We process the personal data of our users, in principle, only to the extent of what is necessary to provide a functional website as well as our contents and services. The processing of the personal data of our users takes place regularly only with the consent of the user. An exception in such cases is when prior consent is not possible for factual reasons and the processing of the data is permitted by legal provisions.

Moreover, we will collect personal data (e.g. e-mail address, name, phone number and company) within the operation of our websites only if you make such data available (e.g. if you register for a newsletter on our homepage, use our contact form, leave a comment, register on our Community Portal, register on our ticket system PARTconcept for support enquiries or provide contact details in the settings of our apps) and if we have the authorization to do so with your consent or on the basis of a legal regulation for processing and use. Information required to render a service is indicated accordingly, any other information is voluntary. We basically use such data for the purpose of which you provided us the data, e.g. to answer your inquiry, to process your inquiry or to provide you with access to certain information or offers..

Insofar as consent has been obtained by the person concerned to process personal data, Art. 6(1)(a) of the EU Data Protection Basic Regulation (GDPR) serves as the legal basis.

When processing personal data to fulfill a contract, the contracting party, which is the person concerned, Art. 6(1 lit)(b) of the GDPR serves as the legal basis.  This also applies to processing required for the execution of pre-contractual measures.

Insofar as the processing of personal data is necessary to meet a legal obligation which our company is subject to, Art. 6(1)(c) of the GDPR serves as the legal basis.

In case the vital interests of the person concerned or another natural person make the processing of personal data necessary, Art. 6(1)(d) of the GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or of a third party and outweigh the interests, fundamental rights and freedoms of the person concerned, then Art. 6(1 lit)(f) GDPR serves as the legal basis for the processing.  

The personal data of the person concerned will be deleted or blocked as soon as there is no longer a purpose for the storage. Storage can also take place if provided for by European or national legislators in regulations, laws or other provisions the responsible party is subject to. Blocking or deletion of the data shall also take place when the mandatory storage period by the aforementioned standards expires.

Whenever our website is called up, our system records data and information automatically from the system of the calling computer.

The following data is collected:

• IP address
• date and time of the request  
• time zone difference to Greenwich Mean Time
• content of the request
• access Status/https-status code
• the transferred data volume
• website from which the request comes
• browser,
• the operating system and its interface
• language and version

The data is also stored in the log files of our system. The information is stored in the log files of our system solely for the purposes of the technical administration of our website. This data will not stored together with other personal data of the user, neither transferred to third parties.

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the IP address of the user must be stored for the length of the session.

Storage in log files takes place to ensure the functionality of the website. The data also serves to optimize the website and to ensure the security of our information system. An evaluation of the data for marketing purposes does not take place in this regard.

Our legitimate interest in data processing is for these purposes in accordance with Art. 6(1)(f) GDPR.

The data will be deleted as soon as the purpose of the data's collection is no longer necessary. Collecting the data to be provided to the website will end with each session.   

In case the storage of IP addresses in log files takes place:

If the data is stored in log files, this will be for the duration of seven days at the most. Storage beyond that point is possible. In which case the IP addresses of the users are deleted or distorted to prevent attributing to the requesting client.

The collecting of data for the website and the storing of data in log files are essential to operate the website. Therefore the user has no possibility to object.

Consent with ConsentManager

Our website uses the ConsentManager consent technology to obtain your consent to the storage of certain cookies on your device or for the use of certain technologies and data protection legislation compliant documentation of the former. The party offering this technology is Jaohawi AB, Håltegelvägen 1b, 72348 Västerås, Sweden, website: https://www.consentmanager.de (hereinafter referred to as “ConsentManager”).

Whenever you visit our website, a connection to ConsentManager’s servers will be established to obtain your consent and other declarations regarding the use of cookies.

Moreover, ConsentManager shall store a cookie in your browser to be able to allocate your declaration(s) of consent or any revocations of the former. The data that are recorded in this manner shall be stored until you ask us to eradicate them, delete the ConsentManager cookie or until the purpose for archiving the data no longer exists. This shall be without prejudice to any mandatory legal retention periods.

ConsentManager uses cookies to obtain the declarations of consent mandated by law. The legal basis for the use of such cookies is Art. 6(1)(c) GDPR.

On various occasions, cookies are used on our apps and websites in order to provide you with targeted information and to store your search settings. Cookies are small text files sent to your PC or end device from our web and normally stored on your hard drive for the browser you use. Cookies cannot run any programs nor transfer viruses onto your computer, but serve only to provide us the information needed to make your visit to our website easier and more effective.  A cookie contains a character string which enables the clear identification of the browser whenever the website is visited again. If you have an account on any of our websites, we use cookies to identify you for subsequent visits, otherwise you would have to make a new login with each visit. The stored information is saved separately from any other data that might have been provided to us. In particular, the data of cookies will not be linked with any of your additional data.

Our websites use cookies to the following extent:

(1) Session IDs

(2) persistent Cookies

(3) Third-Party-Cookies

Session IDs allow the various requests by your browser to be assigned to a common session, so that your computer will be recognized when you return to the website.

We also use cookies on our website to enable an analysis of the user's surfing behavior, in case that you have declared your consensus.

In this respect, especially the following data can be transferred:

(1) Language settings

(2) Log-in Information: User Name, Password encrypted if user selects Option "remember my Login data"

(3) Session IDs

We also use cookies on our website to enable an analysis of the user's surfing behavior.

In this respect, especially the following data can be transferred:

(1) Search terms entered

(2) Frequency of page views

(3) Utilization of website functions

User data collected in this manner are pseudonymized through technical precautions. Therefore the user visiting the website cannot be identified. The data will not be stored together with other personal data.

When calling up our website, an info banner lets the users know that cookies are used for necessary technical purposes. We also ask for consensus for the purpose of analysis. The users are referred to this data protection declaration and to the opt-out regarding the consensus for analysis cookies. It will also be pointed out that the storing of cookies can be prevented in the browser settings.

The legal basis for the processing of personal data with the use of cookies is Art.6(1)(f) GDPR for technical necessary cookies and Art. 6(1)(a) GDPR for the analysis cookies.

The reason for using technically necessary cookies is to simplify the use of websites for the users. Some of the functions of our website cannot be offered without the use of cookies. For those, it is necessary that the browser can also be recognized after a page change.

