Data privacy statement for the Coroplast Tape website (www.coroplast-tape.com)

1. Information about the controller

Coroplast Fritz Müller GmbH & Co. KG
Wittener Straße 271
42279 Wuppertal
Germany

Phone: +49 202 2681 0
Fax: +49 202 2681 375

Email: info@coroplast-tape.com

2. Information about the data protection officer

If you have any questions regarding data protection, please contact our external company data protection officer:

Mr Jörg Conrad of GINDAT GmbH
Wetterauer Str. 6, 42897 Remscheid, Germany
Email: privacy@coroplast-group.com
Phone: +49 2191 909 430

3. Data processing on our website

Any visit you make to our website is logged. Basically, your browser automatically sends us the following data:

• The IP address currently used by your computer or router
• Date and time
• Browser type and version
• The operating system your computer is using
• The pages you have viewed
• The name and size of the file(s) you have requested
• The URL of the referring website, if applicable

Personal data are collected only for the purposes of data security, to improve our website and to enable us to analyse errors on the basis of Art. 6(1) f GDPR.

Your computer’s IP address is always evaluated in anonymised form.

Personal data (e.g. your name, address data or contact details) which you provide to us voluntarily, for example when you send an enquiry to one of the contact persons named on our website by email, are stored by us but are only processed to enable us to engage in correspondence with you and only for the purpose for which they were submitted. Such data are processed on the basis of Art. 6(1) a and f GDPR.

We would like to point out that no data transmission over the Internet (e.g. when communicating by email) can be guaranteed to be absolutely secure and vulnerabilities can never be ruled out entirely. While we make every effort to protect your data, complete protection against access by third parties is not possible. You should therefore send all confidential data to us by another method, for example by post.

4. Online careers portal

You can use our online careers portal (http://jobs.coroplast-group.com) to apply for a job at Coroplast. If you do so, we ask you to provide us with the usual personal data and your qualifications. For this purpose we additionally point out our separate terms regarding data protection. We also refer you to our separate data protection provisions, which we provide in the case of an online application.

5. Information on the use of cookies

We use cookies on our website. Cookies are small text files that your Internet browser stores and places on your computer. Cookies are used to make visiting our website a more user-friendly experience. They make it possible, for instance, to recognize the user for the duration of their visit without having to continually re-enter their username and password.

This website uses different types of cookies. Some cookies are placed by third parties featured in our website.

Some of the cookies we use are erased immediately when you close your browser (session cookies). Other cookies remain stored on your device and enable us to recognize your browser the next time you visit our website (persistent cookies).

We process data using cookies for the sole purpose of ensuring the functionality of our website, pursuant to Article 6 Paragraph 1(f) GDPR.

In all other cases, in particular to analyze website usage and for marketing purposes, we only use cookies pursuant to consent using our Cookie Consent Tool. This tool also provides additional information on the type, function and storage time for cookies we use. The legal basis for this is Article 6 Paragraph 1(a) GDPR and Section 25 Paragraph 1 of the German Telecommunications Telemedia Data Protection Act (TDDDG).

If you object to the use of cookies, you can change your browser settings to prevent cookies from being accepted and stored. However, please note that, if you do this, you may not be able to use the full functionality of our websites.

You can change or revoke your consent at any time under the “Cookies Policy” on our website.

See our “Data privacy statement” to find out more about who we are, how you can contact us and how we process personal data. Should you wish to contact us regarding your consent, please provide your consent ID and the date.

Your consent applies to the following domains: www.coroplast-tape.com

Consent to cookies with Cookiebot

Our website uses the Cookiebot cookie consent management platform to obtain your consent to store certain cookies on your device and to document these cookies as required under data protection law. This technology is operated by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.

A connection to the Cookiebot servers is established each time you visit our website in order to obtain your consent and to provide other information on the use of cookies. Cookiebot then stores a cookie in your browser to be able to attribute prior cookie consents or rejections and allow you to revoke consent. In doing so, Cookiebot stores data, including the IP address, referrer URL and consent data (consent ID, date and time).

In this respect, Cookiebot acts as data processor, and we have concluded the relevant data processing agreement with Cookiebot as per Article 28 GDPR.

We use Cookiebot to obtain the consent we legally require to use cookies. The legal basis for this is Article 6 Paragraph 1(c) GDPR.

According to Cookiebot, your consent status for cookies (cookie consent) is one (1) year.

