The controller responsible for data processing in accordance with data protection law is:

 

GRENKE AG

Neuer Markt 2

76532 Baden-Baden

Phone: 07221 5007-0

Fax: 07221 5007-222

 

You can read our legal notice here.

 

If you have questions or suggestions related to data protection, please contact us.

 

You can contact our Data Privacy Officer at the following address:

 

GRENKE AG

Data Privacy Officer

Neuer Markt 2

76532 Baden-Baden

Email address: [email protected]

 

 

Data protection is the protection of personal data. This is all information that relates to an identified or identifiable natural person (called a data subject). This includes, for instance, information such as your name, mailing address, email address or phone number, as well as information that is required in order to use our website, such as information on the start, end and scope of usage and your IP address.

 

We process personal data in compliance with relevant data protection regulations. This means that your data is processed only if we have your consent to do so, or if we are permitted by law to process it. For instance, this is the case if the processing is required to carry out our contractual services (such as to process orders) or required by law, or carried out based on our legitimate interests in the sense of Art. 6 para. 1 lit. f) GDPR (such as our interest in analysing, optimising, and securely operating our website).

 

We implement state-of-the-art organisational, contractual and technical security measures in order to ensure that we comply with data protection law regulations, and to protect the data we process against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons.

In general, our website can be used without registration and without providing any personal data. However, personal data may be collected and processed through automated procedures even if you use our website only for informational purposes. The following section provides an overview of the type, scope, purposes and legal bases for data processing over our website.

 

 

3.1 Provision of our Webseite

 

When your device accesses our website, we collect and process the following data in server log files:

 

• Device used
• Name of the file accessed
• Date and time of access
• Time zone
• Transmitted volume of data
• Message whether access was successful
• Description of the type of web browser used
• Operating system used
• Previously visited website
• Provider
• IP address of the user

 

We process this data based on our legitimate interests in the sense of Art. 6 para. 1 lit. f) GDPR, namely in order to provide and display the website, to ensure and maintain technical operations, for the purpose of identifying and correcting faults and for security reasons (for instance to clarify cases of abuse or fraud). This data is processed automatically when you access our website. You cannot use our website without providing such data. We do not use this data for the purpose of determining your identity.

 

The collected data is generally deleted after 28 days, unless we need it for longer in exceptional cases, for the purposes indicated above. In such cases, we will promptly delete the data after this purpose no longer applies.

 

 

3.2 Cookies

 

In addition to the data indicated under clause 3.1, when you use our website we implement a variety of technical tools for different functions. In particular, these include cookies which may be saved on your device. When you access our website, you can choose whether to permit cookies to be saved – this can be changed later at any time. You can also choose the individual additional functions you would like to use. You can change these selections in your browser settings, or via our cookie banner.

 

 

a. Essential cookies for displaying our website

 

The technical design of the website requires that we use some technically necessary (essential) cookies. Without this technology, it would be impossible to display our website correctly, or impossible to provide support functions. You cannot deny these cookies if you would like to use our website. The legal basis for this processing is our legitimate interest in ensuring the function of the website, according to Art. 6 para. 1 lit. f) GDPR.

 

 

b. Optional cookies based on your consent

 

There are some categories of cookies which are saved only after you grant your consent to do so. You can select the cookies you would like to save when you visit our website using the cookie banner. These functions are activated only if you grant your consent, and may be used in particular to analyse traffic on our website and make improvements, to make it easier for you to use the website on different browsers or devices, to recognise you when you visit the page again or to show ads (including focusing ads based on your interests and measuring the effectiveness of advertisements). The legal basis for this processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You can revoke your consent at any time without affecting the permissibility of processing up to the time consent was revoked.

 

 

c. Use of a consent management platform (“cookie banner”)

 

Scope and purpose of processing: we use OneTrust on our website, a consent management platform (referred to in the following as “OneTrust”) from OneTrust Technology Limited, 82 St John St Farringdon London EC1M 4JN, United Kingdom. We use OneTrust in order to request consent for processing information regarding your device and for processing your personal data using cookies or other technologies. We process both personal data and device information using OneTrust for technical reasons, in particular your IP address, in order to display a cookie banner that conforms to the requirements of the GDPR.

 

Legal bases and management options: the legal basis for processing is Art. 6 para. 1 clause 1 lit. c) GDPR, if the processing is necessary to fulfil the statutory verification obligations for granting consent. In addition, we have a legitimate interest in providing an appealing, user-friendly cookie banner which conforms to the GDPR, in order to obtain corresponding consent from our users to save cookies and to process personal data.

 

Storage term: information regarding your settings is saved on your device. Your settings and personal data are deleted after 12 months, unless you delete information regarding your user settings in your browser before this time.

 

Recipients of data and further information: your data is also transmitted to OneTrust. We have concluded a processing agreement with OneTrust, under which we obligate the company as a service provider to protect your data, and not to transmit your data to third parties.

 

We are not able to exclude the possibility that your data may be transmitted to entities located outside of the European Union or other contracting states to the Agreement on the European Economic Area, or entities that process data outside of these territories. In such cases, it is ensured that data is transmitted either based on an adequacy decision from the European Commission or based on appropriate guarantees, such as standard contractual clauses. Further information on international data transmission to OneTrust is available at: https://www.onetrust.de/datenschutzerklaerung/#Internationale-Daten%C3%BCbermittlung

 

The OneTrust Data Privacy Declaration is available at: https://www.onetrust.de/datenschutzerklaerung/.