The user data collected by technically necessary cookies will not be used to create user profiles.

The use of analysis cookies serve the purpose of improving the quality of our website and its contents. The analysis cookies show us how our website is used and help us to constantly optimize our offer.

Cookies are stored on the user's computer and from there transferred to our page. It follows that you as the user have the complete control over the use of cookies. By changing your settings in your Internet browser, you can deactivate or limit the transfer of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. The deactivating of cookies for our website can possibly lead to a restricted use of all of the website's functions.

The session IDs are then deleted when you log out or close the browser. Persistent cookies will be deleted automatically after a specified time, which can vary depending on the cookie.

A detailed overview including further information about the used cookies, session and local storage entries can be found in our Cookie Policy.

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

The Google Tag Manager is a tool that allows us to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, does not store cookies, and does not carry out any independent analyses. It only manages and runs the tools integrated via it. However, the Google Tag Manager does collect your IP address, which may also be transferred to Google’s parent company in the United States.

The Google Tag Manager is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the quick and uncomplicated integration and administration of various tools on his website. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5780

This website uses functions of the web analysis service Google Analytics. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior patterns of website visitors. To that end, the website operator receives a variety of user data, such as pages accessed, time spent on the page, the utilized operating system and the user’s origin. This data is summarized in a user-ID and assigned to the respective end device of the website visitor.

Furthermore, Google Analytics allows us to record your mouse and scroll movements and clicks, among other things. Google Analytics uses various modeling approaches to augment the collected data sets and uses machine learning technologies in data analysis.

Google Analytics uses technologies that make the recognition of the user for the purpose of analyzing the user behavior patterns (e.g., cookies or device fingerprinting). The website use information recorded by Google is, as a rule transferred to a Google server in the United States, where it is stored.

The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5780

IP anonymization
Google Analytics IP anonymization is active. As a result, your IP address will be abbreviated by Google within the member states of the European Union or in other states that have ratified the Convention on the European Economic Area prior to its transmission to the United States. The full IP address will be transmitted to one of Google’s servers in the United States and abbreviated there only in exceptional cases. On behalf of the operator of this website, Google shall use this information to analyze your use of this website to generate reports on website activities and to render other services to the operator of this website that are related to the use of the website and the Internet. The IP address transmitted in conjunction with Google Analytics from your browser shall not be merged with other data in Google’s possession.

This website uses Google Conversion Tracking. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the assistance of Google Conversion Tracking, we are in a position to recognize whether the user has completed certain actions. For instance, we can analyze how frequently which buttons on our website have been clicked and which products are reviewed or purchased with particular frequency. The purpose of this information is to compile conversion statistics. We learn how many users have clicked on our ads and which actions they have completed. We do not receive any information that would allow us to personally identify the users. Google as such uses cookies or comparable recognition technologies for identification purposes.

The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

For more information about Google Conversion Tracking, please review Google’s data protection policy at: https://policies.google.com/privacy?hl=en

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5780.

The website operator uses Google Ads. Google Ads is an online promotional program of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display ads in the Google search engine or on third-party websites, if the user enters certain search terms into Google (keyword targeting). It is also possible to place targeted ads based on the user data Google has in its possession (e.g., location data and interests; target group targeting). As the website operator, we can analyze these data quantitatively, for instance by analyzing which search terms resulted in the display of our ads and how many ads led to respective clicks.

The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5780

This website uses the Insight tag from LinkedIn. This service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Data processing by LinkedIn Insight tag
We use the LinkedIn Insight tag to obtain information about visitors to our website. Once a website visitor is registered with LinkedIn, we can analyze the key occupational data (e.g., career level, company size, country, location, industry, job title) of our website visitors to help us better target our site to the relevant audience. We can also use LinkedIn Insight tags to measure whether visitors to our websites make a purchase or perform other actions (conversion measurement). Conversion measurement can also be carried out across devices (e.g. from PC to tablet). LinkedIn Insight Tag also features a retargeting function that allows us to display targeted advertising to visitors to our website outside of the website. According to LinkedIn, no identification of the advertising addressee takes place.

LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser characteristics and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymized). The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data will then be deleted within 180 days.

The data collected by LinkedIn cannot be assigned by us as a website operator to specific individuals. LinkedIn will store the personal data collected from website visitors on its servers in the USA and use it for its own promotional activities. For details, please see LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.

Legal basis
If your approval (consent) has been obtained the use of the abovementioned service shall occur on the basis of Art. 6(1)(a) GDPR and § 25 TDDDG (German Telecommunications Act). Such consent may be revoked at any time. If your consent was not obtained, the use of the service will occur on the basis of Art. 6(1)(f) GDPR; the website operator has a legitimate interest in effective advertising promotions that include the utilization of social media.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5448.

Objection to the use of LinkedIn Insight Tag
You can object to LinkedIn’s analysis of user behavior and targeted advertising at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

In addition, LinkedIn members can control the use of their personal information for promotional purposes in the account settings. To prevent LinkedIn from linking information collected on our site to your LinkedIn account, you must log out of your LinkedIn account before you visit our site.

This website uses Clarity. The provider is the Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, https://docs.microsoft.com/en-us/clarity/ (hereinafter referred to as “Clarity”).

Clarity is a tool to analyze user patterns on this website. Clarity records in particular cursor movements and compiles graphics that show on which parts of the website users are scrolling with great frequency (heatmaps). Clarity can also record sessions so that we can watch the use of the site in the form of videos. Moreover, we receive information on the general user conduct within our website.

Clarity uses technologies that make it possible to recognize users for the purpose of analyzing user patterns (e.g., cookies or use of device fingerprinting). Your personal data will be archived on Microsoft servers (Microsoft Azure Cloud Service) in the United States.

If your approval (consent) has been obtained the use of the abovementioned service shall occur on the basis of Art. 6(1)(a) GDPR and § 25 TDDDG (German Telecommunications Act). Such consent may be revoked at any time. If your consent was not obtained, the use of the service will occur on the basis of Art. 6(1)(f) GDPR; the website operator has a legitimate interest in the effective analysis of user patterns.

For more details on Clarity’s data privacy policy, please see: https://docs.microsoft.com/en-us/clarity/faq.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzNaAAK&status=Active

This statement of data privacy applies only to our websites and their subpages. Our websites can also contain links to other providers not covered by this statement. If you leave our websites via a link, it is recommended to carefully read the data protection regulations of each website that collects personal data.

