contalo

Privacy Policy

We are pleased that you are visiting our website. The protection and security of your personal information when using our website is very important to us. We would therefore like to inform you here about which of your personal data we collect when you visit our website and for what purposes it is used.

This privacy policy applies to the online services of SMF GmbH, which are accessible via the domain www.smf.de and its various subdomains (“our website”).

Who is responsible and how can I contact you?

Data Controller

for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR)

SMF GmbH
Paul-Henri-Spaak-Straße 5
44263 Dortmund

+49 231 9644-0
info@smf.de

Data Protection Officer

AGAD Service GmbH
Waldring 43-47
44789 Bochum
datenschutz@agad.de

What is this about?

This privacy policy fulfills the legal requirements regarding transparency in the processing of personal data. Personal data means all information relating to an identified or identifiable natural person. This includes, for example, information such as your name, age, address, telephone number, date of birth, email address, IP address, or user behavior when visiting a website. Information that cannot be linked to you personally, or only with disproportionate effort, for example through anonymization, is not personal data. The processing of personal data (such as collection, retrieval, use, storage, or disclosure) always requires a legal basis and a defined purpose.

Stored personal data will be deleted as soon as the purpose of processing has been fulfilled and there are no legitimate reasons for further retention. We inform you about specific retention periods or criteria in the individual processing activities. Regardless of this, we may store your personal data in individual cases for the assertion, exercise, or defense of legal claims and where statutory retention obligations apply.

Who receives my data?

We only disclose personal data processed on our website to third parties if this is necessary to fulfill the stated purposes and is covered by a legal basis in the individual case, for example consent or legitimate interests. In individual cases, personal data may also be disclosed if required for the assertion, exercise, or defense of legal claims. Possible recipients may include law enforcement authorities, lawyers, auditors, courts, etc.

Where we use service providers for operating our website who process personal data on our behalf in accordance with Art. 28 GDPR, these providers may receive your personal data. More detailed information on processors and web services can be found in the descriptions of the individual processing operations.

Do you use cookies?

Cookies are small text files that are sent to your browser during your visit to our website and stored on your device. Alternatively, information may also be stored in your browser’s local storage. Some functions of our website cannot be offered without cookies or local storage (technically necessary cookies). Other cookies allow us to carry out analyses so that, for example, we can recognize the browser you use when you revisit our website and transmit various information to us (non-essential cookies). Cookies help us make our website more user-friendly and effective, for example by understanding how you use our website and by storing your preferred settings such as country or language. If third parties process information via cookies, they collect the information directly through your browser. Cookies do not cause damage to your device. They cannot execute programs or contain viruses.

Information about the specific services for which we use cookies can be found in the individual processing descriptions. Detailed information on cookies used can be found in the cookie settings or consent manager of this website.

What rights do I have?

Under the GDPR, you have the following rights as a data subject:

Right of access under Art. 15 GDPR to data stored about you and details of the processing
Right to rectification pursuant to Art. 16 GDPR of inaccurate or incomplete data stored by us;
Right to erasure pursuant to Art. 17 GDPR of the data stored by us, insofar as the processing is not necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
Right to restriction of processing pursuant to Art. 18 GDPR, insofar as the accuracy of the data is contested, the processing is unlawful, we no longer need the data and you oppose its erasure because you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR;
Right to data portability pursuant to Art. 20 GDPR, insofar as you have provided us with personal data on the basis of consent pursuant to Art. 6(1)(a) GDPR or on the basis of a contract pursuant to Art. 6(1)(b) GDPR and such data has been processed by us using automated procedures. You will receive your data in a structured, commonly used, and machine-readable format, or we will transfer the data directly to another controller where technically feasible;
Right to object pursuant to Art. 21 GDPR to the processing of your personal data, insofar as such processing is based on Art. 6(1)(e) or (f) GDPR and there are reasons arising from your particular situation, or where the objection is directed against direct marketing. The right to object does not apply if compelling legitimate grounds for the processing can be demonstrated that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims. Where the right to object does not exist for individual processing operations, this is stated there;
Right to withdraw consent pursuant to Art. 7(3) GDPR, with effect for the future, in relation to any consent you have given;
Right to lodge a complaint pursuant to Art. 77 GDPR with a supervisory authority if you consider that the processing of your personal data violates the GDPR. As a rule, you may contact the supervisory authority at your usual place of residence, your place of work, or the registered office of our company.

