Dear User*,

Thank you for your interest in our online services and how we handle your personal data. We would like to assure you that the protection of your personal data means much more to us, STEMMANN-TECHNIK GmbH, than simply complying with legal regulations.

*For reasons of better readability, we have refrained from using both male and female language forms in these notes. All personal designations apply equally to both genders and do not represent any form of judgement.

1. General Information

We respect your privacy. You can trust that we handle the data entrusted to us responsibly while using this website and do not share it with third parties without authorisation. The protection of your personal data is particularly important to us. The processing of personal data, such as the name, address, e-mail address or telephone number of a person, is always carried out in accordance with applicable data protection law.

With this data protection notice, we would like to inform you about the type, scope and purpose of the personal data we collect, use and process. In addition, we would like to inform you about your rights in connection with the processing of your data. With regard to the terms used in our data protection information, such as “processing” or “controller”, we refer to the definitions of the GDPR.

As the controller for data processing, we have implemented numerous technical and organisational measures to ensure the most comprehensive protection possible for the personal data processed via this website. Despite the utmost care, however, security gaps can occur in Internet-based data transmission, so absolute protection cannot be guaranteed.

1.1 The controller for data processing within the meaning of the GDPR and the BDSG is

STEMMANN-TECHNIK GmbH
Niedersachsenstraße 2
48465 Schüttorf
Germany
Phone: +49 5923 81-0
Fax: +49 5923 81-100
E-Mail: stemmann-sales@wabtec.com
Website: https://www.stemmann.com

1.2 Contact details of the data protection officer

The data protection officer of the controller is

REVIDATA GmbH
P.O. Box 10 42 27
40033 Düsseldorf
Phone: +(0) 49-211-65584395
Datenschutz@revidata.de

1.3 Additionally, you can reach the data protection coordinators of STEMMANN-Technik GmbH at:

STEMMANN-TECHNIK GmbH
Niedersachsenstraße 2
48465 Schüttorf
Phone: +49 5923 81-200
E-Mail: fsg-stemmann-datenschutz@wabtec.com

2. Overview of the Processing

Below you will find an overview of the types of data processed, the categories of data subjects and the purposes of processing:

2.1 Processed Data and Data Categories

We may process the following categories of personal data: Master data (first name, surname, email address, job title, company/employer), usage data, meta and communication data

2.2 Purposes of Data Processing

The purposes of data processing are to enable the provision of the online offer, to carry out direct marketing, to enable the provision of contractual services and pre-contractual measures, to carry out security measures, to answer enquiries, to measure reach and to increase the user-friendliness of our online offer.

2.3 Categories of Data Subjects

The following groups of people are affected by data processing on our website Customers, interested parties, communication partners, users, business and contractual partners.

2.4 Relevant Legal Bases

The processing of personal data, e.g. contact details, usage data, contract data, meta or communication data of a data subject, is carried out exclusively in accordance with the requirements of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and, where applicable, in compliance with other specific data protection regulations.

In principle, we process your data on the basis of the following legal bases

• Consent of the data subject pursuant to Art. 6 para. 1 sentence 1 letter. a  and Art. 7 GDPR,
• Fulfilment of our contractual obligations and implementation of pre-contractual measures - including responding to enquiries - in accordance with Art. 6 para. 1 sentence 1 letter b GDPR,
• Fulfilment of our legal obligations pursuant to Art. 6 para. 1 sentence 1 letter c GDPR,
• Necessity to safeguard our legitimate interests in accordance with Art. 6 para. 1 sentence 1 letter f GDPR
• in the event that the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Art. 6 para. 1 sentence 1 letter d of the GDPR is the legal basis

In addition to the provisions of the GDPR, the provisions of the BDSG also apply, which particularly contain special regulations on the rights of data subjects, i.e. the right to access, the right to deletion, the right to object, as well as the processing of special categories of personal data, or processing for other purposes, as well as the provisions of the TDDDG, which particularly include regulations on the storage of information on your devices.