We have integrated buttons with graphics of Facebook, Linkedin and Youtube on our homepage so that you can find CADENAS on those social media platforms with one click. In the interest of the most extensive protection of your data, the buttons are only integrated as a link to the respective services. This assures that data transfer to any operator of the social network will not take place without previous activation on your part. After clicking the button, you will be forwarded to the provider and can then visit the pages of CADENAS on each of the platforms, find out about activities and topics around CADENAS, leave your comments and exchange ideas with others. Third-party pages are operated exclusively by the same. We neither have any influence on the data collected there and the data processing nor do we have any knowledge about the full extent of data collection, the purpose thereof as well as the storage periods. Information on the handling of your personal data when using those websites is available in the data protection regulations of the provider.

We have integrated YouTube videos into our websites, stored at http://www.YouTube.com and playable directly from our websites. These are all integrated in “extended data protection mode”, i.e. no data about you as a user will be transferred to YouTube when you are not playing any videos. Only when viewing videos YouTube, if need be, will store cookies on your computer and so-called  server log files, see 1, will be transferred. YouTube uses this data to collect information about the visitors of their website, i.a. for statistics, preventing fraud and improving usability. Also a connection with the Google DoubleClick network is established. Moreover, if you are logged into your YouTube account, YouTube can assign your surfing behavior directly to your personal profile. If this is against your wishes, we recommend that you log out of your YouTube account before playing the video. We have no influence on the said data transfer and collect no personal data with regard to the embedding of YouTube videos. Information about the handling of your personal data when using those websites is available in YouTube’s data protection policy: https://www.youtube.com/static?template=privacy_guidelines

The embedded YouTube videos are used in the framework of permitted use by YouTube, which all YouTube users must accept: https://www.youtube.com/t/terms. 

In case you notice any copyright violation, please report this directly to YouTube.

Google custom search engine „Google CSE“ Is the central search service on the CADENAS homepage. The integrated search service allows a full-text search for contents of the official Internet offer from CADENAS. For user information on the Internet offer, “search Google™ cadenas.de” is displayed in the search box. When the user enters a term in the search box, an additional link appears below the search box that refers to data protection when using the Google™ search.

After entering the search term in the search box, pressing enter or the search icon (magnifying glass), the user activates the search function and the search results page appears, which loads the Google search results by means of a plugin provided by Google.

The plugin, developed and provided by Google (Google Custom Search Engine, “Google CSE”), is integrated into the search results page by CADENAS as a software module “as is”(unchanged). The plugin enables automatic communication (data exchange) between the search results page and Google service, when the results page is called up. The use of Google’s search function includes a dynamic transfer of data to the search results page by the service provider Google.

In principle, no data is transferred to the provider of the search service (Google) when CADENAS websites are officially called up, where the "Google user-defined search" is integrated. Data is first transferred to Google after the user has activated the search box, a full-text search has started and the search results page is called up. When using the search function within the results page, user data is also sent to the Google server in the USA and stored there.

By using the full-text search and the accompanying search results page, you consent to the use of the Google search service as well as to the transfer of data to the Google service. This includes e.g. search terms you have entered and the IP address of the computer you are using. Please note that other standards of data protection apply for Google than for the Internet offer from CADENAS. We draw your attention to the fact that processing, in particular the storing, deleting and use of personal data possibly transmitted, is the matter of the provider of the search service and that CADENAS has no influence on the type and extent of the data transferred and further processed.

In its privacy policy Google commits itself not to pass on information to third parties,however, it makes exceptions from that. This means information could be transferred to third parties, if this is legally required in the US or if third parties process data for Google. If you are logged in to Google, the Google service is in the position to assign the information directly to your user profile. You should log out to prevent profile information about you from being collected.

Further information from Google Inc. about the handling of user data (data privacy policy) can be obtained here: http://www.google.com/policies/privacy/

On our websites and apps you can use the Google Maps service to see where CADENAS branch offices or a manufacturer is located on an interactive map. In doing so information about using CADENAS wesbites or apps, including your IP address is transferred to the Google server in the US and stored there.

In its privacy policy Google commits itself not to pass on information to third parties ,however, it makes exceptions from that. This means information could be transferred to third parties, if this is legally required in the US or if third parties process data for Google. You can find Google’s privacy policy here:  http://www.google.com/policies/privacy/

You have the option to switch off the card service and to prevent data transfer to Google. Simply deactivate JavaScript in your browser. In this case, you will no longer be able to use the location display.

We offer you the so-called “share function” on our websites. This can be used to share the contents of our websites, such as news or CAD models, with persons who you think would be interested, per e-mail and via Social Media Buttons (Facebook, Tumblr, Xing, Google Plus, Pinterest, WhatsApp,LinkedIn, Twitter).

In case you share contents via email, please be aware of the fact that you are responsible for the sent email and deemed to be Data Controller pursuant to the German Federal Data Protection Act. In the interest of the fullest protection possible for your data, the Buttons on our websites and in our apps are integrated only as a link to the respective services. This ensures that a data transfer does not take place to the operator of each social network without prior activation performed by you. After clicking onto the button without being logged into the social network, the login window of the selected social network will open in a new browser window and at the same time a cookie will be placed on your hard disk. If you click the button while being already logged into the social network, the network will be able to allocate your visit to your account on the social network. Websites of third parties are solely operated by them. We neither have any influence on the data collected and processed, nor do we know anything about the full extent of the data collection, the purposes as well as the storage limits. Information about the handling of your personal data when using those websites is available in the provider’s data protection policy.

