Privacy policy
Data protection has a particularly high priority for our company. In the following, we provide information about the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior. We have taken extensive technical and operational precautions to protect your data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.
Who is responsible for data processing?
This data protection information applies to data processing by:
ALUCA GmbH
Westring 1
74538 Rosengarten
Managing Director: Frédéric Straß, Christian Breuer
Who can I contact with questions about data protection?
You can reach our company data protection officer at:
ALUCA GmbH
Westring 1
74538 Rosengarten
Germany
E-Mail: [email protected]
What is personal data?
Any information relating to an identified or identifiable natural person. Personal data is information about an identified or identifiable person and thus all information that makes a person identifiable. Statistical data that cannot be associated with your person are not included here.
What personal data do we process, as well as the type and purpose of use?
When visiting the website:
For most of our service offerings, no processing of personal data is required. You can therefore visit our website without telling us who you are.
We only collect and process access data that your Internet browser automatically transmits to us for technical reasons to provide the website. Depending on the access protocol used, the protocol data record contains general information with the following contents:
- Your browser version
- your operating system
- the website you were previously on, if it contains a link to the ALUCA website.
When using the contact form:
Purpose of data processing
The processing of personal data serves us to process the contact request. If your request is for the conclusion of a contract or in connection with an already concluded contract, then the processing of the personal data serves us exclusively for the fulfillment or initiation of the contract.
The following data is collected:
- First name,
- last name
- Postal code
- City
- Telephone number (optional)
- Your message
Legal basis for data processing
The legal basis is Art. 6 para. 1 p. 1 lit. f DSGVO (legitimate interest). The legitimate interest lies in ensuring that your request is processed promptly by our company.
If the request is directed towards the conclusion of a contract or if the request is related to an already concluded contract, the legal basis for the data processing of the personal data processed in the course of sending a request via our contact form is Art. 6 para. 1 p. 1 lit. b DSGVO (implementation of pre-contractual measures/fulfillment of a contract).
For personal data that you provide to us voluntarily, Art. 6 para. 1 lit. a DSGVO (consent) is the legal basis. You can revoke your consent at any time with effect for the future.
Duration of storage
The above data will be deleted as soon as they are no longer required to achieve the purpose of their processing. For the personal data sent by e-mail or the contact form provided, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been conclusively clarified.
If the legal basis for data processing is consent, the data will also be deleted if you have revoked your consent.
To whom do we transfer your data
To process your contact request, we transmit your request internally at the responsible party to the relevant departments. If you also inform us of the country that concerns you, we can process your inquiry even faster by forwarding your contact request to the distribution partner or group company responsible for this country.
The legal basis for the data transfer to the distribution partner or group company is your consent pursuant to Art. 6 (1) p. 1 lit. a DSGVO, as you indicate your country voluntarily. You can revoke your consent at any time with effect for the future.
If your contact request serves to initiate a contract or concerns contractual issues, the legal basis for the data transfer is Art. 6 para. 1 p. 1 lit. b DSGVO.
When ordering a newsletter:
If you are interested in our newsletters, you have the option to voluntarily give your consent to receive newsletters. We apply the double opt-in procedure. This means that we will only send you the newsletter if, after sending a confirmation link to the e-mail address you provided, you confirm by means of a link contained in this e-mail that you wish to subscribe to our newsletter.
After delivery of a confirmation link by e-mail (double opt-in) to the e-mail address you have provided, we will use your e-mail address exclusively for sending our newsletter.
The following data will be collected by us in the process:
- Salutation
- First name and last name
- E-mail address
The sole purpose of processing the personal data is for us to provide our newsletter to your specified e-mail address in order to inform you about news and offers.
Legal basis for data processing
The legal basis is Art. 6 para. 1 p. 1 lit. a DSGVO (consent). You can revoke your consent at any time and without giving reasons.
Duration of storage
We store your personal data at the longest until you revoke your consent.
To whom do we transfer your data
The newsletter dispatch is carried out by the service provider: Sendinblue GmbH (formerly Newsletter2Go).
This website uses Sendinblue to send newsletters. The provider is Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Newsletter2Go is a service with which, among other things, the sending of newsletters can be organized and analyzed. The data you enter for the purpose of receiving newsletters is stored on Sendinblue's servers in Germany.