How is my data processed in detail?

Below, we inform you about the individual processing operations, the scope and purpose of data processing, the legal basis, the obligation to provide your data, and the respective storage period. Automated decision-making in individual cases, including profiling, does not take place.

Provision of the Website

Type and Scope of Processing

When accessing and using our website, we collect the personal data that your browser automatically transmits to our server. The following information is temporarily stored in a so-called log file:

IP address of the requesting computer
Date and time of access
Name and URL of the retrieved file
Website from which access originates (referrer URL)
Browser used and, where applicable, the operating system of your computer, as well as the name of your access provider

Our website is not hosted by us directly, but by a service provider who processes the above-mentioned data on our behalf in accordance with Art. 28 GDPR.

Purpose and Legal Basis

Processing is carried out for the protection of our overriding legitimate interest in displaying our website and ensuring its security and stability on the basis of Art. 6(1)(f) GDPR. The collection of data and storage in log files is strictly necessary for the operation of the website. A right to object to this processing does not exist due to the exception under Art. 21(1) GDPR. Where further storage of log files is legally required, processing is carried out on the basis of Art. 6(1)(c) GDPR. There is no legal or contractual obligation to provide the data. However, accessing our website without providing this data is technically not possible.

Retention Period

The above-mentioned data is stored for the duration of the display of the website [and, for technical reasons, for a maximum of [7 days] beyond that].

Contact Form

Type and Scope of Processing

On our website, we offer you the opportunity to contact us via a provided form. The information collected through mandatory fields is required in order to process your inquiry. In addition, you may voluntarily provide further information that you consider necessary for handling your contact request.

When using the contact form, your personal data will not be passed on to third parties.

Purpose and Legal Basis

The processing of your data through the use of our contact form is carried out for the purpose of communication and handling your inquiry on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. If your inquiry relates to an existing contractual relationship with us, the processing is carried out for the purpose of contract fulfillment on the basis of Art. 6 para. 1 lit. b GDPR. There is no legal or contractual obligation to provide your data. However, processing your inquiry is not possible without providing the information requested in the mandatory fields. If you do not wish to provide this data, please contact us by other means.

Retention Period

If you use the contact form on the basis of your consent, we store the data collected for each inquiry for a period of three years, beginning with the completion of your request or until you withdraw your consent.

If you use the contact form within the framework of a contractual relationship, we store the data collected for each inquiry for a period of three years from the end of the contractual relationship.

Newsletter

Type and Scope of Processing

If you subscribe to receive our newsletter on our website, we collect your email address and store this information together with the date of registration and your IP address. Afterwards, you will receive an email in which you must confirm your subscription to the newsletter (double opt-in). If you do not confirm your subscription within 24 hours, it will automatically expire and the data will not be processed for newsletter distribution.

Purpose and Legal Basis

We process your data for the purpose of sending the newsletter on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. By unsubscribing from the newsletter, you may withdraw your consent at any time with future effect in accordance with Art. 7 para. 3 GDPR. There is no legal or contractual obligation to provide your data. However, sending the newsletter is not possible without providing your data.

Retention Period

After registering for the newsletter, we store the data for a maximum of 24 hours until the subscription is confirmed. After successful confirmation, we store your data until you withdraw your consent (unsubscribe from the newsletter).

Präsenzen auf Social-Media-Plattformen

We maintain so-called fan pages, accounts, or channels on the networks listed below in order to provide you with information and offers within social networks and to offer you additional ways to contact us and learn about our services. Below, we inform you about which data we process and which data the respective social network processes in connection with your access to and use of our fan pages/accounts.

Daten, die wir von Ihnen verarbeiten

If you wish to contact us via messenger or direct message through the respective social network, we generally process your username through which you contact us and, where necessary, store additional information you provide to the extent required to process and respond to your request.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller).

(Statistical) Usage Data We Receive from Social Networks

We receive automatically generated statistics regarding our accounts through insights functionalities. These statistics include, among other things, the total number of page views, likes, information on page activities and post interactions, reach, video views/impressions, as well as information on the proportion of men/women among our fans/followers.

The statistics contain only aggregated data that cannot be linked to individual persons. We are not able to identify individuals from this information.