 

 

d. Overview of the cookies used on the website

 

An overview of the cookies we use on the website, which you can individually select or deny using the cookie consent tool, is available here.

 

We can further process information that we have obtained using cookies on our website. Additional details on this processing are provided in the corresponding sections of the following clauses 3.3 – 3.5.

 

 

3.3 Analytic services on our website

 

PIWIK Pro

Scope and purpose of processing: we use PIWIK Pro, a software program used for statistical analysis of user access. Your IP address is shortened before it is saved. PIWIK PRO uses cookies that are saved on your computer, and that make it possible to analyse your use of this website. Pseudonymised user profiles can be created from this processed data.

 

Legal bases and management options: data processing carried out using PIWIK Pro is completed based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR. If you do not want cookies to be stored on your device by PIWIK Pro, you can deny or revoke your consent using our cookie banner. In addition, you can deactivate the corresponding option in the system settings using your browser. You can delete saved cookies at any time using the system settings in your browser.

 

Storage term: we store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent.

 

Recipients of data and further information: the information collected on your use of our website is stored on behalf of PIWIK Pro on Microsoft Azure servers in the EU. We are not able to exclude the possibility that data may be transmitted to or accessed from the USA in every case. . In such cases, it is ensured that data is transmitted either based on an adequacy decision from the European Commission or based on appropriate guarantees, such as standard contractual clauses. Specifically, the hosting provider Microsoft has joined the EU-US Data Privacy Framework, which ensures compliance with the level of data protection established in Europe based on an adequacy decision of the European Commission.

 

Further information on the PIWIK Pro service is available on the manufacturer's website at https://piwikpro.de/datenschutz/.

 

 

3.4 Social media services on our website

 

 

a. Integration of YouTube videos

 

Scope and purpose of processing: we have integrated YouTube videos in our website. These are hosted by YouTube, but can be played directly from our website. These videos are all integrated in “expanded data protection mode”, meaning that, based on YouTube’s assertions, played videos are not used to personalise advertisements for the user. However, we have no influence over this process.

 

In order to increase protection for your data when you visit our website, the videos integrated into the website are deactivated as a default, via a so-called “2 click” solution. This approach ensures that no connection to Google's servers is created when you simply access a page of our website that contains such videos. You must activate the videos for your browser to create a direct connection to Google’s servers.

 

When you activate the video, YouTube receives the information that you accessed the corresponding page of our website. Basic data such as your IP address and a time stamp are also transmitted. This is the case regardless of whether you have or are logged into a YouTube user account. If you are logged into Google, your data is associated directly with your account. YouTube saves your data as a user profile, which it uses for the purposes of advertisement, market research, and/or designing its website in line with user needs. Such analysis is carried out in particular (even for users who are not logged in) in order to provide interest-based advertisements and inform other users of the social network about your activities on our website.

 

Legal bases and management options: The legal basis for displaying the videos is Art. 6 para. 1 lit. a) GDPR, meaning that they are integrated only based on your consent. If you do not want cookies to be stored on your device by YouTube, you can deny or revoke your consent.

 

If you do not want collected data to be associated with your YouTube profile, you must log out before activating the video. You also have the right to object to the creation of user profiles by YouTube, although you must contact YouTube and/or Google to exercise this right, for instance at: https://about.google/contact-google/. Complete instructions for managing your data in conjunction with Google products is available at: https://support.google.com/accounts/answer/3024190.

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent.

 

Data recipients and further information: The collected information is stored on Google’s servers, including in the USA. The provider has joined the EU-US Data Privacy Framework for this purpose, which ensures compliance with the level of data protection established in Europe based on an adequacy decision of the European Commission. We have also agreed to standard contractual clauses on data protection with YouTube. The purpose of these clauses is to ensure compliance with an appropriate level of data protection in third countries.

 

Further information on the purposes and scope of data collection and processing by YouTube is available in the Google Data Privacy Declaration. It also provides further information on your rights and optional settings to protect your privacy: www.google.de/intl/de/policies/privacy.

 

 

b. Integration of Google Maps

 

Scope and purpose of processing: We use the Google Maps service on this website. This allows us to display interactive maps to you directly on the website, and allows you to easily use the map function.

 

When the interactive map is displayed, Google receives the information that you accessed the corresponding page of our website. Basic data such as your IP address and a time stamp are also transmitted. This is the case regardless of whether you have or are logged into a Google user account. If you are logged into Google, your data is associated directly with your account. Google saves your data as a user profile, which it uses for the purposes of advertisement, market research, and/or designing its website in line with user needs. Such analysis is carried out in particular (even for users who are not logged in) in order to provide interest-based advertisements and inform other users of the social network about your activities on our website.

 

Legal bases and management options: The legal basis for displaying the interactive map is Art. 6 para. 1 lit. a) GDPR, meaning that the map is integrated only based on your consent. If you do not want your data to be transmitted to Google, you can deny or revoke your consent using our cookie banner. You can revoke your consent at any time without affecting the permissibility of processing up to the time consent was revoked. The simplest option for revoking your consent is to use our cookie banner.

If you do not want collected data to be associated with your Google profile, you must log out before visiting the website. You also have the right to object to the creation of user profiles, although you must contact Google to exercise this right, for instance at: https://about.google/contact-google/. Complete instructions for managing your data in conjunction with Google products is available at: https://support.google.com/accounts/answer/3024190.

 

Storage term: Your data will be stored for as long as necessary for the intended purpose, or until you object to the storage of your data.

