to ensure this contractually. The legal basis for such processing agreements is Art. 28 GDPR.

**VI. To whom do we transmit your data?**

We regularly work with the following recipients in particular:

– Email host

– Web host

We carefully select external service providers. In the case of processing relationships (Art. 28 GDPR), these companies are contractually bound to our instructions and are regularly monitored by us. Further information can be found in the descriptions of the individual services below.

**VII. Will your data be transferred to entities outside the EU?**

A transfer of your personal data to third countries (i.e. outside the EU or the EEA) or to an international organization is only provided for in exceptional cases. Further information can be found in the descriptions of the individual services below.

If we process your personal data in a third country or have them processed by third parties, this is done only if it is necessary to fulfill our (pre-)contractual obligations or on the basis of your consent, a legal obligation, or our legitimate interests. Your personal data will only be processed in a third country if the special requirements of Art. 44 et seq. GDPR are met, unless there are statutory or contractual permissions in individual cases. This means that data processing is carried out, for example, on the basis of special safeguards, such as the officially recognized determination of a level of data protection corresponding to that of the European Union or compliance with specific, recognized contractual obligations (in particular the so-called “EU Standard Contractual Clauses”).

**VIII. How long do we process your data?**

The duration of the storage of your personal data is regularly determined by existing statutory retention periods (e.g. under commercial or tax law). Unless otherwise stated below, your personal data will be routinely deleted after the expiry of any applicable period, provided that they are no longer required for the fulfillment of the contract or the initiation of a contract, we no longer have a legitimate interest in further storage, and/or if you have not consented to storage beyond this.

In Germany, special retention periods exist, among others, in the following areas:

– under commercial law (6 years, e.g. for opening balance sheets, annual financial statements, accounting records, etc.)

– under tax law (10 years for all documents relevant to tax law)

– under the General Equal Treatment Act (AGG) (6 months for documents of rejected applicants)

**IX. What are your rights?**

With regard to the processing of your personal data, you have the right vis-à-vis us to…

– request information about your personal data processed by us. In particular, you can obtain information about the purposes of processing, the category of personal data, the categories of recipients to whom your data have been disclosed or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if they were not collected from you, and the existence of automated decision-making including profiling and, if applicable, meaningful information about its details (Art. 15 GDPR);

– demand the immediate rectification of inaccurate personal data concerning you or the completion of your personal data stored by us (Art. 16 GDPR);

– demand the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims (Art. 17 GDPR);

– demand the restriction of processing of your personal data, where the accuracy of the data is contested by you, the processing is unlawful and you oppose the erasure of the personal data and we no longer need the data, but you require them for the establishment, exercise, or defense of legal claims, or you have objected to processing pursuant to Art. 21 GDPR (Art. 18 GDPR);

– receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format or request the transfer to another controller (data portability, Art. 20 GDPR);

– not be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR);

– lodge a complaint with a supervisory authority (Art. 77 GDPR);

– object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f); this also applies to profiling based on those provisions (Art. 21 GDPR);

– withdraw your consent at any time. This has the consequence that we may no longer continue the data processing that was based on this consent for the future (Art. 7(3) GDPR).

The last three rights are explained in more detail below.

**X. When and how can you object to data processing?**

If your personal data are processed on the basis of legitimate interests pursuant to Art. 6(1) sentence 1 lit. f GDPR or for direct marketing and/or profiling, you have the right to object to data processing at any time. This then has the consequence that we may no longer continue the processing of your personal data for the future, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

However, the right to object applies only insofar as there are reasons arising from your particular situation or if your objection is directed against direct marketing. In the latter case, you have a general right to object, which will be implemented by us without the need to state a particular situation.

If you wish to exercise your right to object, a message to us (contact details above) is sufficient.

**XI. When and how can you withdraw your consent?**

You can withdraw any consent given to us at any time. This then has the consequence that we may no longer continue the processing of your personal data, which was based on this consent, for the future.

If you wish to exercise your right of withdrawal, a message to us (contact details above) is sufficient.