What Data the Social Networks Process About You

You do not need to be a member of the respective social network in order to view the content of our fan pages or accounts. Therefore, no user account with the respective social network is required for this purpose.

Please note, however, that when accessing the respective social network, these platforms may also collect and store data from website visitors without a user account (for example technical data required to display the website) and may use cookies and similar technologies, over which we have no influence whatsoever. Further details can be found in the privacy policies of the respective social networks (see the corresponding links above).

If you wish to interact with content on our fan pages/accounts, for example by commenting on, sharing, or liking our posts, and/or if you wish to contact us via messenger functions, prior registration with the respective social network and the provision of personal data are required.

We have no influence over the data processing carried out by the social networks in connection with your use of their services. To the best of our knowledge, your data is processed in particular in connection with the provision of the services of the respective social network, as well as for the analysis of user behavior (using cookies, pixels, web beacons, and similar technologies). Based on this, advertising tailored to your interests may be displayed both within and outside the respective social network. It cannot be ruled out that your data may also be stored outside the EU/EEA and shared with third parties by the social networks.

Information regarding the exact scope and purposes of the processing of your personal data, retention periods/deletion, and policies regarding the use of cookies and similar technologies in connection with registration and use of the social networks can be found in the privacy policies/cookie policies of the respective providers. There you will also find information about your rights and options to object.

Facebook Page

When visiting our Facebook page, Facebook (Meta) collects, among other things, your IP address as well as additional information stored in the form of cookies on your device. This information is used to provide us, as the operator of the Facebook page, with statistical information about the use of our Facebook page. Further information is available from Facebook at: https://facebook.com/help/pages/insights.

Based on the statistical information provided, it is not possible for us to draw conclusions about individual users. We use this information solely to better understand the interests of our users, continuously improve our online presence, and maintain its quality.

We collect data through our fan page only to enable communication and interaction with us. This data generally includes your name, message content, comment content, and publicly available profile information provided by you.

The processing of your personal data for the above-mentioned purposes is based on our legitimate business and communication interest in providing an information and communication channel pursuant to Art. 6 para. 1 lit. f GDPR. If you, as a user, have given consent to the respective social network provider for data processing, the legal basis also extends to Art. 6 para. 1 lit. a GDPR in conjunction with Art. 7 GDPR.

As the actual data processing is carried out by the provider of the social network, our access to your data is limited. Only the provider of the social network has full access to your data. Therefore, only the provider can directly implement measures to fulfill your data subject rights, such as access requests, deletion requests, objections, etc. Exercising such rights is therefore most effective directly with the respective provider.

We are jointly responsible with Facebook for the personal content of the fan page. Data subject rights may be asserted with Meta Platforms Ireland Ltd. as well as with us.

According to the GDPR, Facebook bears primary responsibility for the processing of Insights data and fulfills all obligations under the GDPR with regard to the processing of Insights data. Meta Platforms Ireland Ltd. makes the essential contents of the Page Insights Addendum available to data subjects.

We do not make decisions regarding the processing of Insights data or the storage duration of cookies on user devices.

Further information can be found directly at Facebook (Page Controller Addendum): https://www.facebook.com/legal/terms/page_controller_addendum.

Further details regarding the scope and purposes of the processing of your personal data, retention/deletion periods, and policies on cookies and similar technologies can be found in Facebook’s privacy and cookie policies:
https://www.facebook.com/privacy/policy/?entry_point=data_policy_redire ct&entry=0
https://www.facebook.com/policies/cookies

Instagram Page

When visiting our Instagram page, Instagram collects, among other things, your IP address as well as additional information stored in the form of cookies on your device. This information is used to provide us, as the operator of the Instagram page, with statistical information about the use of our Instagram page. Further information is available from Instagram at: https://facebook.com/help/pages/insights.

We are jointly responsible with Instagram for the personal content of the fan page. Data subject rights may be asserted with Facebook Ireland as well as with us.

Primary responsibility for the processing of Insights data under the GDPR lies with Instagram, and Instagram fulfills all obligations under the GDPR with regard to the processing of Insights data. Facebook Ireland makes the essential contents of the Page Insights Addendum available to data subjects.