More information is available in Cookiebot’s Privacy Policy:

www.cookiebot.com/en/privacy-policy/.

You may revoke your Cookiebot consent or change your preferences at any time using the “Cookie settings” button.

6. Data processing using Cloudflare

Our website uses Cloudflare’s CDN services. A content delivery network is a network of Edge servers at various geographic locations. It stores the content of our website, including files, images, audio and video material, etc. from the host server. Depending on where the user accesses our website from, content can be retrieved from a server located closer by, resulting in faster performance and loading times, thereby making our website more user friendly.

When accessing our website, log files are automatically compiled via Cloudflare’s servers; these files may contain personal data in the form of IP addresses. Data is stored in data processing centers in Europe and the US for a limited period of time, and serves merely to identify security threats and attacks, and bottlenecks and errors in our system. This data is not used for marketing purposes.

We have concluded a data processing agreement (available to view at https://www.cloudflare.com/media/pdf/cloudflare-customer-dpa.pdf, which requires Cloudflare to safeguard website user data and bars them from disclosing that data to third parties.

https://www.cloudflare.com/cloudflare-customer-dpa/

Cloudflare also relies on the European Commission’s standard data protection clauses when sending data from the EU to the US, which is intended to ensure compliance with European data protection standards in the US. In addition, Cloudflare is certified under EU-US Data Privacy Framework, which contains relevant data protection provisions for data transfers to the US.

Detailed information on the security of data processing by Cloudflare is available at:

https://www.cloudflare.com/trust-hub/gdpr/

Data is processed on the basis of our legitimate interest in the secure and efficient provision of our website, as well as our legitimate interest in optimizing the stability and functionality of our website pursuant to Article 6 Paragraph 1(f) GDPR.

7. Data collection using Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Ireland Ltd. (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and app instance IDs to help analyze your use of our website.

The following information is displayed as standard:

• number of users
• session statistics
• approximate location (city, continent, country, region, sub-continent)
• browser and device information
• the user’s IP address

We can use the analytics Google provides to evaluate your use of this website, to compile reports on website activity, and to utilize further services linked to website and internet use. For example, it is possible to analyze user behavior across different devices and platforms with a user ID.

According to Google, no IP addresses are logged or stored when collecting data in Google Analytics 4. With IP masking enabled, your IP address will be shortened by Google before it is stored and processed.

We have concluded a data processing agreement with Google Ireland Ltd.

The information generated by cookies about your use of this website is typically transferred to a Google server in the US and stored there.

A European Commission adequacy decision is in place for data processing by US companies, which falls under the EU-US Data Privacy Framework (DPF) with corresponding certification. Processing by Google LLC is done on the basis of certification under the EU-US Data Privacy Framework.

We have also concluded EU standard contractual clauses with the service provider to ensure an appropriate level of data protection.

The basis for processing in this case is your consent pursuant to Section 6 Paragraph 1(a) GDPR and Section 25 Paragraph 1 TDDDG. You may revoke your consent at any time with future effect using the “Cookie settings” button.

You can also prevent the data generated by the cookie about your use of the website (including your IP address) from being sent to Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en

Data we send that is linked with cookies will be automatically erased after 14 months.

https://policies.google.com/privacy?hl=en

Google Tag Manager

This website uses Google Tag Manager. Google Tag Manager is a solution that allows marketed website tags to be managed using an interface. The Google Tag Manager itself (which only implements the tags) is a cookie-less domain and does not register personal data. The tool causes other tags to be activated which may, for their part, register data under certain circumstances. Google Tag Manager does not access this information. If recording has been deactivated on domain or cookie level, this setting will remain in place for all tracking tags implemented with Google Tag Manager.

For more information on Google Tag Manager, follow this link: www.google.com/analytics/tag-manager/use-policy.html.

8. Use of social media

Our website uses social plug-ins from various social networks (Facebook, XING, LinkedIn, YouTube). The buttons are each marked with the logos of the various social networks. When you visit our website, the corresponding buttons are disabled, or merely linked so that data will only be sent to the particular social network if its button is clicked.

Clicking on the button of the social network creates a direct connection to that particular website. If you are logged into a social network, the operator in question can assign the visit to your account. If you do not want that to happen, we suggest you log out of your account beforehand. Even if you are not a member of a social network, it is still possible for the operator to find out your IP address, for example, and store it. If you do not want this to happen, do not click on any of the buttons.