 

Data recipients and further information: The collected information is stored on Google’s servers, including in the USA. The provider has joined the EU-US Data Privacy Framework for this purpose, which ensures compliance with the level of data protection established in Europe based on an adequacy decision of the European Commission. We have also agreed to standard contractual clauses on data protection with Google. The purpose of these clauses is to ensure compliance with an appropriate level of data protection in third countries.

 

Further information on the purposes and scope of data collection and processing by Google is available in the Google Data Privacy Declaration. It also provides further information on your relevant rights and optional settings to protect your privacy: www.google.de/intl/de/policies/privacy.

 

c. Links to our social media accounts

 

There are links on this website to our accounts on the social networks Facebook, Xing, Kununu, and LinkedIn. After you click the integrated icons, you will be forwarded to the page of the respective provider. Only at this point will user information be transmitted to the respective provider. If you are logged in to your user profile on the corresponding social network, then after you activate the button your visit to our website will be associated with your profile. If you do not want the social networks to collect data through the website, you should log out of the networks before visiting the website.

 

 

d. Our social media pages

 

Information on data processing on our social media pages is available in our “Social media data privacy supplement”.

 

 

3.5 Marketing services and functions on our website

 

 

a. Eloqua

 

Scope and purpose of processing: We use the service Eloqua, from the provider ORACLE Nederland B.V., Hertogswetering 163, 3543 AS Utrecht, P.O. Box 40387, 3504 AD Utrecht.

 

Eloqua uses cookies that are saved on your computer, and that make it possible to analyse your use of this website (referred to in the following as your user behaviour). Eloqua stores and analyses the frequency of your visits to the website, which content you were interested in, and which links you visited. Advertisements are also adapted to your interests based on this information. If you have previously visited another website that uses Eloqua, then you may already have an Eloqua cookie. Even if this cookie is set on other websites, information regarding your visit to our website is only visible to use, and is not shared with Oracle or with other users of the Eloqua system. Likewise, we are not able to record or view information regarding your visits to other websites using this cookie.

 

Legal bases and management options: The legal basis for analysing use of our website via Eloqua is your consent in accordance with Art. 6 para. 1 lit. a) GDPR. If you do not want cookies to be stored on your device by Eloqua, you can deny or revoke your consent using our cookie banner. In addition, you can deactivate the corresponding option in the system settings using your browser. You can delete saved cookies at any time using the system settings in your browser.

 

If you would like to prevent the use of Eloqua cookies on your device in the future, you can do so via the following link https://www.oracle.com/cx/marketing/

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent.

 

Data recipients and further information: Information regarding your use of this website generated via the cookie is transmitted to an Eloqua server and stored there. Eloqua uses this information on our behalf to analyse use of the website and compile reports regarding website activities. In conjunction with support and administrative services, it is possible in some cases that individual employees of the Oracle Corporation outside of the EU may access user data while performing their contractual services. In such cases, it is ensured that data is transmitted either based on an adequacy decision of the European Commission or suitable guarantees, such as standard contractual clauses which we have concluded with the provider as a precaution. Further information on international data transmission to Oracle is available at: https://www.oracle.com/legal/privacy/services-privacy-policy.html#1-7

 

Further information on data protection in conjunction with the use of Eloqua is available at: https://www.oracle.com/legal/privacy/privacy-policy.html.

 

 

b. Creation of profiles for advertising purposes

 

 

Scope and purpose of processing: When we collect personal data from you (such as your IP address or data you enter into a contact form) in the course of your visit to the website, this information may be stored in a profile for advertising purposes. We may combine such data with other information, such as your country of origin, which we obtain from you directly – in particular using a contact form.

 

We store the information we collect from you in order to offer you content based on your interests on the website and through our newsletter, as well as to send you information about our company or our services that is of interest to you based on your data and your individual interests. In order to do so, for technical reasons we must combine the data collected on you and the data you provide into user profiles, then analyse these for the purposes indicated. We do so internally, and only for the purposes described above.

 

Legal bases and management options: The legal basis for creating profiles for advertising purposes are our legitimate interests in analysis and statistical evaluation of the use of our website, in optimising our website and in providing services and content tailored to the interests of users. We have carefully weighed these legitimate interests against your own interests and your basic rights and freedoms as a user, and have determined that no consent is required in this respect; instead, data processing for the purpose of creating profiles for advertising purposes is permitted based on Art. 6 para. 1 lit. f) GDPR.

 

The significant factor in this decision is the fact that, in general, we only use basic identifying features such as your location, which we obtain through your IP address. We may combine these basic identifying features with information on your user behaviour on the website collected through the services PIWIK Pro and Eloqua. We will only store further identifying features in your profile if you provide us with additional information, in particular if you enter into a (business) relationship with us via the contact form. In such cases, we may also combine this information with your user behaviour related to newsletters and emails. However, no direct conclusions or legal consequences for you – such as consequences related to your credit rating – will ever result from data processing in order to create profiles for advertising purposes. You will also not be denied services on this basis.

 

Furthermore, please note that we do not collect any information from external data sources (such as information from social networks) in order to create profiles, and that we do not use automated selection processes to create predictions regarding your behaviour.

 

You are also not obligated to accept the creation of a profile; if you want to prevent us from creating a profile for you, you can deny Eloqua and PIWIK cookies in our cookie banner. You can also prevent Eloqua from creating a profile using the following link: https://www.oracle.com/cx/marketing/.    