Addresses of the respective providers and URL with their privacy notices:

a) Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA;
http://www.facebook.com/policy.php
further information on data collection: http://www.facebook.com/help/186325668085084

b) WhatsApp Inc., 650 Castro Street, Suite 120-219, Mountain View, California 94041, USA; https://www.whatsapp.com/legal/

c) Xing AG, Gänsemarkt 43, 20354 Hamburg, DE; http://www.xing.com/privacy.

d) Tumblr, Inc., 35 East 21st Street, 10E, New York, NY 10010, USA; https://www.tumblr.com/policy/en/privacy

e) Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland; http://www.google.com/policies/privacy/?hl=de

f) Pinterest Inc, 808 Brannan Street, San Francisco, California 94103, USA; https://about.pinterest.com/de/privacy-policy

g) LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy.

h) Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy?lang=de

i) YouTube LLC, 901 Cherry Ave., San Bruno, California 94066, USA; https://www.youtube.com/static?template=privacy_guidelines

We publically maintain accessible profiles in social networks. The social networks we use are detailed below. Social networks such as Facebook, Google+, etc. can, as a rule, analyse your user behavior comprehensively when you visit their website or a website with integrated social media contents (e.g. like- buttons or banners). When you visit our social media presence, numerous data protection processes are triggered. Specifically: When you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign the visit to your user account. Your personal data might also be collected even if you are not logged in or you do not have an account with the respective social media portal. In this case, data collection can take place via the cookies stored on your end device or by the collecting of your IP address. With the help of such data, the operators of social media portals can create user profiles that contain your preferences and interests. This way, interest-related advertising can be displayed for you in and outside of the respective social media presence. If you have an account with a certain social network, interest-related advertising can be displayed on all devices where you are or were logged in. Moreover, please note that we cannot trace all processing operations on the social media portals. Depending on the provider,  additional processing can be carried out by the operators of the social media portals. For details, see the terms of use and data protection regulations of the respective social media portal.

Our social media presence should be as comprehensive on the Internet as possible. This is a legitimate interest as set out in Art. 6 para. 1 lit. f DSGVO. The analyzing processes initiated by the social networks are possibly based on differing legal grounds, which must be stated by the operators of the social networks (e.g. Consent according to Art. 6 para. 1 lit. a DSGVO.

When you visit one of our social media presences (e.g. Facebook), we, together with the operators of the social media platform, are responsible for starting the data-processing operations for that visit. You can assert your rights (information, correction, deletion, limitation of the processing, data portability and complaints) in general against us as well as against the operator of the respective social media portal (e.g. against Facebook). Please note that, even though we share the responsibility with the operators of social media portals, we cannot entirely influence data processing operations of those social media portals. Our options primarily go by the company policy of each provider.

The data we collect directly from the social media presence are deleted as soon as they have served their purpose for being stored, if you request us to do so, if you revoke your consent to store the data or there is no longer any reason for the storage of your data.  Stored cookies remain on your end device till you delete them. Mandatory legal provision – esp. retention periods – remain unaffected. We have no influence on the storage period of your data, which are stored by the operators of the social networks for their own purposes. You can find out the details directly from the operators of the social networks (e.g. in their privacy statement, see below).  

- Facebook – We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter Meta). According to Meta’s statement the collected data will also be transferred to the USA and to other third-party countries.

You can customize your advertising settings independently in your user account. Click on the following link and log in: https://www.facebook.com/settings?tab=ads.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Details can be found in the Facebook privacy policy: https://www.facebook.com/about/privacy/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/4452

- X (formerly Twitter) We use the short message service X (formerly Twitter). The provider is the parent company X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Responsible for the data processing of individuals living outside the United States is the branch Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can customize your X (formerly Twitter) privacy settings in your user account. Click on the following link and log in: https://x.com/settings/account/personalization.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://gdpr.x.com/en/controller-to-controller-transfers.html.

For details, see the X (formerly Twitter) Privacy Policy: https://twitter.com/en/privacy.

- XING – We have a profile on XING. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. Details on their handling of your personal data can be found in the XING Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

- LinkedIn – We have a LinkedIn profile. The provider is the LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you want to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

For details on how they handle your personal information, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5448

- YouTube - We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on how they handle your personal data can be found in the YouTube privacy policy: https://policies.google.com/privacy?hl=en.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5780

1.1 Receipt of newsletter by registration

It is possible to subscribe to a free newsletter on our website. Data will be transferred to us from the input mask when registering for the newsletter. Shipping and administration takes place through CADENAS GmbH, a member of the CADENAS group.

Only your e-mail address is needed to have the newsletter sent to you. Further information , marked separately (e.g. title, first and last name) is voluntary and used solely for personalizing the newsletter. This data as well will be completely deleted in case of cancellation (see under VIII 4).

In addition, the following data is collected at registration;

(1) IP address of the requesting computer

(2) Date and time of registration

For the processing of the data, your consent will be obtained and this data protection declaration will be referred to during registration.

1.2 Receiving the newsletter due to the sale of goods or services

We use Mailingwork to send news, letters, invitations, statistics and system notifications. The provider is Mailingwork GmbH, Schönherrstraße 8, 09113 Chemnitz, Germany.

Mailingwork is a service that can be used to organize the sending of newsletters, among other things. Your data will be stored on Mailingwork's servers in Germany. With a revocation to datenschutz@fsf.de the data will also be deleted at Mailingwork.

To secure your data, we have concluded an order processing contract with Mailingwork in accordance with Art. 28 para. 3 GDPR. This contract ensures that your personal data, which we pass on to Mailingwork for processing, is protected in accordance with the provisions of the GDPR.

For more details, please refer to Mailingwork's privacy policy: https://mailingwork.de/datenschutz

1.1 Receipt of newsletter by registration

Legal basis for the processing of data, after the user registers for the newsletter, is the submitting of the user's consent Art. 6(1)(a) GDPR.

1.2 Receiving the newsletter due to the sale of goods or services

Legal basis for sending the newsletter as a result of the sale of goods or services ist § 7(3) UWG.

The collecting of the e-mail address and other voluntary information (e.g. title, first and last name) of the user serves to deliver the newsletter as well as to supply the newsletter text with a personal addressing by name.

The collecting of any other personal data during registration serves to prevent the misuse of services or the e-mail address used.

In order to ensure sufficient data security when transmitting masks and forms (e.g. the registration mask for our newsletter), we use the reCAPTCHA service of Google Inc. The service ensures that the input is made by a natural person and not by automated software (bot). When using the service, the IP address and possibly other data required by Google for the reCAPTCHA service are transmitted to Google. The deviating data protection regulations of Google Inc. apply here. Further information on the data protection guidelines of Google Inc. can be found at https://policies.google.com/privacy or https://www.google.com/intl/de/policies/privacy.

The data will be deleted as soon as the purpose of the data's collection is no longer necessary. The user's e-mail address will be stored for as long as the newsletter is subscribed to.

Any other personal data collected during registration will usually be deleted after a period of seven days.