We do not make any decisions regarding the processing of Insights data or any other information arising under Art. 13 GDPR, including the legal basis, identity of the controller, and retention period of cookies on user devices.

Further information can be found directly at Instagram (supplementary agreement with Facebook): https://www.facebook.com/legal/terms/page_controller_addendum.

Twitter Page

Twitter is a social network of Twitter Inc., based in San Francisco, California, USA, which enables the creation of private profiles for natural persons (personal accounts) as well as professional profiles (professional accounts) for natural persons and companies. Via Twitter, users can, among other things, publish short messages (so-called “Tweets”), interact with the content of other users, for example by posting “Retweets”, liking posts, sharing posts, and replying when other users mention or tag them in content.

When using or visiting the network, and therefore also when visiting our Twitter account, Twitter automatically collects data from users or visitors during use or the visit, for example username and IP address. This is done with the help of tracking technologies, in particular through the use of cookies. Based on the data collected in this way, Twitter provides users with information, offers, and recommendations, among other things. This information is used to provide us, as the operator of our Twitter page, with statistical information about the use of the Twitter page. Further information can be found in Twitter’s privacy policy: https://twitter.com/privacy#twitter-privacy-1.

We are jointly responsible with Twitter for the personal content of the fan page. Data subject rights may be asserted with Meta Platforms Ireland Ltd. as well as with us.

According to the GDPR, Twitter bears primary responsibility for the processing of Insights data and fulfills all obligations under the GDPR with regard to the processing of Insights data. Meta Platforms Ireland Ltd. makes the essential contents of the Page Insights Addendum available to data subjects.

We do not make decisions regarding the processing of Insights data or the storage duration of cookies on user devices.

Further details regarding the scope and purposes of the processing of your personal data, retention/deletion periods, and policies on cookies and similar technologies can be found in Twitter´s privacy and cookie policies:
Privacy Policy https://twitter.com/privacy#twitter-privacy-1
Cookie Policy https://help.twitter.com/rules-and-pol icies/twitter-cookies

LinkedIn Page

LinkedIn is a social network of LinkedIn Inc., based in Sunnyvale, California, USA, which enables the creation of private as well as professional profiles for natural persons and company profiles. Users can maintain their existing contacts within the social network and establish new ones. Companies and other organizations can create profiles on which photos and other company information can be uploaded in order to present themselves as employers and recruit employees. Other LinkedIn users have access to this information and can write their own articles and share this content with others. The focus of the network is on professional exchange about specialist topics with people who have the same professional interests.

When using or visiting the network, LinkedIn automatically collects data from users or visitors during use or the visit, for example username, job title, and IP address. This is done with the help of various tracking technologies. Based on the data collected in this way, LinkedIn provides users with information, offers, and recommendations, among other things.

We are jointly responsible with LinkedIn for the personal data content of our company profile. Data subject rights can be asserted with LinkedIn Inc. as well as with us.

We do not make any decisions regarding the data collected on LinkedIn’s site by means of tracking technologies.

Further information about LinkedIn can be found at: https://about.linkedin.com.

Further information about data protection at LinkedIn can be found at: https://www.linkedin.com/legal/privacy-policy.

Further information about storage periods/deletion as well as guidelines on the use of cookies and similar technologies in connection with registration and use on LinkedIn can be found at: https://de.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy.

XING Page

XING is a social network of XING SE, based in Hamburg, Germany, which enables the creation of private and professional profiles. Users can maintain their existing contacts and establish new ones. Companies can create profiles on which photos and other company information can be uploaded. Other XING users have access to this information and can write their own articles and share this content with others.

The focus lies on professional exchange about specialist topics with people who have the same professional interests. In addition, XING is frequently used by companies and other organizations to recruit employees and present themselves as attractive employers.

Further information about XING can be found at: https://corporate.xing.com/de/unternehmen/

Further information about data protection at XING can be found at: http s://privacy.xing.com/de/datenschutzerklaerung.

We do not collect or process any personal data via our XING company page.

Google Analytics

Type and Scope of Processing

We use Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as an analytics service for the statistical evaluation of our online offering. This includes, for example, the number of visits to our online offering, visited subpages, and the length of time visitors stay on the website.

Google Analytics uses cookies and other browser technologies to analyze user behavior and recognize users.

This information is used, among other things, to compile reports on website activity.

