Privacy policy
I. GENERAL INFORMATION
1. Responsible body and Data Protection Officer
The controller for this website (www.arnold.de) within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states of the European Union as well as other data protection regulations is
Arnold AG
Industriestrasse 6-10, 61381 Friedrichsdorf
Phone: +49 (0)6172 7650
E-Mail: datenschutzteam@arnold.de
The Data Protection Officer of Arnold AG can be contacted at the above address, for the attention of the Data Protection Officer, or by email at dsb.arnold@cortina-consult.de.
Below you will find information about the collection and processing of your personal data during or following your use of our website. Personal data are individual details about personal or factual circumstances of an identified or identifiable natural person, e.g. name, postal address, e-mail addresses, IP addresses, user behavior, etc.
2 Scope of the processing of personal data
We collect and process the personal data of our users only to the extent necessary to provide a functional website and our content and offers, as described below.
3 Legal basis for data processing
The processing of personal data is only lawful if there is a legal basis for the processing. The legal basis for processing may be in particular in accordance with Article 6(1)(a) - (f) GDPR:
- Consent pursuant to Article 6(1)(a) GDPR. Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
- Necessity for the performance of a contract or in order to take steps prior to entering into a contract pursuant to Article 6(1)(b) GDPR, i.e. the processing of your data is necessary for us to fulfill our contractual obligations towards you or to prepare the conclusion of a contract with you.
- Processing to fulfill legal obligations pursuant to Article 6 (1) (c) GDPR, i.e. processing of data is required by law or other regulations.
- Processing to protect the vital interests of the data subject in accordance with Article 6(1)(d) GDPR.
- Processing for the purposesof legitimate interests in accordance with Article 6(1)(f) GDPR, i.e. processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where the data subject is a child.
4. Rights of data subjects
You have a number of rights with regard to the processing of your personal data by us, about which we inform you in section III. at the end of this privacy policy.
5 Data erasure and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.
II. DATA PROCESSING ON OUR WEBSITE
1. Data collection when visiting the website
Each time our website is accessed, our systems automatically collect data and information from the computer system of the accessing computer:
a) Scope of data processing
When you visit our website, our web server collects and stores the following data
- The name of the requested file
- Information about the browser type and version used
- The user's operating system
- The IP address of the user
- The date and time of access
The data is stored in the log files of our system. This data is not stored together with other personal data of the user.
b) Legal basis
The legal basis for the processing of the data is Art. 6 para. 1 lit. f GDPR.
The legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR lies in the functionality of our website and its availability.
c) Purpose of the data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Other data is stored in order to ensure the functionality of the website. We also use the data to troubleshoot and optimize the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.
d) Duration of storage
The log files are deleted after one month at the latest, unless there is a need to retain the data for the aforementioned purpose due to specific events.
Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or anonymized so that it is no longer possible to assign them to a specific user.
e) Possibility of objection and removal
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.
2. Application
We offer users of our website the opportunity to apply online for jobs advertised by us ("online application").
For online applications, please note our Information obligations for applicants (m/f) of Arnold AGin accordance with Art. 13 and 14 GDPR.
3. Contact form
a) Scope of the data processing
We offer a contact form on our website for contacting us electronically. If you enter data in the input mask, it will be transmitted to us and stored. These data are: Your name, your e-mail address, your telephone number if applicable (optional) and your individual message to us. In addition, the date and time of your message is automatically recorded.
Alternatively, you can contact us via the e-mail address(es) provided at the beginning of this statement and on our website. In this case, the user's personal data transmitted with the email will be stored by us.
b) Legal basis
The legal basis for the processing of data transmitted in the course of sending an email to us is Art. 6 (1) (f). If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. The legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR lies in answering a customer inquiry or answering a contact inquiry on other topics.
c) Purpose of the data processing
The purpose of data storage is to make contact at the request of the website user.
d) Duration of storage
The data is stored for as long as is necessary to deal with the inquiry or any subsequent conversation. Insofar as these are commercial letters subject to retention under commercial and tax law, they will also be stored for the statutory retention period.
e) Right of objection and removal
The user has the option at any time to withdraw their consent to the processing of personal data or to object to its further use. If the user contacts us by e-mail, they can object to the storage of their personal data at any time. Deletion can only take place if there is no statutory retention period; in this case, however, the data will be blocked for any other use. In such a case, the conversation cannot be continued.
III. SOCIAL MEDIA
1. General Information
Arnold AG maintains the following corporate profiles:
When you visit or interact with our social media channels (for example, by clicking “like”), these platforms may analyse your behaviour extensively. Personal data is processed in this context: your visit can be linked to your account, logged, and potentially collected even if you are not logged in or do not have an account, for instance via cookies or your IP address. The platform operators may use your data to create a user profile and display targeted advertising both on and off the platform.