We use the so-called double-opt in when registering for our newsletter. This means we will send you a confirmation e-mail to the e-mail address obtained from you, where you confirm your wish to receive the newsletter. If this is not confirmed within one (1) week, your registration will be automatically deleted.

The subscription to the newsletter can be cancelled by the user at any time. A link for this purpose is in every newsletter.

At this point, it is also possible to withdraw your consent to the storage of your personal data that was collected during registration.

For the newsletter registration, we use the so-called double-opt-in method. This means that we send a confirmation e-mail to your e-mail address and ask you to confirm your wish to receive our newsletter. You have a week’s time to confirm, otherwise your registration will be deleted automatically. As far as you confirm your wish to receive the newsletter, we will store your e-mail address until you unsubscribe the newsletter. The storage serves the purpose of sending you our newsletter on current topics about CADENAS. Required information for the sending of the newsletter is only your e-mail address. Any other information marked separately is voluntary and will be used to personalize the newsletter. Such data will also be deleted in case of cancellation.

We offer users on our website the option to register with their personal data to take part as a participant in our B2B PARTcommunity forum and to use services provided, e.g. the obtaining of CAD models, within this and, if necessary, other portals  solely for registered participants. The data will then be entered into an input mask, transferred to us and stored.

Our B2B PARTcommunity forum can be read without being registered. Provided you wish to use our B2B PARTcommunity portal to download CAD models, place postings in the community forum, comment on or like other postings or to participate in challenges, you can either use your login from a PARTcommunity manufacturer portal or you will have to register at PARTcommunity B2B. For the registration, we use the so-called double-opt-in process, i.e. your registration will be finalized only after you have confirmed by clicking on a link contained in an e-mail of confirmation sent to you for this purpose. In case your confirmation does not follow in a timely manner, your registration will be deleted automatically from our data base.

Moreover, we offer you the option to register for our service via Facebook Connect. More infos here.

The following details are collected during the registration process:

(1) E-mail address*
(2) Password*
(3) Confirm password*
(4) Time zone
(5) Language
(6) Enter verification code*
(7) Declaration of consent to the terms of use and the data privacy statement

Text suggestion after confirmation button: I hereby give my consent to the processing (collection, storage and use) of my personal data according to the data protection declaration and privacy notices that I have been made aware of. I have read the terms of use of the PARTcommunity forum and hereby give my consent as well.

Profile information
(8) First name*
(9) Last name*
(10) Company*
(11) Street*
(12) Postal code*
(13) City*
(14) Country*
(15) Select system environment CAD
(16) Select system environment PLM/ERP
(17) Select System Environment OTHER
(18) Website
(19) LinkedIn
(20) Facebook
(21) Skype
(22) Twitter
(23) Profile picture

Those marked with * are mandatory. Further personal data will only be collected only on a voluntary basis, such as for a request or registration.

During registration, the following data will also be stored:

(1) IP address of the user
(2) Date and time of registration

The user's consent to process such data will be obtained during registration and reference will be made to the regulations of the terms of use as well as the provisions of this data protection declaration and agreed on and legally binding for the duration of the user relationship.

Legal basis for the processing of data, after the user registers for the newsletter, is the submitting of the user's consent Art. 6(1)(a) GDPR.

If the registration serves to fulfill a contract of which the user is a party (e.g. use / license agreement for the providing and obtaining of CAD models) or the implementation of pre-contractual measures, the legal basis for the data processing  is also Art. 6(1)(b) GDPR.

Every access to our portal and every obtaining of CAD models will be recorded.  The storage serves internal system-related and statistical purposes. The following is recorded: Name of the accessed file, date and time of access, data volume transferred, report on successful access, web browser and requesting domain.

3.1 A registration of the user is necessary to hold specific contents and services ready on our website.

If you use our portal, we will store the data necessary to perform the contract. In addition, we will store the voluntary data you have provided for the duration of use of the portal, unless previously deleted. All information can be managed and modified in the protected customer area. Information given in the forum such as public postings, pinboard entries, friendships, private messages (we have no access to the latter) etc. will be stored so as to operate the forum.

If you use the portal, your data can be made accessible to other participants, depending on the contractual service. Your user name, your photo (if available) and your postings in public groups will be visible to non-members only if you have enabled the same. Moreover, for registered members the „user info“ is visible, which includes information on the type of your membership, visitors to your profile, friendships, the last time you placed a posting and since when you have been a member. In contrast, your entire profile containing the data you have released is visible to all members you have confirmed as personal contacts. If you make contents accessible to your personal contacts, but not by a private message service, the contents will be viewable to third parties, provided your personal contact has authorized a release. Insofar as you have placed postings in the public group, these will be viewable for all registered members of the portal. In the protected customer area, you can manage whatever information and postings you wish to release.

3.2 A registration of the user is necessary to fulfill a contract with the user or for the implementation of pre-contractual measures.

We require and process, in particular, your double-opt verified e-mail address to use as your mailing address for the delivery of ordered CAD models as well as proof of deliver for us to the respective manufacturer of the requested product catalog. We owe it to you and are obligated to the catalog manufacturer, in particular, your e-mail address and the information of the CAD model you obtained to transfer to the respective manufacturer of the requested product catalog so that he can run an invoice control of the delivery order and also contact you to inform you of faulty and/or updated CAD models.

If you register on the PARTcommunity portal of with a specific manufacturer or download CAD files from manufacturers, we pass on your personal data that you specified to execute the order. In addition, the catalog manufacturer will receive personal data such as your e-mail address and, if necessary, further contact details, if you have voluntarily provided him the same via the feedback function in order to leave feedback for the manufacturer portal or if you opt for a newsletter from the manufacturer, so that he can provide you a newsletter for certain information or offers. Insofar as you are put through to the manufacturers homepage, we recommend that you read the data protection provisions on the homepage of the manufacturer before providing your personal data, since this data protection declaration does not include other websites.

Other personal data processed for the obtaining of CAD models serves to prevent misuse in the providing of the CAD models (e.g. violation of the Fair Use Policy) and to ensure the safety of our information technology systems.

Further information about the handling of your data as a registered portal member in the PARTcommunity forum can be obtained here.

The data will be deleted as soon as the purpose of the data's collection is no longer necessary.

This is the case for the data collected during registration, if registration is withdrawn or amended on our website.