If you do not want Sendinblue to analyze your data, you must unsubscribe from the newsletter. You can revoke your consent to the storage of the data, the e-mail address and their use for sending the newsletter at any time, for example via the "unsubscribe" link in the newsletter.
For more details, please refer to the privacy policy of Sendinblue at: https://www.sendinblue.com/legal/privacypolicy/
Data analysis by Sendinblue
With the help of Newsletter2Go, it is possible for us to analyze our newsletter campaigns. For example, we can see whether a newsletter message was opened and which links, if any, were clicked. In this way, we can determine, among other things, which links were clicked on particularly often.
In addition, we can see whether certain previously defined actions were performed after opening/clicking (conversion rate). For example, we can see whether you have made a purchase after clicking on the newsletter.
Sendinblue also allows us to subdivide ("cluster") newsletter recipients based on various categories. In this way, the newsletters can be better adapted to the respective target groups.
For detailed information on the Sendinblue features, please see the following link: https://www.sendinblue.com/information-for-email-recipients/
We have concluded an order processing agreement with this service provider to protect your data.
Applications
You can apply to our company electronically, e.g. via e-mail. Please note that e-mails sent unencrypted will not be protected against unauthorized access.
Your details will be used for processing your application and deciding whether to establish an employment relationship. The legal basis is § 26 para. 1 in conjunction with. Abs. 8 S.2 BDSG. Furthermore, your personal data may be processed insofar as this should be necessary for the defense of asserted legal claims against us arising from the application process. The legal basis for this is Art. 6 para. 1 p.1 lit. f DSGVO. The stated purposes also constitute the legitimate interest in the processing.
Insofar as an employment relationship arises between you and us, we may, in accordance with Section 26 (1) BDSG, further process the personal data already received from you for the purposes of the employment relationship if this is necessary for the implementation or termination of the employment relationship or for the exercise or fulfillment of the rights and obligations of the employee representation resulting from a law or a collective agreement, a company or service agreement (collective agreement).
Your application data will not be processed beyond the described use.
Your personal data will be deleted after completion of the application process after 6 months at the latest, provided that no other legitimate interests on our part oppose deletion or you have not given us your consent for longer storage. Other legitimate interest in this sense is, for example, a duty to provide evidence in proceedings under the General Equal Treatment Act (AGG).
Is there any data transfer to third parties?
A transfer of your personal data to third parties does not take place in principle, unless we are legally obliged to do so, or the data transfer is necessary for the implementation of the contractual relationship or you have previously expressly consented to the transfer of your data.
External service providers and partner companies, such as online payment providers or a shipping company commissioned with the delivery, only receive your data to the extent that this is necessary to process your order / your order. In these cases, however, the scope of the transmitted data is limited to the necessary minimum. Insofar as our service providers process your personal data on our behalf, we ensure within the framework of order processing pursuant to Art. 28 DSGVO that they comply with the provisions of data protection laws in the same manner.
Please also note the data protection notices of the respective providers. The respective service provider is responsible for the content of third-party services, whereby we check the services for compliance with the legal requirements within the scope of reasonableness.
We attach importance to processing your data within the EU / EEA. However, it may happen that we use service providers who process data outside the EU / EEA. Insofar as data is processed outside the EU / EEA and there is no adequacy decision by the EU Commission, we have concluded the standard data protection clauses adopted by the EU Commission in accordance with Art. 46 DSGVO with the service provider in order to establish a secure level of data protection, which allow the transfer of personal data to a third country in individual cases.
We use cookies
What are cookies
Cookies are small text files that allow the web server to recognize a website visitor and store information about the visited web pages in the web browser. Cookies can be divided into "session cookies" and "persistent cookies". Session cookies are all those cookies that expire when a session is closed, i.e. they are only stored for the duration of the session. Persistent cookies, on the other hand, store the collected information for a longer period of time. Cookies can be set by website providers, but also by third parties.
We may store cookies on your browser if they are absolutely necessary for the operation of the website. For all other categories of cookies, we require your consent to use cookies.
Necessary cookies
Some cookies are necessary to provide core functionality. This website will not function properly without these cookies and they are enabled by default..