We use this website to inform the public about our company and our products and services. The data you enter on our social media pages, such as usernames, comments, images, likes, messages, etc. is published on our social media platform, and we use this data, where applicable to interact with you. Our interaction with you as a prospective customer gives us direct insight into how we and our products are viewed in the marketplace, who our customers and prospective customers are, and what they are looking for, thereby helping us improve our products, services and ourselves for our customers.

Data processing is generally done via the social media operator’s platform within the scope of the general terms and conditions agreed between you and the platform operator and their privacy policy. We have limited influence over data processing by platform operators. If you do not wish to use social media platforms, you can, of course, reach us and find our information through our website.

In addition to communicating with you, the portals we use (except XING) also provide statistical analyses based on usage of those social media portals. This is usually demographic data, such as age, gender and location and various statistical information about the use of our services. This means that we have some input as to the purposes of data collection, such that we are also considered the data controller in this regard alongside the social media operators. Where possible, we have concluded a joint controller agreement with portal operators pursuant to Article 26 GDPR.

Additional details on data protection are available in the information below on individual operators.

The legal basis for processing your data is Article 6 Paragraph 1(f) GDPR. Data is processed in the interests of public relations work for our company and to communicate with you.

Facebook (“Meta”)

Facebook here means the products and services offered by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (“Meta Platforms Ireland”).

When you visit our page on Facebook, data is usually sent to the US. A European Commission adequacy decision is in place for data processing by US companies, which falls under the EU-US Data Privacy Framework (DPF) with corresponding certification. Processing by Meta Platforms, Inc. is done on the basis of certification under the EU-US Data Privacy Framework.

Meta gives operators of Facebook and Instagram accounts the option to receive an overview of page or account activity using the Page Insights feature. In particular, Page Insights offers statistical data and analytics. When visiting our Facebook page, data is processed on the basis of a joint controller agreement pursuant to Article 26 GDPR. This is available here:

https://facebook.com/legal/terms/page_controller_addendum

In particular, Facebook has agreed to honor the rights of users, e.g. the right to information or erasure. More information regarding data protection at Facebook is available at:

https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

LinkedIn

LinkedIn here means the products and services offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”).

When you visit our page on LinkedIn, data is usually sent to the US. A European Commission adequacy decision is in place for data processing by US companies, which falls under the EU-US Data Privacy Framework (DPF) with corresponding certification. Processing by LinkedIn is done on the basis of certification under the EU-US Data Privacy Framework.

LinkedIn gives operators of LinkedIn accounts the option to receive an overview of page activity using the Page Insights feature. In particular, Page Insights offers statistical data and analytics. When visiting our LinkedIn page, data is processed on the basis of a joint controller agreement pursuant to Article 26 GDPR. In particular, LinkedIn has agreed to honor the rights of users, e.g. the right to information or erasure.

https://linkedin.com/legal/l/dpa

Details on data collection (purpose, scope, additional processing, use) and your rights and settings options are available in LinkedIn’s Privacy Policy:

https://linkedin.com/legal/privacy-policy

XING

XING here refers to the products and services offered by Work SE, Dammtorstrasse 30, 20354 Hamburg, Germany. Details on how they process your personal data are available in XING’s Privacy Policy: 

https://privacy.xing.com/en/privacy-policy.

YouTube

We have a YouTube profile. YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube Analytics offers the option to receive an overview of activity on our YouTube account and its users. In particular, YouTube Analytics offers statistical data and analytics.

Details on how they process your personal data are available in YouTube’s Privacy Policy:
https://policies.google.com/privacy?hl=en.

9. Use of YouTube videos

We have YouTube videos embedded in our website. These can be played directly from our website. YouTube is a service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you agree to playback of embedded YouTube videos, YouTube uses cookies that are also intended to analyze your user behavior.

Google thereby receives data that may be transmitted to the US.

If you are logged in to Google, your data is directly attributed to your account when you click on a video. If you would prefer such activity not be attributed to your YouTube profile, you must log out before pressing the playback button. You can also prevent the data generated by the cookie about your use of the website (including your IP address) from being sent to Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout.

Playing this video and the data processing involved for YouTube to do so requires your explicit consent pursuant to Section 6 Paragraph 1(a) GDPR and Section 25 Paragraph 1 TDDDG. You may revoke your consent at any time with future effect.