For data collected to perform a contract (e.g. agreement of use to provide and obtain CAD models) or for the implementation of pre-contractual measures, whenever the data is no longer necessary for the implementation of the contract. Also, after concluding a contract, it can become necessary to store the personal data of the contract partner in order to meet contractual or legal obligations.

We will process and store your personal data as long as needed to meet our contractual and legal obligations.

Moreover, we are subject to various retention and documentation obligations from, among other things, the commercial code (HGB) and the tax code (AO).  The specified deadlines for retention and documentation are usually six to ten years.

The storage period is finally assessed according to limitation periods which are usually three years in accordance to §§ 195 ff. of the Civil Code (BGB), but in certain cases can be up to thirty years, although the regular limitation period is three years.

Users have the option to cancel registration at any time. You can modify your stored data anytime.

You can delete and manage your account and change your information in the protected customer area.

If the data is necessary to perform a contract or to implement pre-contractual measures, a premature deletion of the data is only possible if not prevented by contractual or legal obligations (see  IX 9.).

There is a contact form on our website which can be used for electronic contacting. If the user takes advantage of it, the data entered into the input mask will be transferred to us and stored. The data consists of:

(1) E-mail address
(2) Your name
(3) Company
(4) Postal code
(5) Place

During registration, the following data will also be stored:

(6) Date and time of registration

For the processing of the data, your consent will be obtained and this data protection declaration will be referred to during registration.

As an alternative, contacting is also possible via the e-mail address provided. In this case, the user's personal data submitted with the e-mail will be stored.

In this context, no further data will be transferred to any third parties. The data will only be used to process the conversation.

Legal basis for the processing of data, after the user registers for the newsletter, is the submitting of the user's consent Art. 6(1)(a) GDPR.

Legal basis for the processing of data transferred by e-mail is Art. 6(1)(f) GDPR.  If e-mail contact is aimed for after concluding a contract, the legal basis for processing is also Art. 6(1)(b).

The processing of personal data from the input mask serves only for contacting. In case of contacting by e-mail, here is also a legitimate interest in the processing of the data.

To ensure your contact to the nearest CADENAS location, we will also transfer your data, if necessary, to a CADENAS branch office or subsidiary near you.

Any other personal data processed during dispatch serves to prevent misuse of the contact form and to ensure the safety of our information technology systems.

The data will be deleted as soon as the purpose of the data's collection is no longer necessary. This is the case when the conversation with the user is finished, for the personal data from the input mask of the contact form and the data has been sent by e-mail. The conversation is finished when it can be assumed that the matter has finally been clarified.

The additional personal data collected during dispatch will be deleted after a period of seven days.

The user can at any time withdraw his consent to the processing of his personal data. If the user contacts us by e-mail, he has the option to object to the storage of his personal data. In this case, the conversation can no longer continue.

You can  also submit the withdrawal of your consent and the objection to storage anytime in text form (e-mail).

In this case, all personal data that was stored in the course of contacting will be deleted.

If you make use of our apps, we will use your data to provide the product or service that you have selected. Necessary information will be transferred to the app store during the download, in particular

(1)   user name,
(2)   e-mail address 
(3)   customer number of your account,
(4)   time of download
(5)   payment information and  
(6)   the individual device number

We have no influence on this data collection and are not responsible for it. We process the data provided insofar as necessary to download the app onto your end device. Beyond that, your data will not be stored.

Legal basis for the processing of data, after the user registers for the newsletter, is the submitting of the user's consent Art. 6(1)(a) GDPR.

Legal basis for the processing of data transferred while using this app is Art. 6(1)(f) GDPR. If the use of the app serves the concluding of a contract (e.g. obtaining/download of CAD models), an additional legal basis for processing is Art. 6(1)(b) GDPR.

3.1 Download of CAD files

If you wish to receive the CAD files of manufacturers by e-mail, you can register in the app settings. Information required for downloading CAD models is marked accordingly, all other is voluntary.

If you request CAD models via our app by e-mail, we will store your data that is necessary to fulfill the contract. All information can be managed and changed in the protected customer area.

3.2 Use of your photos

Depending on the respective operating system of your end device, we ask for permission in a pop-up to use your photos while downloading or when you begin using the app. If you refuse, we will not use the data. It could be, however, that you then will not be able to use all the functions of the app. Later on, you can alway consent or withdraw permission in the settings of your operating system.

If you allow access, the app will access only the said data and transfer to our server, insofar as is necessary to render the functionality.

3.3 Collection of your location data

Our offer also includes so-called Location Based Services, with which we make you special offers tailored to your respective location.To offer you such functions of the app, we will collect your location data by means of GPS and your IP address in anonymized form, with your permission. You can allow or refuse this function at any time in the settings of your operating system. Your location will only be transferred to us whenever you use app functions that require us to know your location.

The data will be deleted as soon as the purpose of the data's collection is no longer necessary and no legal retention obligations exist.

Users have the option to cancel registration at any time. You can modify your stored data anytime.

You can delete and manage your account and change your information in the protected customer area.

If you process personal data, you are the person concerned pursuant to the GDPR. You have the following rights against the responsible party:

You can request a confirmation from the responsible party of whether your personal data is being processed by us.

If your data is being processed, you can request the following information from the responsible party:

1. the purpose of the processing of your personal data;
2. the categories of personal data being processed;
3. the recipients or categories of the recipients to which the said personal data have been or will be disclosed;
4. the expected storage period of your personal data or, in case concrete information is not available, criteria for the setting of the storage period;
5. the existence of a right to correction or deletion of your personal data, a right to the limitation of processing by the responsible party or a right of objection against the processing.
6. the existence of a right to appeal with a supervisory authority;
7. all available information about the origin of the data, if the personal data was not collected from the person concerned;
8. the existence of automatic decision making, including profiling as per Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved as well as the scope and the effects hoped for of such a processing for the person concerned.

You have the right to request information about whether your personal data will be transferred to a third country or an international organisation. In this connection, you can ask about the suitable guarantees as per Art. 46 GDPR relating to the transfer.

You have a right of correction and/or completion against the responsible party, insofar as your processed personal data is not correct or incomplete. The responsible party is to make adjustments immediately.