Analytical cookies
Analytical cookies help us improve our website by collecting and reporting information about your usage.
Marketing cookies
Marketing cookies are used to track visitors to websites so that publishers can serve relevant ads.
You can change or revoke your cookie setting preferences at any time on our website.
Cookie settings in your browser
We would also like to point out that, irrespective of the issue of granting/not granting consent, you can prevent cookies from being stored altogether by setting your browser to accept cookies only if you agree to this.
Google Maps Plug-In
Google Tag Manager
This site uses the mapping service Google Maps. Google Maps is a mapping service provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The responsible entity for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
In order to use the functions of Google Maps, information, including the IP address as well as the address entered as part of the route function, may be transmitted to the provider's servers. This information is usually transferred to a Google server in the USA and stored there. When visiting a website that contains Google Maps, your browser establishes a direct connection with Google's servers, whereby the map content is sent to your browser and integrated by it. The provider of this site has no influence on this data transmission. According to current knowledge, this includes the following data:
- Date and time of the visit to the website in question,
- Internet address or URL of the website called up,
- IP address, (start) address entered as part of route planning.
Google Maps is used in the interest of an appealing presentation of our online offers and to make it easy to find the places we indicate on the website. If you do not wish Google to process data via this service, you can deactivate the use of JavaScript in your browser settings. Please note that in this case the interactive map function of Google Maps cannot be used.
Insofar as data is processed outside the European Economic Area / the EU, where there is no level of data protection corresponding to the European standard, Google states that it uses standard contractual clauses.
More information on the handling of user data can be found in Google's privacy policy: https://www.google.de/intl/en/policies/privacy/
The collection and storage of data only takes place after explicit consent according to Art. 6 para. 1 p. 1 lit. a) DSGVO. This can be revoked at any time with effect for the future.
Privacy notice for the internal whistle-blowing system
Purposes of processing personal data
ALUCA GmbH processes the following types of personal data, among others, in connection with the submission and processing of reports via the internal whistle-blowing system:
- Information that personally identifies the whistle-blower, e.g. first name and surname, gender, address, telephone number and email address;
- Employment status at ALUCA GmbH;
- Information about persons implicated, i.e. natural persons named in a report as being those who committed the breach or who are connected with the persons named. Such information includes, for example, first name and surname, gender, address, telephone number, email address and/or other information that enables identification;
- Information about breaches that may allow the indirect identification of a natural person.
ALUCA GmbH will process personal data for the purpose of investigating the reports in order to prevent and uncover breaches of applicable law or company guidelines and/or to take follow-up measures (such as measures to verify the validity of the claims made in the report and, where applicable, to take action in relation to the reported breach, including through internal enquiries, investigations, criminal prosecutions, measures to withdraw/recover funds and to conclude proceedings).
Legal basis
- We will only process information that personally identifies the whistle-blower if the whistle-blower has given us their consent to do so pursuant to Art 6. (1a) of the GDPR. In accordance herewith, processing is only lawful if the data subject has given consent to the processing of their personal data for one or more specific purposes.
- We will process information on employment status, information on persons implicated and other information that indirectly identifies natural persons on the basis of Art. 6 (1f) of the GDPR. In accordance herewith, processing is lawful if necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Our legitimate interest – depending on the specific individual case to be reviewed – lies in processing reports in order to be able to take follow-up measures, such as measures to verify the validity of the claims made in the report and, where applicable, to take action in relation to the reported breach, including through internal enquiries, investigations, criminal prosecutions, measures to withdraw/recover funds and to conclude proceedings. It will be reviewed on a case-by-case basis, taking into account the breach concerned and other factors, whether interests or fundamental rights and freedoms of the data subject stand in opposition to processing of this kind. - We may process the personal data of employees on the basis of Sect. 26 (1) sentence 2 of the German Federal Data Protection Act (BDSG). In accordance herewith, the personal data of employees within the meaning of Sect. 26 (8) BDSG may be processed if there is a documented reason to believe the data subject has committed a crime while employed, the processing of such data is necessary to investigate the crime and is not outweighed by the data subject’s legitimate interest in not processing the data, and in particular the type and extent are not disproportionate to the reason.