Information on data protection and the processing of personal data is available here:

https://policies.google.com/privacy?hl=en

10. Recipients of personal data

Personal data will not be disclosed to anyone else without your consent. Such data will only be shared with third parties with your express consent, or insofar as they are required for the performance and/or technical management of a contract, or insofar as we are obliged to divulge them to public authorities or other government institutions as a result of statutory provisions or judicial decisions.

We may employ service providers to perform functions and provide services on our behalf (order processing). Specifically, our website is hosted, and our recruitment portal managed, by an external service provider.

The contractual relationships with our service providers are subject to the provisions of Art. 28 GDPR, which describes the legal requirements concerning data protection and data security.

11. Your rights

Pursuant to Sections 15 to 21 GDPR, you may assert the following rights in relation to the personal data processed by us, provided the specific conditions listed there are met.

• right of access to your personal data (Article 15 GDPR);
• right to rectification of incorrect personal data (Article 16 GDPR);
• right to erasure, provided one of the reasons specified in Article 17 GDPR applies, e.g. if the data is no longer needed for the purposes for which it was originally required;
• right to restriction of processing if one of the conditions listed in Article 18 GDPR is met, e.g. if the data subject has objected to processing, for the duration of the investigation by the data controller;
• right to object for reasons arising from the data subject’s particular situation (Article 21 GDPR);
• right to revoke consent at any time with future effect if data is being processed on the basis of your consent.

12. Standard periods for the deletion of data

Unless a specific storage period has been listed in this Data privacy statement or our Cookie Consent Tool, data is generally erased if it is no longer required to achieve the original purpose of data processing, and no statutory retention periods are in place. Different timelines are in place regarding the storage of personal data. For example, data relevant under tax law is generally stored for ten (10) years, while other data is generally stored for six (6) years under the statutory commercial provisions.

13. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR, every data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data relating to him or her infringes the GDPR. The responsible supervisory authority with regard to data protection issues is the state data protection officer for the federal state in which our company is based, in other words in our case the State Commissioner for the Protection of Data and Freedom of Information North Rhine-Westphalia (Landesbeauftragter für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

According to Article 77 GDPR, every data subject is entitled to lodge a complaint with a supervisory authority if they believe their personal data is being processed in violation of the GDPR. The competent supervisory authority for issues relating to data protection is the state data protection officer for the German state in which a company has its registered office. In our case, this is the:

North Rhine-Westphalia State Commissioner for the Protection of Data and Freedom of Information

Kavalleriestr. 2–4
40213 Düsseldorf, Germany
Telephone: +49 (0)211/38424-0
Fax: +49 (0)211/38424-999
Email: poststelle@ldi.nrw.de​​​​​​​​​​​​​​​​​​​​​

Data privacy statement for customers for sample parcel tracking

Data Protection Information per Articles 13 and 14 of the EU General Data Protection Regulation (GDPR)

Valid for customers of Coroplast Fritz Müller GmbH & Co. KG (hereinafter referred to as “Coroplast”).

The information below is intended to provide you with an overview of our processing of your personal data and your rights under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The specific data processed and the ways in which such data are used largely depends on the products and services requested and/or ordered.

1. Controller responsible for data processing

Coroplast Fritz Müller GmbH & Co. KG
Wittener Str. 271
42279 Wuppertal, Germany
Telephone: +49 (0)202 2681 0
Fax: +49 (0)202 2681 375
Email: info@coroplast-group.com

2. Controller’s data protection officer

GINDAT GmbH
Mr. Arndt Halbach
Wetterauer Str. 6
42897 Remscheid
Germany
Telephone: +49 (0)2191 909/430
Email: arndt.halbach.ext@coroplast-group.com

3. Data and services

a) Sources

We process personal data we receive from you as part of our business relationship. Where necessary to provide our products and services, we also process personal data we receive from other organizations under the Coroplast corporate umbrella.

b) Categories of personal data

For sample tracking, the following personal data is forwarded to each shipping provider:

Client (recipient) name, consisting of
- First name
- Last name
- Employer
- Client email address
- Official client delivery address (optional), consisting of
- Second address line
- Street name
- Building number
- Postal code
- Town/city

c) Service information

When processing data as part of services rendered by shipping providers, you will receive additional information on data protection and privacy for each service being rendered.