2.5 Security Measures

In accordance with the statutory provisions, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, safeguarding availability and its separation. In addition, we have established procedures to ensure the exercise of data subject rights, the deletion of data and responses to data threats. We already take the protection of personal data into account during the development or selection of hardware, software and processes in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

We use SSL encryption to protect your data transmitted via our online offering. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

2.6 Recipients or Categories of Recipients of the Data, Data Transfers

We also transfer your personal data to other bodies, companies, legally independent organisational units or persons within the scope of processing or disclose your data to them. In addition to our digital event manager, the recipients of this data also include service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data. Within our company, only those departments and persons receive your data who absolutely need it to fulfil their tasks.

If we disclose data to other persons and companies (processors or third parties), transmit it to them, or otherwise grant them access to the data as part of our processing, this is done solely on the basis of a legal permission (e.g. when a data transfer to third parties is required for the performance of a contract pursuant to Art. 6 para.1 sentence 1 letter b of the GDPR), your consent, a legal obligation, or based on our legitimate interests (e.g. when using agents, web hosts, etc.).

Our website may also contain external links to third-party websites. Please note that we are not responsible for their operation, including the data processing that takes place in connection with a visit to these offers. If you click on one of these links, you send information to or via such third-party websites to the operator and to the services used by the operator. We therefore recommend that you check the data protection notices of these websites in advance before you visit them and send them any information about yourself that can be attributed to you personally.

As part of our processing of your personal data, it may also occur that the data is transferred or disclosed to other entities, companies, legally independent organizational units, or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

We may also transfer personal data to other departments or units within our organisation or grant them access to it. If the data transfer takes place for administrative purposes, it is based on our legitimate business and economic interests, or it occurs if necessary to fulfil our contractual obligations, or if consent from the data subject or a legal permission is provided.

2.7 Transfer of Personal Data to a Third Country

Your personal data may also be transferred to a third country. In cases where data is processed in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or where processing occurs as part of the use of third-party services or the disclosure or transfer of data to other persons, entities, or companies, this only takes place in accordance with legal requirements.

Subject to explicit consent or transfers required by contract or law, we process or allow the processing of data only in third countries with a recognized level of data protection, where contractual obligations are in place and complied with through so-called standard contractual clauses of the EU Commission, or where certifications or binding internal data protection regulations exist.

As part of the so-called „Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection as adequate for certain companies from the USA. The list of certified companies, as well as further information about the DPF, can be found on the website of the USA Department of Commerce at https://www.dataprivacyframework.gov.

2.8 Storage Duration, Deletion, and Blocking

We adhere to the principle of data minimisation. The data processed by us will be deleted in accordance with the statutory provisions as soon as you withdraw your consent to the processing or other authorisations cease to apply. If the data is not deleted because it is required for other, legally permissible purposes, processing will be restricted to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise or defence of legal claims or to protect the rights of another natural or legal person. In accordance with the legal requirements in Germany, retention is required, in particular, for 6 years pursuant to Section 257 para. 1 of the German Commercial Code (HGB) and for 10 years pursuant to Section 147 para. 1 of the German Fiscal Code (AO).

3. Individual Processing Operations

3.1 Hosting

To enable us to provide our online offering securely and efficiently, we use the services of web hosting providers from whose servers (or servers managed by them) the online offering can be accessed. For this purpose, we can provide infrastructure and platform services, computing power, storage space, and database services, as well as security and technical maintenance services that we use for the operation of this website. In this context, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, as well as meta and communication data of customers, interested parties, and visitors of this online offering in order to pursue our legitimate interests in the efficient and secure provision of this service in accordance with Art. 6 para. 1 letter f of the GDPR.

The provider we use is ratiokontakt GmbH, Starkenfeldstraße 31, 96050 Bamberg. Information on data protection can be found here: https://ratiokontakt.de/index.php?seite=datenschutz.

3.2 Collection of Access Data

Each time our website is accessed, it collects a range of general data and information in pursuit of our legitimate interests in accordance with Art. 6 para. 1 letter f of the GDPR. This general data and information is stored in the server log files. The following are collected: (1) the types and versions of browsers used, (2) the operating system used by the accessing system, (3) the date and time of access to the website, (4) the IP address, (5) the Internet service provider of the accessing system, (6) logs, status codes, and data volume; (7) directory protection users, as well as (8) other similar data and information used for threat prevention in the event of attacks on our IT systems.