General information on recipients/categories of recipients
Personal data processed in connection with a report will be processed by the company lawcode GmbH, Universitätsstrasse 3, 56070 Koblenz, Germany, on behalf of, and subject to the instructions of, ALUCA GmbH.
Personal data will only be transferred to third parties if there is a legal basis for doing so. In particular, this is the case if data transfer serves the purpose of complying with legal requirements under which we are obligated to provide information or notifications or share data, if you have provided us with your consent to transfer the data or if data transfer is justified by a legitimate interest assessment.
Furthermore, external service providers, such as external data centres or telecommunications providers, will process personal data on our behalf as data processors.
Depending on the area of responsibility into which the report falls and in order to initiate follow-up measures effectively, personal data may also be shared with the in-house specialist departments responsible.
Under certain circumstances, we may also share personal data with national security and/or law enforcement agencies, other official agencies and/or to persons subject to a duty of confidentiality, e.g. auditors/lawyers.
Personal data will only be transferred to third parties if there is a legal basis for doing so. In particular, this is the case if data transfer serves the purpose of complying with legal requirements under which we are obligated to provide information or notifications or share data, if you have provided us with your consent to transfer the data or if data transfer is justified by a legitimate interest assessment.
Furthermore, external service providers, such as external data centres or telecommunications providers, will process personal data on our behalf as data processors.
Depending on the area of responsibility into which the report falls and in order to initiate follow-up measures effectively, personal data may also be shared with the in-house specialist departments responsible.
Under certain circumstances, we may also share personal data with national security and/or law enforcement agencies, other official agencies and/or to persons subject to a duty of confidentiality, e.g. auditors/lawyers.
General information on the retention period
Data will generally be stored until follow-up measures have been concluded. Generally speaking, data contained within a report will be deleted two months after the conclusion of proceedings, unless it is necessary to retain the data for longer in order to initiate further legal action (e.g. to launch criminal or disciplinary proceedings). We will delete personal data in connection with reports immediately if it becomes clear to us that the report has no basis in fact.
Information pursuant to Art. 13 (2e) of the GDPR
What rights do you have?
Right to information
In accordance with Art. 15 DSGVO, you are entitled to request confirmation from the controller at any time as to whether personal data relating to you is being processed. To do so, you can use the form available at this link.
Right of rectification
Pursuant to Art. 16 DSGVO, you are entitled to demand that the controller rectify any inaccurate personal data concerning you without undue delay. This right also includes, depending on the purpose, the completion of incomplete personal data.
Deletion
If the personal data you have provided above is no longer necessary for the purpose of processing, the consent you have given for processing is revoked and there is no other reason for further processing, you may exercise your right to erasure in accordance with Article 17 of the GDPR and if there are no overriding legitimate grounds for further processing, you may request that your data be erased.
Restriction of processing
If the accuracy of the personal data processed by you is contested, the processing is unlawful, and in case of other grounds referred to in Art. 18 DSGVO, you may request the controller to restrict the processing.
Data portability
In accordance with Art. 20 DSGVO, you may request the controller to transfer the data you have provided to it in a structured, common and machine-readable format to you or to a third party.
Right of objection
Pursuant to Art. 21 (1) DSGVO, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6 (1) p. 1 lit. e (public interest) or f (legitimate interest); this also applies to profiling based on these provisions. We will no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.
If personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing in accordance with Article 21 (2) of the GDPR; this also applies to profiling insofar as it is related to such direct marketing. You can lodge your objection by mail at the address to ALUCA GmbH, Westring 1, 74538 Rosengarten or at [email protected].
Revocation of consent
You may revoke any consent you have given at any time, without giving any reason, by sending a written notice to ALUCA GmbH, Westring 1, 74538 Rosengarten or by sending an e-mail to [email protected]. To do so, you can use the form available under this link.
The lawfulness of the processing of your personal data, which was processed on the basis of the consent up to the time of the revocation, is not affected by the revocation.
Right of appeal
If you believe that the processing of personal data concerning you violates legal provisions, you have the right to lodge a complaint with a supervisory authority.
External links
On our websites you will find various links to other websites. We have neither influence nor control over the content and privacy policies of these linked websites. We therefore recommend that you check the privacy policy of these websites when you access the links.