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data.

 

Data recipients and further information: Stored information is transmitted to an Eloqua server and stored there. Eloqua uses this information on our behalf to create a user profile. We can store data collected for the purpose of creating a profile in our customer relationship management (CRM) system and in the data warehouse.

 

Further information on data protection in conjunction with the use of Eloqua is available in this data privacy notice under clause 3.5, lit. a) as well as here: https://www.oracle.com/legal/privacy/privacy-policy.html.

 

 

c. Advertisements with Meta (Facebook Pixel and conversion tracking)

 

Scope and purpose of processing: In addition, the website uses advertising services from the company Meta (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). By integrating the so-called “Facebook Pixel” on our website, we are able to display our advertisements (“ads”) to users of our website and of the social network Facebook, as well to as measure and analyse the success of such ads (“conversion tracking”). The “Facebook Pixel” is used for technical reasons to complete this connection.

 

We also use the “Custom Audiences” remarketing function, which also makes use of the Facebook Pixel and which displays advertisements based on your interests when you visit our website or other websites that have also integrated the Facebook Pixel. This allows us to display advertisements to you that match up with your interests, to make our website more interesting for you, and to market our services .

 

Because of the marketing tools we use, your browser forms a direct connection to the Meta server when you visit our website – after you grant your consent for this purpose. We have no influence over the scope and further use of data which is collected by Meta using this tool. Therefore, we will describe the procedures of which we are aware: because the Facebook Pixel is integrated into the website, Facebook is informed that you accessed the corresponding page of our website, or clicked on one of our ads. If you are registered with a Meta service, Meta can associate this website visit with your account. Even if you are not registered on the Facebook platform or are not logged in, it is still possible that the provider may receive your IP address and further identifying characteristics and use them to create a profile.

 

Legal bases and management options: The legal basis for data processing is Art. 6 para. 1 lit. a) GDPR, meaning that they are integrated only based on your consent. You can revoke your consent at any time without affecting the permissibility of processing up to the time consent was revoked. The simplest option for revoking your consent is to use our cookie banner. Logged in users can also object directly to the provider or using the following link: www.facebook.com/settings/?tab=ads#_. In addition, you can deactivate the corresponding option in the system settings using your browser. You can delete saved cookies at any time using the system settings in your browser.

 

Storage term: Your data will be stored for as long as necessary for the intended purpose, or until you object to the storage of your data or revoke your consent.

 

Data recipients and further information: The collected information is stored on Meta’s servers, including in the USA. The provider has joined the EU-US Data Privacy Framework for this purpose, which ensures compliance with the level of data protection established in Europe based on an adequacy decision of the European Commission. We have also agreed to standard contractual clauses on data protection with Meta. The purpose of these clauses is to ensure compliance with an appropriate level of data protection in third countries.

 

Further information on data processing by Meta is available at: www.facebook.com/about/privacy.

 

 

d. Google Ads

 

 

Scope and purpose of processing: We use the service Google Ads in order to make you aware of our services with the help of advertisements. If you access our website through a Google Ad, then Google Ads will save a cookie on your device.

 

Google will deliver the advertisement via a so-called “Ad server”. We and other websites use so-called Ad Server cookies for this purpose, through which we can measure certain parameters to determine the success of the ads, like the number of times the ad was displayed or user clicks. We can obtain information on the success of our advertising campaign through the Google Ads cookies saved on our website. These cookies are not used to identify you personally. In general, the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (marking that users no longer want to see the ad) are stored as analytic variables.

 

The cookies set by Google allow Google to recognise your web browser. If a user visits certain pages of an Ads customer's website, for instance, and if the cookie saved on their computer has not yet expired, both Google and the customer can see that the user clicked the advertisement and was forwarded to this page. A different cookie is assigned to each Ads customer, so that cookies cannot be tracked over the websites of other Ads customers. Because Google Ads is integrated, Google is informed that you accessed the corresponding part of our website or clicked on one of our ads. If you are registered with a Google service, Google can associate this website visit with your account. Even if you are not registered with Google or are not logged in, it is still possible that the provider may receive and store your IP address.

 

Because of the marketing tool we use, your browser automatically creates a direct connection with the Google server. We do not independently collect personal data in conjunction with these advertising measures; we simply make it possible for Google to collect such data. We only receive statistical analyses from Google indicating which ads were clicked on, how often, and at what price. We do not receive any further information related to the use of these advertisements; in particular, we are not able to identify users based on this information.

 

Google Conversion Tracking

 

We use Google Ads with the additional “Google Conversion Tracking” application. This is a process which allows us to review the success of our advertising campaigns. Advertisements are equipped with a technical provision for this purpose, such as an ID, which we can use to determine how users interacted with the ads based on clicks, and whether they actually used any of our services. This provides us with statistical information on the total number of users who read our ads, which ads are particularly popular, and further information regarding consequences resulting from the ads.

 

Google Remarketing

 

We use Google Ads with the additional “Google Remarketing” application. This process allows us to create advertisements based on the information we have about you, then display them to you as you use the internet. We do so through the cookies saved when you visit our website. Google uses these to record your user behaviour when you visit different websites, then analyse this information in pseudonymised form. Based on Google’s own statements, Google does not combine data collected in the course of remarketing with any personal data that may be saved by Google.

 

Legal bases and management options: The legal basis for processing your data is Art. 6 para. 1 lit. a) GDPR, meaning that Google Ads is only integrated, and Google Conversion Tracking and Google Remarketing are only used after you grant your consent.