We cannot trace all the data processing carried out by the platforms. Further information can be found in their terms of use and privacy policies. As a general principle, Arnold AG shares responsibility with the respective platform for any processing triggered when visiting our profiles.
a) Data Subjects
Users of our social media profiles
b) Legal Basis and Purposes of Data Processing
Our social media profiles are used for targeted public relations, recruitment, and to provide information about Arnold. The legal basis for processing your data when interacting with our content is Article 6(1)(f) GDPR (legitimate interest).
c) Retention Period
Data directly collected on our social media profiles will be deleted as soon as you request it or the purpose for processing it no longer applies. Cookies remain on your device until you remove them. We have no influence over the retention period of data stored by the platform operators themselves. For details, please refer to the privacy policies of the respective networks.
2. Social Networks in Detail
a) Facebook und Instagram
We run profiles on Facebook and Instagram. These services are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).
For certain types of data processing linked to your use of our Facebook and Instagram pages, we and Meta share responsibility under a Controller Addendum. This agreement sets out which processing activities are handled by us and which are handled by Meta. You can view the agreement here: https://www.facebook.com/legal/terms/page_controller_addendum.
Data that Meta processes in connection with these platforms may be transferred to third countries, notably the United States. Meta relies on the EU-U.S. Data Privacy Framework or other appropriate safeguards for these transfers.
For all other data processing and the way your personal information is handled, Meta’s privacy policies for Facebook and Instagram apply:
- Facebook: https://www.facebook.com/about/privacy/
- Instagram: https://privacycenter.instagram.com/policy/
b) XING
We maintain a presence on the XING platform. The service is provided by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.
We process personal data when you, for example, comment on posts, share content, or contact us via XING messages.
For further information on XING’s data processing, the legal basis for such processing, and your rights in relation to XING, please see their privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.
c) LinkedIn
We operate a profile page (“Page”) on LinkedIn. The service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
For certain processing activities linked to “Page Insights”, we and LinkedIn act as joint controllers under Article 26 GDPR. LinkedIn provides us with aggregated statistics and analyses for our Page based on personal data of its visitors. We only receive aggregated information, which does not allow any individual visitor to be identified.
The allocation of data protection responsibilities between us and LinkedIn is set out in the “Page Insights Joint Controller Addendum”. The agreement can be viewed here: https://legal.linkedin.com/pages-joint-controller-addendum.
For more information on LinkedIn’s data processing, the legal basis for it, and your rights, please refer to LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.
d) YouTube
We run a profile on YouTube. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
For details on how YouTube handles your personal data, please refer to their privacy policy: https://policies.google.com/privacy?hl=de.
IV. RIGHTS OF THE DATA SUBJECT
1. Revocation of consent
If the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can contact us at datenschutzteam@arnold.de to exercise your right of withdrawal.
2. Right to confirmation
You have the right to request confirmation from the controller as to whether we are processing personal data concerning you. You can request confirmation at any time using the contact details above.
3. Right to information
If personal data concerning you is processed by us, you can request information about this personal data and the following information at any time:
a. the purposes of the processing;
b. the categories of personal data being processed;
c. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
d. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
f. the existence of the right to lodge a complaint with a supervisory authority;
g. where the personal data are not collected from the data subject, any available information as to their source;
h. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. We will provide a copy of the personal data that is the subject of the processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make the request electronically, the information shall be provided in a commonly used electronic format, unless it specifies otherwise. The right to receive a copy in accordance with paragraph 3 must not adversely affect the rights and freedoms of others.
4. Right to rectification
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
5. Right to erasure ("right to be forgotten")
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and we are obliged to erase personal data without undue delay where one of the following grounds applies:
a. The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
b. The data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing.
c. The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
d. The personal data have been unlawfully processed.
e. The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
f. The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject. g. The data subject objects to the processing. The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure ("right to be forgotten") does not exist insofar as the processing is necessary
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
- for the establishment, exercise or defense of legal claims.
6. Right to restriction of processing
You have the right to obtain from us restriction of processing of your personal data where one of the following applies
a. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
b. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; or
d. the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
Where processing has been restricted in accordance with the above conditions, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
To assert the right to restriction of processing, the data subject can contact us at any time using the contact details provided above.
7. Right to information
If you have asserted the right to rectification, erasure or restriction of processing of your personal data against us, we are obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed about these recipients.
8. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where
a. the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR and
b. the processing is carried out by automated means.
In exercising the right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability does not affect the right to erasure ("right to be forgotten"). This right does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
9. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
You have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you which is carried out for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
You can exercise your right to object at any time by contacting the respective controller.
10 Automated decisions in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:
a. is necessary for entering into, or performance of, a contract between the data subject and a data controller,
b. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or
c. is based on the data subject's explicit consent.
The controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
The data subject may exercise this right at any time by contacting the controller.
11. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The supervisory authority with which the complaint has been lodged shall inform the complainant (you) on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