When using this general data and information, no conclusions are drawn about the data subject. These pieces of information are required to (1) correctly deliver the content of our website, (2) optimise the content of our website and its advertising, (3) ensure the long-term functionality of our IT systems and the technology of our website, (4) enable responses to contact requests and communication with users, and (5) provide law enforcement authorities with the information necessary for prosecution in the event of an attack. This anonymously collected data and information is therefore analysed by us statistically and with the aim of increasing data protection and data security in order to ensure an optimal level of protection for the personal data processed by us. The anonymous data from the server log files is stored separately from any personal data provided by the data subject.

3.3 Use of Web Analysis Tools

We use Matomo as a web analysis service on our website. This allows us to analyze visitor traffic on our online offering and capture pseudonymous data about the behavior, interests, or demographic information of visitors, such as age or gender. It also enables us to determine when our online offering or its functions or content are used most frequently, or to invite repeated use. This also enables us to understand which areas require optimisation. When Matomo is used, cookies are generated and stored on the user's end device. The user data collected when using Matomo is only processed by us and is not shared with third parties. The cookies are stored for a maximum period of 13 months: https://matomo.org/faq/general/faq_146/

If we have asked you for your consent to the use of third-party providers, your consent is the legal basis for data processing. Otherwise, the user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). At this point, we also refer to the information on the use of cookies in this data protection notice.

We process usage data, such as page views, length of visit, click paths, device types used, operating systems, interactions with content and functions, as well as meta and communication data, such as IP addresses, time data, identification numbers

3.4 Contact and Enquiry Management

When contacting us and in the context of existing user and business relationships, your details are processed as enquiring persons insofar as this is necessary to respond to contact enquiries and any measures requested. This generally includes details such as name, contact information and any other information that is provided to us and is required for appropriate processing. We use this data exclusively for the stated purpose of establishing contact and communication

The legal basis for processing is, on the one hand, our legitimate interests in accordance with Art. 6 para. 1 S. 1 letter f GDPR and the fulfilment of the contract or the execution of pre-contractual enquiries in accordance with Art. 6 para. 1 S. 1 letter b GDPR.

We process master data, e.g. the name you provide or a customer number, contact data such as postal address, email address and telephone number, content data, usage data such as click paths, intensity and frequency of use, device type and operating system, meta, communication and process data such as IP address or timestamp.

4 Rights of the Data Subjects

The GDPR provides for a number of so-called data subject rights, which we would like to inform and clarify below.

4.1 Right to Confirmation

You have the right to request confirmation as to whether personal data concerning you is being processed. To exercise this right, please contact our data protection officer mentioned above.

4.2 Right to Information

You also have the right to receive information free of charge about the personal data stored about you as well as further information and a copy of the data in accordance with Art. 15 GDPR. Furthermore, you have the right to obtain the following information:

• the purposes of the processing
• the categories of personal data that are processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of a right to rectification or deletion of personal data concerning you or to restriction of processing or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• if the personal data is not collected from you as the data subject: all available information about the source of the data
• the existence of automated decision-making, including profiling, pursuant to Art. 22 para. 1 and 4 of the GDPR, and — at least in these cases — meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject.

Furthermore, you have a right to information as to whether personal data has been transferred to a third country or to an international organisation. If this is the case, you have the right to obtain information about the appropriate guarantees in connection with the transfer. If you wish to exercise this right to information, please contact our data protection officer mentioned above.

4.3 Right to Rectification

In accordance with Art. 16 GDPR, you have the right to request the completion or correction of data concerning you. You also have the right to request the completion of incomplete personal data, taking into account the purposes of the processing. If you wish to exercise this right to rectification, please contact our data protection officer mentioned above.

4.4 Right to Deletion (Right to be Forgotten)

In accordance with Art. 17 GDPR, you also have the right to demand that data concerning you be deleted immediately or, alternatively, in accordance with Art. 18 GDPR, to demand that the processing of the data be restricted if one of the following reasons applies and insofar as the processing is not necessary:

• The personal data have been collected or otherwise processed for purposes for which they are no longer necessary.
• The data subject withdraws consent on which the processing is based according to point (a) of Art. 6 para. 1 GDPR, or point (a) of Art. 9 para. 2 GDPR, and where there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 para. 2 GDPR.
• The personal data has been processed unlawfully.
• The deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the member states to which the data controller is subject.The personal data have been collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.