Purpose and Legal Basis

The use of Google Analytics is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG.

Retention Period

The specific storage period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Analytics:

Google Tag Manager

Type and Scope of Processing

We use Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage website tags via an interface and enables us to precisely control the integration of services on our website.

This allows us to flexibly integrate additional services in order to evaluate user access to our website.

Purpose and Legal Basis

The use of Google Tag Manager is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG.

Retention Period

The specific storage period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Tag Manager:

Leadinfo

Type and Scope of Processing

We have integrated Leadinfo on our website. Leadinfo is a service of Leadinfo B.V., Crooswijksesingel 50, 3034 CJ Rotterdam, Netherlands, which identifies anonymous website visitors and provides complete contact details as well as insights into visitor history.

Leadinfo uses cookies and other browser technologies to analyze user behavior and recognize users.

Among other things, Leadinfo shows us which companies have visited our website, determines the course of your visit, including all pages visited and viewed by you, and the length of your stay on this website.

Leadinfo collects and processes company data such as company name, telephone number, address, website address, industry, company profile, turnover and key persons on LinkedIn.

Purpose and Legal Basis

The use of Leadinfo is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG.

Retention Period

The specific storage period of the processed data cannot be influenced by us, but is determined by LeadInfo B.V. Further information can be found in the privacy policy for Leadinfo:

Leadinfo CDN

Type and Scope of Processing

We use Leadinfo CDN for the proper provision of the content of our website. Leadinfo CDN is a service of LeadInfo B.V. which functions on our website as a Content Delivery Network (CDN).

A CDN helps to provide content of our online offering, especially files such as graphics or scripts, faster by means of regionally or internationally distributed servers. When you access this content, a connection is established to servers of LeadInfo B.V., Crooswijksesingel 50, 3034 CJ Rotterdam, Netherlands, whereby your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the above-mentioned purposes and for maintaining the security and functionality of Leadinfo CDN.

Purpose and Legal Basis

The use of the Content Delivery Network is based on our legitimate interests, namely the interest in secure and efficient provision as well as optimization of our online offering in accordance with Art. 6 para. 1 lit. f GDPR.

Retention Period

The specific storage period of the processed data cannot be influenced by us, but is determined by LeadInfo B.V. Further information can be found in the privacy policy for Leadinfo CDN:

LinkedIn

Type and Scope of Processing

We use the LinkedIn Insight Tag of LinkedIn Corporation, Sunnyvale, California, USA, in order to create target groups, segment visitor groups of our online offering, determine conversion rates and subsequently optimize them. This occurs in particular when you interact with advertisements that we have placed with LinkedIn Corporation. For this purpose, LinkedIn Corporation offers retargeting for website visitors in order to display targeted advertising outside our website.

The LinkedIn Insight Tag collects data about visits to our website, including URL, referrer URL, IP address, device and browser properties (user agent), as well as timestamp. This data is used to provide anonymized reports about the website audience and advertisement performance.

Purpose and Legal Basis

The use of the LinkedIn Insight Tag is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG.

We intend to transfer personal data to third countries outside the European Economic Area, in particular the USA. The transfer of data to the USA takes place pursuant to Art. 45 para. 1 GDPR on the basis of the adequacy decision of the European Commission. The participating US companies and/or their US subcontractors are certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF).

In cases where no adequacy decision of the European Commission exists, including US companies that are not certified under the EU-U.S. DPF, we have agreed other appropriate safeguards with the recipients of the data within the meaning of Art. 44 et seq. GDPR. Unless otherwise stated, these are the standard contractual clauses of the EU Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021. A copy of these standard contractual clauses can be viewed at: https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32021D0914&from=DE

In addition, before such a third-country transfer we obtain your consent pursuant to Art. 49 para. 1 sentence 1 lit. a GDPR, which you grant via the consent manager (or other forms, registrations, etc.). We point out that in the case of third-country transfers there may be risks unknown in detail, for example data processing by security authorities of the third country, the exact scope and consequences of which we do not know, over which we have no influence, and of which you may under certain circumstances not become aware.

Retention Period

The specific storage period of the processed data cannot be influenced by us, but is determined by LinkedIn Corporation. Further information can be found in the privacy policy for the LinkedIn Insight Tag: https://www.linkedin.com/legal/privacy-policy