You can request a limitation of the processing of your personal data on the following conditions:

1. if you dispute the correctness of your personal data for a long enough period to allow the responsible party ample time to check the correctness of your personal data.
2. the processing is unlawful and you refuse the deletion of the personal data and request, instead, limiting the use of personal data;
3. the responsible party has no further need of the personal data, however you have need of the data for the establishment, exercise and defense of legal claims or
4. if you have objected to the processing as per Art. 21(1) GDPR and it is not yet sure if the responsible party's legitimate reasons outweigh your reasons.

If the processing of your personal data has been limited, such data – except for storage purposes – may only be processed with your consent or for the establishment, exercise or defense of legal claims or to protect the rights of another natural or legal entity or for reasons of an important public interest of the European Union or a member state.

If limitation was according to the above conditions, you will be informed before the limitation is removed.

a) Obligation to delete

You can request of the responsible party to delete your personal data immediately, and the responsible party is obligated to delete the data immediately, provided one of the following reasons apply:

1. Your personal data is no longer needed for the purposes the data was collected or otherwise processed.
2. You revoke your consent for the processing that was based on Art. 6 (1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing of your data.
3. As per Art. 21 (1) GDPR, you enter an objection against the processing and there are no other overriding legitimate reasons for the processing, or as per  Art. 21(2) GDPR, you enter an objection against the processing.
4. Your personal data was unlawfully processed.
5. The deletion of your personal data is to meet a legal obligation in accordance with European Union law or that of the member states, which the responsible party is subject to.
6. Your personal data was collected with regard to the services of the information society as per Art. 8(1) GDPR.

b) Information to third parties

If the responsible party made your personal data public and if he is obligated to delete your data according to Art. 17(1) GDPR, he is to take suitable measures, in consideration of available technology and the costs of implementation, also of a technical kind, to inform you that as the person concerned, the deletion of all links to the respective personal data has been requested, including copies or replications of the personal data.

c) Exceptions:

The right to have data deleted does not apply insofar as processing is necessary

1. to practise the right of freedom of opinion and information;
2. to meet a legal obligation that requires processing according to the law of the European Union or member states,which the responsible party is subject to, or for the performance of a task that is in the public's interest or the excercise of official authority that has been transferred to the responsible party.
3. for reasons of public interest in the area of public health as per Art.9(2)(h)(i) as well as Art. 9(3) GDPR.
4. for archive, scientific or historical research purposes in the public's interest in accordance with   Art. 89(1) GDPR, insofar as the right mentioned in Section a) renders the expected realization of the objectives of processing impossible or seriously affected, or
5. for the establishment, exercise or defense of legal claims.

If you have asserted the right of correction, deletion or limitation against the responsible party, he is obligated to inform all those recipients in possession of your personal data of the correction or deletion of the data or the limitation of processing, unless it proves to be impossible or involves disproportionate effort.

You have the right to be informed about those recipients by the responsible party.

You have the right to receive your personal data, which you provided to the responsible party, in a structured, conventional and machine-readable format. Moreover, you have the right to transfer the data to another responsible party without hindrance by the responsible party whom you provided with your personal data, as long as

1. the processing is based on consent according to Art.6(1)(a) GDPR or Art. 9(2)(a) GDPR or in a contract as per Art.6(1)(b) GDPR and
2. the processing takes place by means of automated processes.

In exercising this right, you also have the right to cause that your personal data be directly transferred from one responsible party to another, if technically possible.  The freedom and rights of other persons must not hereby be affected.

The right to data portability does not apply to a processing of personal data which is necessary to perform a task, which is in the public's interest or in exercising official authority transferred to the responsible party.

You have the right, for reasons stemming from your special situation, to object to the processing of your personal data, on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling supported by these provisions.

If you file an objection, the responsible party will no longer process your personal data unless he can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedom, or the processing serves the establishment, exercise or defense of legal claims.

You have the right to object at any time to the processing of your personal data for such advertising; this also applies to profiling, insofar as it is directly related to direct advertising.

If you object to the processing for purposes of direct advertising, we will no longer process your personal data for such purposes.

You have the option, relating to the use of services of the information society - regardless of Directive 2002/58/EC - to exercise your  right of objection by means of automated processing, where technical specifications are used.

You have the right to withdraw from your declaration of consent under data protection law at any time. After consent has been withdrawn, the legality of the processing done up to the time of the withdrawal remains unaffected.

You have the right not to be subject to a decison solely based on automated processing - profiling included – which has indirect legal effects for you or otherwise affect you adversely. This does not apply, if the decision

1. is necessary for the conclusion or fulfillment of a contract between you and the responsible party,
2. is permissible as per legal regulations of the European Union or member states, which the responsible party is subject to, and those legal regulationss contain appropriate measure to ensure you rights and freedoms as well as your legitimate interests or
3. is made with your expressed consent.

However, those decisions must not be based on special categories of personal data in accordance with Art. 9(1) GDPR, as far as Art. 9(2)(a) or (g) GDPR does not apply and suitable measures have been taken to protect the rights and freedoms as well as their legitimate interests.

In regards to (1) and (3) of the mentioned cases, the responsible party is to take suitable measures to ensure the rights and freedoms as well as their legitimate interests, which is to include at least the right to obtain the intervention of a person on the part of the responsible party, to present one's own point of view and to challenge the decision.

Irrespective of another administrative or judicial remedy, you have the right of appeal with a supervisory authority, in particular with the member state of your residence, your workplace or the place of the presumed infringement, if you are of the opinion that the processing of your personal data is in violation of the GDPR.

The supervisory authority, where you made your appeal, shall inform the complainant of the status and results of the appeal, including the possibility of a judicial remedy as per Art. 78 GDPR.

The competent supervisory authority for CADENAS Konstruktions-, Softwareentwicklungs- und Vertriebs GmbH is the Bavarian State Office for Data Protection Supervision.

We process personal data we receive in the course of our business relationship with our members or others concerned. In addition, we process – as far as necessary to render our services – personal data that we permissibly obtain from publicly accessible sources (e.g. press, Internet) or other third parties (e.g. manufacturers of product catalogs CAD models) from which we are entitled.

Relevant personal data consists of personal details (last name, first name, company address, company e-mail address and other contact details) and other data voluntarily provided by our members (e.g. profile photo). Moreover, the data can also come through the fulfillment of our contractual obligations (e.g. by download or e-mail related CAD model, number and time of the download and/or  e-mail), advertising and sales data (incl. advertising scores) as well as other data comparable with the above-mentioned categories.