If one of the above reasons applies and you wish to request the deletion of personal data stored by us, please contact our data protection officer.

4.5 Right to Restriction of Processing

You also have the right to demand that we restrict processing if one of the following conditions is met:

• the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data
• the processing is unlawful, but you oppose the deletion of the personal data and request the restriction of their use instead
• we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims
• you have lodged an objection to the processing pursuant to Art. 21 para. 1 GDPR, but it is not yet clear whether our legitimate reasons outweigh yours.

If one of the above conditions is met and you wish to request the restriction of personal data stored by us, please contact our data protection officer mentioned above.

4.6 Right to Data Portability

You also have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. Furthermore, you have the right to request the transfer of this data by us to another controller, provided the processing is based on consent under Art. 6 para. 1 s. 1 letter a GDPR or Art. 9 para. 2 1 letter a GDPR, or on a contract under Art. 6 para. 1 letter b GDPR, and the processing is carried out using automated methods, and provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, and provided that the rights and freedoms of other individuals are not affected. To assert the right to data portability, please contact our data protection officer mentioned above.

4.7 Right to Object

Finally, you have the right to object at any time to the processing of your personal data, which is based on Art. 6 para. 1 sentence 1 letter e or f GDPR. This also applies to profiling based on these provisions.

If you object, we will no longer process your personal data unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If we process personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling insofar as it is associated with such direct advertising. Furthermore, you have the right to object to the processing of your personal data, which is carried out by us for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, unless such processing is necessary for the performance of a task carried out in the public interest. To exercise your right to object, please contact our data protection officer directly.

4.8 Automated Decisions in Individual Cases Including Profiling

We do not make decisions based solely on automated processing, including profiling, that have legal effects on you or similarly significantly affect you.

4.9 Right to Withdraw Consent under Data Protection Law

You also have the right to withdraw your consent to the processing of personal data at any time. To assert this right to withdraw consent, please contact our data protection officer mentioned above.

4.10 Right to Lodge a Complaint with a Supervisory Authority

In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the State Commissioner for Data Protection of Lower Saxony, www.lfd.niedersachsen.de.

5. Cookies and Web Storage

We use various cookies on our website and store data in web storage. Cookies are files that are placed and stored on a computer system via an internet browser.
By using cookies and storing data in web storage, we can provide users of our website with more user-friendly services that would otherwise not be possible. By means of a cookie, the information and offers on our website can be optimised for the benefit of the user. As already mentioned, cookies enable us to recognise the users of our website. The purpose of this recognition is to make it easier for users to use the site. For example, the user of a website that uses cookies does not have to re-enter their access data each time they visit the website because this is taken over by the website and the cookie stored on the user's computer system.

You can prevent the use of cookies by our website at any time by means of a corresponding setting in the Internet browser used and thus permanently object to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an Internet browser or other software programmes. This is possible in all common internet browsers. If the data subject deactivates the setting of cookies in the Internet browser used, not all functions of our website may be fully usable.

We use cookies in accordance with the legal requirements. Therefore, we obtain consent before using it, unless it is not legally required, particularly when storing and retrieving the information is absolutely necessary to provide the users with a service they have explicitly requested. If you consent, the legal basis for the processing of your data is your consent, as indicated by the checkbox, in accordance with Art. 6 para. 1 s. 1 letter a GDPR. Otherwise, the data processed through cookies is processed based on Art. 6 para 1. s. 1 letter b GDPR, if this is necessary for the fulfilment of our contractual obligations, or based on Art. 6 para. 1 s. 1 letter f GDPR, if it is required to safeguard our legitimate interests. Please refer to the explanations in the Consent Tool to find out which cookies are used on our website.

6. Integration of Third-Party Services and Content

6.1 Deployment and Use of YouTube

We have integrated the services of YouTube on our website. YouTube is an Internet video portal that enables video publishers to post video clips free of charge and other users to view, rate and comment on them, also free of charge. YouTube allows the publication of all types of videos, which is why complete film and television programmes as well as music videos, trailers or videos made by users themselves can be accessed via the Internet portal.