**XII. Where can you lodge a complaint?**

With regard to the processing of your personal data by us, you have the right to lodge a complaint with a data protection supervisory authority. A list of the state data protection supervisory authorities can be found, for example, at the following address: [www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html](http://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html)

**XIII. When and why is the provision of your data necessary?**

When using our contact form or when making inquiries by email, you provide us with your personal data (e.g. name, address, or email address).

The provision of your personal data is partially required by law (e.g. by provisions of tax law). It may also be necessary for the performance of (pre-)contractual measures. Failure to provide your personal data would mean that the contract with you could not be concluded or that your inquiry could not be answered.

For the performance of contracts or pre-contractual measures or for communication with us, the provision of the following data is mandatory:

– First and last name

– Address

– Email address

– if applicable, customer data (e.g. customer number)

– Text entries

– if applicable, telephone number (e.g. for queries or answering customer inquiries)

Unless otherwise stated in this privacy policy, all other information is voluntary.

**XIV. Does automated decision-making (e.g. profiling) take place?**

No, automated decision-making including profiling does not take place.

**XV. How can you contact us?**

You can contact us either by post or by email (see above).

If, for example, you contact us by email or via our contact form, we automatically store the personal data you voluntarily submit to us for the purpose of processing your inquiry or contacting you. This data is not passed on to third parties.

**XVI. How do we secure our website?**

Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR). These measures include, in particular, safeguarding the confidentiality, integrity, and availability of data. In addition, we have established business processes that ensure, in particular, the protection of data subjects’ rights, the deletion of data, and the response to data breaches. Furthermore, we observe the principles of data protection law, including data protection by design and by default (Art. 25 GDPR).

On our website, we use encrypted transmission via an SSL certificate for security reasons and to protect the transmission of your personal data as well as other confidential content. You can recognize this by the fact that “https” (instead of “http”) as well as a lock symbol and a different color display appear in your browser’s address bar.

**XVII. What are cookies and how do we use them?**

We use so-called cookies on our website. These are small files that contain text information and are stored by your browser and placed on your device.

So-called transient (or temporary) cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These store a specific identifier (the so-called session ID), which allows your device to be recognized when you return to our website. This can be used, for example, to store the contents of a virtual shopping cart in an online shop or the login status. Session cookies are deleted when you log out or close the browser.

So-called persistent (or permanent) cookies are automatically deleted after a certain period of time; depending on the cookie, the storage duration varies. This can be used, for example, to store user information for reach measurement and/or marketing purposes or a login status for a longer period of time.

For both temporary and permanent cookies, a distinction must be made between so-called first-party cookies and third-party cookies. The former are set by the controller, the latter by third-party providers.

You can delete cookies at any time via your browser’s security settings or, for example, refuse to accept third-party cookies. If you wish to object in general to the use of cookies used for online marketing purposes, you can do so with various services or providers, e.g. via the American page [www.aboutads.info/choices](http://www.aboutads.info/choices) or the European page [www.youronlinechoices.com](http://www.youronlinechoices.com/).

Please note that you may then not be able to use all functions of our website.

On our website, we may use temporary or permanent cookies, as well as first-party and third-party cookies, e.g. to identify you for subsequent visits if you have an account with us (otherwise you would have to log in again for each visit). You will find further information on this in our privacy policy below.

We currently only use cookies that are technically necessary to provide our offering (e.g. to store the login status). The legal basis for the use of cookies is Art. 6(1) sentence 1 lit. f GDPR. If other, technically non-essential cookies are used, we obtain your consent for this (Art. 6(1) sentence 1 lit. a GDPR).

**XVIII. What about our profiles on social networks?**

We operate the profiles listed below on social networks in order to get in touch with users active there and to inform them about our services. When accessing the respective networks, the terms and conditions and privacy notices of the respective operators apply. Unless otherwise stated in our privacy policy, we process users’ data only if they contact us within the social networks, e.g. by posting on our profile pages or by sending us messages.

Our social media profiles:

*LinkedIn*