We process personal data in accordance with the provisions of the basic EU data protection regulation (GDPR) and the Federal Data Protection Law (BDSG)

a. to meet contractual obligations (Art. 6(1)(b)  GDPR)

Data processing is done for the rendering of host services in the course of performing our contracts with our members or to take pre-contract measures as a result of requests. The purposes of data processing are oriented in the first place towards concrete database research and the resulting requesting and collecting of data (e.g. CAD models) and can include, among other things, the transferring of your data to the respective manufacturer of requested product catalogs due to our license agreements. For further details about data processing purposes, see the relevant contract documents as well as the terms and conditions of use.

b. in the course of balancing the interests of parties (Art. 6(1)(f)  GDPR)

We will process your data as needed beyond the fulfillment of the contract to safeguard our legitimate interests or those of third parties. Examples:

• Testing and optimizing of methods for a requirement analysis in order to address members directly.
• to satisfy legal claims and for defense in legal disputes,
• to safeguard IT security and the company's  IT operations,
• prevention and investigation of criminal offences
• Measures for business management and the further development of services and products,
• Risk management in the company.

c.subject to your consent (Art. 6(1)(a)  GDPR)

Insofar as you have consented to the processing of your personal data for certain purposes (e.g. the volunteering of your profile picture, newsletter, advertising or market and opinion research), the legality of that processing is given on the basis of your consent.  Your given consent can be withdrawn at anytime. This also applies to the withdrawal of consents which were given to us before the application of the GDPR, that is before 15th May 2018. The withdrawal of a consent applies to the future and has no affect on the legality of data processed up to the withdrawal.

The areas within the company which have access to your data if needed to meet our contractual and legal obligations. Services providers and agents we use for order processing can receive the data for that purpose, sofar as they observe data secrecy. Those are companies in the categories of IT services, logistics, print services, telecommunication, collection, consultation as well as sales and marketing.

Other data recipients can be those places for which you gave us your consent to transfer data or for those due to our contractual relationship with you and a third party who are authorized to transfer personal data within a balancing of interests. We are authorized to do so in meeting our contractual obligations (Art. 6(1)(b) GDPR) and, if necessary, in the course of a balancing of interests (Art. 6(1)(f) GDPR) to transfer your personal data (e.g. e-mail address and the information of the CAD model you obtained) to the respective manufacturer of the requested product catalog so that he can run an invoice control of the delivery order and also contact you to inform you of faulty and/or updated CAD models.

Moreover, we provide for each manufacturer of the product catalog requested statistics of usage behavior (e.g. number of downloads, sector, location). The manufacturer can process your data for advertising, marketing or opinion research as an independent person responsible i.S.d. DSGVO within his justified interests according to Art. 1 f DSGVO, provided you have not objected to the use of your data for these purposes. An objection in this case is to be made directly to the manufacturer

A data transfer to countries outside of the European Union (so-called third countries) will take place if

• it is necessary for the providing of CAD models from our database which have been ordered,
• it is prescribed by law (e.g. fiscal reporting obligations) or
• you have given us your consent.

In addition, a transfer to places in third countries is foreseen in the following cases:

• If necessary in individual cases, your personal data might be transferred to an IT provider in the USA or another third country to ensure the company's IT operations in compliance with the European level of data protection.
• CADENAS subsidiaries in third countries will receive your personal data only if they have obligated themselves to maintain a suitable level of data protection in EU standard contractual clauses.

We will process and store your personal data as long as needed to meet our contractual and legal obligations.

If the data is no longer needed to meet contractual or legal obligations, the data will be deleted at regular intervals, unless further processing, for a limited time, is necessary for the following purposes:

• Fulfillment of commercial and fiscal retention obligations resulting, for example, from: commercial code (HGB), tax code (AO). The specified deadlines for retention and documentation are usually six to ten years.
• Keeping of evidence according to the statute of limitations. As per §§ 195 of the Civil Code (BGB), statutes of limitation can be up to 30 years, although the regular statute of limitations is 3 years

Each person concerned has the right to information as per Article 15 GDPR, the right to correction as per Article 16 GDPR, the right to cancellation as per Article 17 GDPR, the right to limitation of processing as per Article 18 GDPR, the right to contradiction as per Article 21 GDPR as well as the right to data portability as per Article 20 GDPR. For the right to information and cancellation, the limitations as per §§ 34 and 35 BDSG apply. Moreover, there is a right of appeal to a responsible data protection supervisory authority (Article 77 GDPR in conjunction with § 19 BDSG).

Consent given for the processing of personal data can be revoked at anytime. This also applies to the withdrawal of consents which were given to us before the application of the GDPR, that is before 25th May 2018. Please note that the revocation becomes effective only for the future. Processings that took place before the revocation are not affected.

Detailed information about your data protection rights can be obtained from our general data protection declaration starting at chapter XIV.

Within the scope of our business relationship, you must provide personal data needed for the start, performing and end of a business relationship and to meet contractual obligations necessary thereby or if we are legally required to collect the data. Without the data, we will normally not be able to conclude, perform and end a contract with you. You conclude a use / license agreement when requesting CAD models on our portal.

When entering and implementing a  business relationship, in principle no fully-automated decision making is used as per Article 22 GDPR. Should we use such methods in individual cases, we will inform you of the same and separately about your rights, provided this is legally mandated.

We process your data in part automatically with the aim to evaluate certain personal aspects (profiling). We use profiling in the following cases:

• We use evaluation tools to be able to inform and give advice about products. They enable needs-based communication and advertising, including marketing and opinion research.

Case-by-case right of objection

You have the right, for reasons pertaining to your particular situation, to object at anytime to the processing of your personal data, which takes place based on Article 6(1)(e) GDPR (data processing in public interest) and Article 6(1)(f) GDPR (data processing for the balancing of interests); this also applies to supported profiling according to Article 4 No. 4 GDPR.

If you file an objection, we will no longer process your  personal data unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedom, or the processing serves the establishment,  exercise or defense of legal claims.

In individual cases, we will process your personal data to do direct advertising. You have the right to object at anytime to the processing of your personal data for such advertising; this also applies to profiling, insofar as it is related to direct advertising.

If you object to the processing for purposes of direct advertising, we will no longer process your personal data for such purposes.