 

You can revoke your consent at any time without affecting the permissibility of processing up to the time consent was revoked. the simplest option for revoking your consent is to use our cookie banner or the following functions:

 

• by changing the settings of your browser software accordingly; in particular, suppressing third-party cookies will prevent you from receiving advertisements from third-party providers;
• by changing your browser settings to that cookies from the domain “www.googleadservices.com” are blocked, www.google.de/settings/ads, although this setting will be deleted when you delete your cookies;
• by deactivating interest-based advertisements from the provider that are part of the “About Ads” self-regulation campaign, via the link www.aboutads.info/choices, although this setting will be deleted when you delete your cookies;
• by permanent deactivation in your Firefox, Internet Explorer or Google Chrome browsers via the link www.google.com/settings/ads/plugin. Please note that, in this case, you may not be able to use all of the functions of our website in full.

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent.

 

Data recipients and further information: The collected information is stored on Google’s servers, including in the USA. The provider has joined the EU-US Data Privacy Framework for this purpose, which ensures compliance with the level of data protection established in Europe based on an adequacy decision of the European Commission. We have also agreed to standard contractual clauses on data protection with Google. The purpose of these clauses is to ensure compliance with an appropriate level of data protection in third countries.

 

Further information on data protection at Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland is available here: www.google.com/intl/de/policies/privacy and here: http://services.google.com/sitestats/de.html.

 

 

e. LinkedIn Insight-Tag

 

Scope and purpose of processing: In addition, this website uses the so-called LinkedIn Insight Tag (or LinkedIn Pixel) from the LinkedIn Ireland Unlimited Company (“LinkedIn”). By integrating this JavaScript tag, we are able to identify you as a user of our website in the scope of a visit to the social network LinkedIn or other websites that also use the process, to display relevant advertisements (“ads”) to you based on your interests, and receive statistics regarding website visitors and demographics. In addition, we can analyse your use of our LinkedIn advertisement and your interest in our services through a conversion tracking function, as well as display LinkedIn advertisements to you on other websites via retargeting. In doing so, we are pursuing our interests in improving the effectiveness of LinkedIn advertisements and making our website more appealing to you.

 

Through the integration of the LinkedIn Insight Tag, your browser forms a direct connection to the LinkedIn server – after you grant your consent – both when you visit the LinkedIn website and when you visit websites that have integrated the LinkedIn Insight Tag. LinkedIn and we are jointly responsible for collecting your user data when you visit our website and for transmitting the data to the provider. However, LinkedIn is solely responsible for the processing necessary to carry out the objectives described after the data is transmitted. We have no influence over the scope or manner in which data is used by LinkedIn. Therefore, we will provide you with the information we do have: Because the LinkedIn Insight Tag is integrated into our website, LinkedIn is informed that you have accessed the corresponding page of our website or clicked on one of our ads. If you are registered with a LinkedIn service, LinkedIn can associate this website visit with your account. Even if you are not registered on LinkedIn or are not logged in, it is still possible that the provider may receive your IP address, time frame, and further identifying characteristics and link them with your associated actions.

 

Legal bases and management options: The legal basis for data processing is Art. 6 para. 1 lit. a) GDPR, meaning that they are integrated only based on your consent. You can revoke your consent at any time. The easiest way to do so is to use our cookie banner. In addition, you can deactivate the LinkedIn Insight Tag and object to further advertisement using the advertisement settings at www.linkedin.com/help/linkedin/answer/62931?trk=microsites-frontend_legal_privacy-policy&lang=en and at www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Further information and optional settings are available at the LinkedIn Privacy Center: https://privacy.linkedin.com/de-de?lr=1/.

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent.

 

Data recipients and further information: LinkedIn processes your personal data in the USA as well. It is ensured that data is transmitted either based on an adequacy decision of the European Commission or suitable guarantees, such as standard contractual clauses which we have concluded with the provider as a precaution. Further information on international data transmission to LinkedIn is available at: https://www.linkedin.com/help/linkedin/answer/a1343190?trk=microsites-frontend_legal_privacy-policy&lang=en 

 

Further information on data processing by LinkedIn is available from the provider, LinkedIn Ireland Unlimited Company, Attn: Legal Dept. (Privacy Policy and User Agreement), Wilton Plaza, Wilton Place, Dublin 2, Ireland; information on the LinkedIn Insight Tag: https://business.linkedin.com/de-de/marketing-solutions/insight-tag?lr=1/; data privacy information: www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy/.

 

 

f. Microsoft Advertising (formerly Bing Ads)

 

Scope and purpose of processing: We use the service Microsoft Advertising from the provider Microsoft Ireland Operations Limited (Ireland/EU) (formerly Bing Ads) on our website. Microsoft Advertising is an online marketing service that supports us in displaying targeted ads over the Microsoft Bing search engine via the Universal Event Tracking (UET) tool. Microsoft Advertising uses cookies to do so. Personal data is processed in this respect in the form of online identifiers (including cookie identifiers), IP addresses, device IDs, and information regarding device and browser settings.

 

Microsoft Advertising collects UET data, which we can use to track target audiences based on remarketing lists. A cookie is stored on the device you use when you visit our website for this purpose. This allows Microsoft Advertising to recognise that you visited our website and to display an advertisement later on when you use Microsoft Bing or Yahoo. The information is also used to create conversion statistics, for instance to record how many users accessed one of our websites after clicking an ad. Through this information, we learn the number of users who clicked our ads and were forwarded to our website. However, we do not receive any information that could be used to personally identify users.