4. Purpose and legal basis for data processing

We process the personal data listed in Section 3 in compliance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

a) Balancing interests (Article 6 Paragraph 1f GDPR)

Our legal basis for disclosing your data is Article 6 Paragraph 1f GDPR (legitimate interests).
Where necessary, we process your data beyond the actual execution of the contract in order to guarantee our legitimate interests or those of third parties.
Our legitimate interest here lies in facilitating the delivery of our products and services and ensuring a smooth consignment tracking process, thereby guaranteeing customer satisfaction.
We also have a legitimate interest in avoiding delivery delays, both for merchants and recipients'
 

5. Data recipients

Within Coroplast, the persons or departments with access to your data are those who need it to meet our contractual and legal obligations.

Service providers we hire may also receive data for these purposes, provided they comply with our written instructions regarding data protection.

With respect to disclosure of data to recipients outside of Coroplast, it is important to note that we are bound by confidentiality regarding all customer-related information we become aware of.

We are only permitted to disclose information about you if required by statutory provisions, you have consented to the disclosure, and/or the data processors we hire guarantee compliance with the requirements of both the GDPR and BDSG.

Under these conditions, recipients of personal data for the purposes mentioned above may include:

• DHL – Europe-wide and worldwide CEP service provider

• DPD – national (within Germany) CEP service provider

• Schenker – national (within Germany) land transportation

• Rhenus – international land transportation

• DSV – sea freight

6. Transfer of data to third countries or international organizations

We will only transfer data to countries outside of the EU or EEA (also known as “third countries”) where necessary to fulfill your orders, where legally required (e.g. reporting requirements under tax law), where you have granted us consent to do so, or where this is done as part of data processing.

When we work with service providers in third countries, these providers must comply with the level of data protection provided in Europe as well as our written instructions by agreeing EU standard contractual clauses with us.

7. Data storage period

Customers’ personal data is stored by Coroplast for as long as each contractual relationship exists, until the contact person changes, or until any objection is made to further shipments.

If an employee of the customer leaves their position, their personal data is either erased as quickly as possible or stored locally by the subsidiary in question in accordance with the Coroplast Group retention policy.

If data is no longer required to meet contractual or statutory obligations, this data is regularly deleted unless its (temporary) further processing is necessary for the following reasons:

• To meet retention and documentation periods under commercial and tax law pursuant to Section 257 of the German Commercial Code (HGB) and the German Tax Code (AO), ranging from two to ten years.

• To retain evidence under the statute of limitations. Per Sections 195 et seq. of the German Civil Code (BGB), this statute of limitations may be up to 30 years, whereas the typical statute of limitations is only three years.

8. Automated decision-making (including profiling)

We generally do not use any fully automated automatic decision-making (including profiling) pursuant to Article 22 GDPR in establishing and executing business relationships. In the event that we do use such procedures in individual cases, we will inform you of this separately where this is required by law.

9. Your rights

Pursuant to Sections 15 to 21 GDPR, you may assert the following rights in relation to the personal data processed by us, provided the specific conditions listed there are met.

You are entitled to request information about your personal information being processed by us (Article 15 GDPR).

If incorrect data is being processed, you are entitled to a right to rectification (Article 16 GDPR).

Where the legal requirements are met, you are entitled to request the erasure of your data or the restriction of processing of your data (Articles 17 and 18 GDPR).

You have the right to revoke any consent granted in relation to data protection at any time. Revoking your consent does not affect the lawfulness of data processing that was carried out based on consent prior to revocation.

Right to object (Article 21 GDPR)
Any data subject has the right to lodge an objection to the processing of personal data relating to you for reasons relating to your particular situation where this is done on the basis of Article 6 Paragraph 1(e) or (f) GDPR. This also applies to profiling based on these provisions.

10. Right to lodge a complaint with a supervisory authority

According to Article 77 GDPR, every data subject is entitled to lodge a complaint with a supervisory authority if they believe their personal data is being processed in violation of the GDPR. The competent supervisory authority for issues relating to data protection is the state data protection officer for the German state in which our organization has its registered office.

North Rhine-Westphalia State Commissioner for the Protection of Data and Freedom of Information
Post Box 20 04 44
40102 Düsseldorf, Germany
Telephone (switchboard): +49 (0)211/38424-0
Fax: + 49 (0)211/38424-999
Email: poststelle@ldi.nrw.de