 

Legal bases and management options: The legal basis for data processing is Art. 6 para. 1 lit. a) GDPR, meaning that they are integrated only based on your consent. You can revoke your consent at any time. The easiest way to do so is to use our cookie banner. You can deactivate personalised advertisements on Microsoft at: https://about.ads.microsoft.com/de-de/ressourcen/richtlinien/personalisierte-anzeigen.

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent.

 

Data recipients and further information: It is not possible to exclude the possibility that data may be transmitted to the USA in conjunction with the use of Microsoft services. If data is processed outside of the EU as well, the provider has joined the EU-US Data Privacy Framework for this purpose, which ensures compliance with the level of data protection established in Europe based on an adequacy decision of the European Commission. Alternatively, we take reasonable and appropriate measures to ensure an adequate level of data protection, for instance by concluding so-called EU standard contractual clauses. Further information on data protection at Microsoft is available in the Microsoft Data Privacy Policy at https://privacy.microsoft.com/de-de/privacystatement.

 

 

g. Bloomreach

 

Scope and purpose of processing: This websiteuses BloomReach B.V., headquartered in Oosteinde 7, 1017 WT, Amsterdam, the Netherlands (“BloomReach”) to analyse your visit to our website and create reports regarding your website activities on our behalf, with the goal of aligning our marketing activities to your interests. Data, in particular your IP address and data on your user activities, is transmitted to BloomReach company servers located in Belgium when you use our website. BloomReach stores cookies on your computer in this context, in order to analyse your surfing behaviour. BloomReach combines, stores, and processes this data through a uniform user interface.

 

Legal bases and management options: The legal basis for data processing is Art. 6 para. 1 lit. a) GDPR, meaning that they are integrated only based on your consent. You can revoke your consent at any time. The easiest way to do so is to use our cookie banner.

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent.

 

Data recipients and further information: Data is not transmitted to entities located outside of the European Union or other contracting states to the Agreement on the European Economic Area, or entities that process data outside of these territories.

In addition to simply using our website for informational purposes, we offer a variety of services and functions you can use if you so choose. In general, to do so you will have to provide additional personal data, which we will use to provide the service or function as described in the following section.

 

 

4.1 Newsletter

 

Scope and purpose of processing: You can register for our newsletter by getting in contact with us, for instance via a contact form on the website. If the contents of the newsletter are specifically described (such as the products and services for which it advertises) in the framework of the newsletter registration, then they determine the scope of consent; you can also change the scope of your consent later on and inform us of your preferences. In addition, our newsletter contains information about our products, services, special offers, and/or our company.

 

Double opt-in procedure: Registration is completed with a double opt-in procedure, meaning that after your registration you will receive an email. You will be asked to confirm your registration, in order to prevent your email address from being misused. We log newsletter registrations in order to verify the registration process in accordance with legal requirements, and to prevent or clarify any misuse of your personal data.

 

Newsletter tracking and creation of profiles: Newsletters sent with the help of Eloqua use tracking technologies that can be used to track your clicks and whether you open the newsletter. We primarily use this data to find out what topics are of interest to you, by tracking whether our emails are opened and tracking the links you click on. We then use this information to improve the emails we send to you and the services we provide, and we may connect this information with previously available tracking or profiling information as well. For further information regarding the creation of profiles for advertising purposes, please see the additional information in clause 3.5 lit. b).

 

Legal bases and management options: We only send newsletters after you register to receive them, e.g., based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You can revoke your consent to receive our newsletter at any time, in particular by unsubscribing from the newsletter. An unsubscribe link which you can use to exercise this right is provided at the end of each newsletter.

 

We will ask you for your consent to newsletter tracking where relevant. By revoking your consent to receive the newsletter, your consent to tracking will also be revoked. In this case, we will not be able to track emails if you have deactivated the display of images in your email program as a default setting. However, in this case the newsletter will not be displayed to you in full, and you may not be able to use all available functions. If you manually display the images, the tracking described above will be carried out.

 

The registration process is logged on the basis of Art. 6 para. 1 lit. c GDPR, since we are legally obligated to verify registrations.

 

Storage term: We store your data for as long as necessary for the intended purpose, unless you object to the storage of your data or unless you revoke your consent. If you have only registered for our newsletter, your personal data will be deleted once you unsubscribe from it, unless some other legal basis for keeping the data applies.

 

Data recipients and further information: We work with the service Eloqua from the provider ORACLE Nederland B.V., Hertogswetering 163, 3543 AS Utrecht, P.O. Box 40387, 3504 AD Utrecht, the Netherlands in order to deliver our newsletter. In conjunction with support and administrative services, it is possible in some cases that individual employees of the Oracle Corporation outside of the EU may access user data while performing their contractual services. In such cases, it is ensured that data is transmitted either based on an adequacy decision of the European Commission or suitable guarantees, such as standard contractual clauses which we have concluded with the provider as a precaution. Further information on international data transmission to Oracle is available at: https://www.oracle.com/legal/privacy/services-privacy-policy.html#1-7.

 

We have concluded a processing agreement with Eloqua that ensures Eloqua only processes the data on our behalf and in accordance with our instructions. Further information on data protection in conjunction with the use of Eloqua is available at: https://www.oracle.com/legal/privacy/privacy-policy.html.

 

 

4.2 Contact inquiries and other inquiries

 

Scope and purpose of processing: Any time you get in touch with us (for instance via email, by phone, or via a contact form) and provide personal data, you do so on a voluntary basis. We only process your information for the purpose of handling your contact inquiry. We then use information from the contact form you complete to improve the services we provide, and we may connect this information with previously available tracking or profiling information as well. For further information regarding the creation of profiles for advertising purposes, please see the additional information in clause 3.5 lit. b).

 

On some contact forms, after the top section of the form asks for your specific area of interest, the relevant group company that will answer your inquiry will be displayed. If multiple companies are listed there, they will process your data jointly as joint controllers in the sense of Art. 26 GDPR. Further information on their joint responsibilities is available by e-mailing [email protected].

 

If you provide specific information on your needs or specific personal information in the course of further inquiries (for instance in our leasing test or leasing calculator), we will store your data for the purpose of processing your inquiry, and if it is required for further correspondence.

 

If you expressly consent to be contacted by email, phone, or mail on the contact form or in the course of any other inquiry, then you grant GRENKE AG, GRENKE Business Solutions GmbH & Co. KG, GRENKEFACTORING GmbH and GRENKE BANK AG each the express consent to inform you by phone, email, or mail in the future about current products and services in the category selected. We may also store your data for the purpose of sending our newsletter (cf. the further information in clause 4.1). We will also store your email address and the date on which you granted consent, so that we can verify this consent in case of doubt.

 

Legal bases and management options: We will process your information for the purpose of handling your contact inquiry in accordance with Art. 6 para. 1 lit. b) GDPR.

 

If you consent to subsequent contact by us, then the legal basis for using your data for advertising purposes is Art. 6 para. 1 lit. a) GDPR. However, you can revoke your consent at any time by sending a brief message to [email protected] (there are no formal requirements for this message) or by unsubscribing from the newsletter.

 

The legal basis for logging your consent is Art. 6 para. 1 lit. c) GDPR, since we are legally obligated to verify registrations.

 

Storage term: If you do not grant your consent, your data will be deleted after your inquiry is handled. This does not include data subject to statutory or other required retention periods (for instance if the data must be processed further in order to fulfil a previously concluded contract). If and insofar as a statutory retention period applies, we will delete the data only after the end of such terms.

Data recipients and further information: Your data may be transmitted to affiliated (group) companies or third parties if necessary in the course of handling your contact inquiry. We may also store this information in our consumer relationship management (CRM) system in this respect.

 

We work with the service Eloqua from the provider ORACLE Nederland B.V., Hertogswetering 163, 3543 AS Utrecht, P.O. Box 40387, 3504 AD Utrecht, the Netherlands in the framework of using our contact forms. In conjunction with support and administrative services, it is possible in some cases that individual employees of the Oracle Corporation outside of the EU may access user data while performing their contractual services. In such cases, it is ensured that data is transmitted either based on an adequacy decision of the European Commission or suitable guarantees, such as standard contractual clauses which we have concluded with the provider as a precaution. Further information on international data transmission to Oracle is available at: https://www.oracle.com/legal/privacy/services-privacy-policy.html#1-7.

 

We have concluded a processing agreement with Eloqua that ensures Eloqua only processes the data on our behalf and in accordance with our instructions. Further information on data protection in conjunction with the use of Eloqua is available at: https://www.oracle.com/legal/privacy/privacy-policy.html.

 

 

4.3 Competitions

 

Scope and purpose of processing: When you participate in competitions, we process personal data that we receive from you, e.g. your name, email address and, if applicable, your customer number and other data, in order to enable you to participate in the competition. We will inform you within the scope of the competition as to which of your details are required for participation.

 

The data is processed in order to provide, conduct and handle competitions. We process personal data of participants in sweepstakes and competitions only in compliance with the relevant data protection provisions.

 

Legal basis and management options: The legal bases for the data processing are Art. 6 para. 1 lit. b GDPR in relation to data processing for conducting the competition and otherwise Art. 6 para. 1 lit. f GDPR, insofar as the processing serves our legitimate interests (e.g. in the security of the competition; in the protection of our interests against misuse through possible recording of IP addresses when competition entries are submitted). Insofar as we ask you for your consent to send advertising via email as part of the competition and you give us your consent to do so, the legal basis for this processing is Art. 6 para. 1 lit. a ) GDPR.

 

Storage term: Participants' data will be deleted when the data is no longer required to carry out the competition and we no longer require the data to achieve the purposes delineated. Data may be processed after the competition has come to an end in particular in the following situations: if we answer queries about the prizes or fulfil the prize benefits; in this case, the retention period also depends on the type of prize and may be up to three years, in particular in the case of goods or services, in order to be able to process warranty cases, for example.

 

Furthermore, the participants' data may be stored for longer in individual cases, e.g. in the case of reporting on the competition in online and offline media. If data was also collected for other purposes within the scope of the competition, its processing and the retention period depend on the prerequisites for this use (e.g. in order to subscribe to a newsletter within the scope of a competition, see the privacy notice for the newsletter under clause 4.1.

 

Data recipients: Participants' data will only be transmitted to other bodies if this is necessary for conducting the competition (e.g. for the purpose of sending prizes) or if a participant has consented to the transmission. External recipients may also be external service providers who help us carry out the competition as our processors, for example when we use entry forms as part of the competition. These processors are carefully selected and regularly reviewed by us. You may only use the data for the purposes specified by us and in accordance with our instructions.

 

 

4.4 Use of the EQS stock chart

 

Scope and purpose of processing: We integrate the EQS stock chart from the provider EQS Group AG, Karlstraße 47, 80333 Munich for visual representation of different stock charts.

 

The provider collects the following data about access to the stock chart on our website, and saves it in server log files.

 

• Website visited
• Time of the access
• Quantity of data transmitted in bytes
• Source/reference from which you accessed the page
• Browser used
• Operating system used
• IP address used – the IP address is anonymised after at most 24 h.

 

Storage term: Any personal data is anonymised within 24 hours. However, the provider reserves the right to review server log files which have not yet been anonymised if there are specific reasons to suspect illegal use, or to evaluate the data in order to correct a problem.

 

Legal basis and further information: The legal bases for processing are our legitimate interests (Art. 6 para. 1 lit. f) GDPR) in designing the website and stock charts in line with user needs and in protecting against any illegal use. Further information is available in the EQS Group AG data privacy declaration.

Within our company, only personnel who need personal data for the purposes indicated will have access to it. We only transmit your personal data to external third parties if this is necessary to process your inquiry, if we are otherwise permitted to do so by law, or if you have consented to the transmission.

 

Data is transmitted within our corporate group for sales and marketing purposes based on our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR.

 

External recipients may include, in particular, affiliated companies or external service providers who we employ as our processors to provide services, for instance in the areas of technical infrastructure and maintenance of our website. These processors are carefully selected and regularly reviewed by us. You may only use the data for the purposes specified by us and in accordance with our instructions.

 

Furthermore, it is possible that we may be required by law to provide personal data to authorities and state institutions, such as public prosecutors, courts or financial authorities. In this case, data is transmitted on the basis of Art. 6 para. 1 lit. c) GDPR.

 

In addition, we can disclose your personal data to third parties if we offer the option to participate in special campaigns or sweepstakes, to conclude contracts, or receive similar services alongside partners or service providers (such as transportation service providers). In these cases, data is transmitted based on your consent, for the purpose of performing a contract with you, or to carry out our legitimate interests in accordance with Art. 6 para. 1 lit. a), b) and/or f) GDPR. You will receive further information when you provide your personal data in conjunction with the specific processing procedure

If data is processed by entities located outside of or conducting processing outside of the European Union or another contracting state to the Agreement on the European Economic Area, then before transmitting the data we ensure that the recipients either offer an appropriate level of data protection, except in the cases permitted by law (for instance through an adequacy decision of the European Commission or through suitable guarantees, such as agreeing to so-called EU standard contractual clauses), or we ensure that you have consented to data processing conducted outside of the European Union / European Economic Area.

Please see the corresponding description of the individual offer or service for the storage term for personal data. In addition, or if not otherwise indicated in the corresponding description of the offer or service, in general we only store your personal data for as long as is necessary to fulfil the purpose of processing or – if you have granted your consent – for as long as you have not revoked your consent. If you object, we will delete your personal data unless continued processing of the data is permitted by law. We will also delete your personal data when we are obligated to do so by law. If and insofar as a statutory retention period applies, we will delete the data only after the end of such terms.

As a data subject, you have a wide range of rights under the GDPR. Specifically, these are:

 

• Information: You have the right to receive information regarding your saved personal data.

 

• Rectification and deletion: You can request that we rectify incorrect personal data and that we delete your personal data.

 

• Restriction of processing: You can request that we restrict the processing of your personal data.

 

• Data portability: If you have provided personal data to us based on a contract or consent, you can request to receive the personal data you have provided in a structured, commonly used, and machine-readable format, or request that we transmit it to another controller.

 

• Objection to data processing based on the legal grounds of “legitimate interest”: You have the right to object to our data processing at any time for reasons related to your specific situation, if the processing is based on “legitimate interest” as the legal grounds. If you make use of your right to object, we will halt processing of your personal data unless we have mandatory, protected reasons to continue processing the data that outweigh your rights.

 

• Objection to cookies: You can also object to the use of cookies at any time.

 

• Revocation of consent: If you have granted us consent to process your personal data, you can revoke this consent at any time with future effect. The legality of processing of your personal data carried out up to the time of consent will remain unaffected.

 

• Submission of complaints to a supervisory authority: You can also submit a complaint to the responsible supervisory authority if you believe that your personal data has been processed in an illegal manner. To do so, please contact the Data Protection Authority responsible for your place of residence or state, or the Data Protection Authority for the state of Baden-Württemberg, which is responsible for our company:

 

State Officer for Data Protection and Freedom of Information, Königstraße 10a, 70173 Stuttgart;
Tel.: +49 (0) 711 / 615541-0
Fax: +49 (0) 711 / 615541-15
[email protected]. 

 

You are entitled to the above rights only if applicable statutory requirements are fulfilled, even if these are not expressly mentioned in the description above.

 

If you have questions regarding the processing of your personal data, regarding your rights as a data subject, or regarding any consent you have granted, you can contact us free of charge. To exercise all of your rights described above, please contact [email protected] or write to the letter provided above under clause 1. When doing so, please ensure that it is possible for us to clearly identify you.

If we provide links to websites of other organisations, this data privacy statement does not apply to the processing of personal data by these organisations. Therefore, we recommend that you read the data privacy notices on the other websites you visit.

From time to time, it may be necessary to adjust the contents of this data privacy notice. Therefore, we reserve the right to update this document at any time. We will publish the updated version of the data privacy notice here. The version of our data privacy notice valid at the time of your visit applies.

 

Last updated [28/11/2023].