The operating company of YouTube is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

By playing the videos, data is transferred to YouTube from your browser. Data processing by the provider depends on whether you have a Google or YouTube account or are logged in to it. If you are logged in, the data can be linked or assigned to your user account by Google. The legal basis for the processing of your personal data is your consent in accordance with Art. 6 para. 1 sentence 1 letter a GDPR.

Information on data protection can be found on Google's website under Google's data protection tools: https://safety.google/privacy/privacy-controls/; the data protection declaration can be found here: https://policies.google.com/privacy, Basis for third country transfer: EU-US Data Privacy Framework (DPF).

6.2 Application and Use of reCaptcha

We also use Google reCAPTCHA from Google Inc. on our website. Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for this Google service in Europe. Using Google reCAPTCHA, we can determine whether a website visitor is a real person or whether they are a robot or spam software. reCAPTCHA is a Google service that protects websites from spam software and misuse by non-human visitors. This service is often used, as we do, to protect forms to be filled out on the Internet.

The IP address and other data that Google requires for the reCAPTCHA service may be sent to Google. IP addresses are almost always truncated beforehand within the member states of the EU or other signatory states to the Agreement on the European Economic Area. The IP address is not combined with other Google data unless you are logged in with your Google account while using reCAPTCHA.

The following data is processed: Referrer URL, the IP address, information about the operating system, cookies, mouse and keyboard behaviour, date and language settings, Javascript objects, screen resolution,

If you have given your consent, the legal basis for the use of reCaptcha is your consent pursuant to Art. 6 para. 1 sentence 1 letter a GDPR or our legitimate interest pursuant to Art. 6 para. 1 sentence 1 letter f GDPR to protect our online offer from abusive automated crawling and spam.
Information on data protection can be found on the Google website under Google's data protection tools: https://safety.google/privacy/privacy-controls/. The privacy policy can be found here: https://policies.google.com/privacy. The basis for the third country transfer is: EU-US Data Privacy Framework (DPF).

6.3 Application and Use of Google Fonts

We also use Google Fonts on our website for the purpose of providing font files for a user-friendly presentation of our online offering.

The Google fonts are hosted on our server, no data is transmitted to Google; the legal basis for data processing is our legitimate interests (Art. 6 para. 1 sentence 1 letter f) GDPR);

6.4 Deployment and Use of Google Maps

We have integrated the Google Maps map system on our website. Google Maps is a web service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (‘Google’) to display interactive (land) maps in order to visualise geographical information. By using this service, website visitors are shown the location of the company and it is easier for them to find us.

Information about the use of the respective website is transmitted to Google servers in the USA and stored there as soon as the subpages in which the Google Maps map is integrated are accessed. This takes place regardless of whether Google provides a user account through which the data subject is logged in or whether no user account exists. If you are already logged in to Google, your data will be assigned directly to your account. If this assignment is not desired, you must log out before activating the button. Google stores the data (even for users who are not logged in) as usage profiles and analyses them. Such an evaluation is carried out in particular in accordance with Art. 6 para. 1 sentence 1 letter f GDPR on the basis of Google's legitimate interests in the display of personalised advertising, market research and/or the needs-based design of its website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

If you do not consent to the transmission of your data to Google when using Google Maps, you have the option of completely deactivating the Google Maps web service by switching off the JavaScript application in your browser. Google Maps and thus also the map display on this website can then not be used.

Information on data protection can be found on the Google website under Google's data protection tools: https://safety.google/privacy/privacy-controls/. The privacy policy can be found here: https://policies.google.com/privacy. The basis for the third country transfer is: EU-US Data Privacy Framework (DPF).

7. Deletion and Blocking of Data

We adhere to the principle of data minimisation. The personal data processed by us is erased or its processing is restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations. If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons. According to the legal requirements in Germany, data is stored in particular for 6 years in accordance with Section 257 para. 1 HGB and for 10 years in accordance with Section 147 para. 1 AO.

Please let us know what you think
You can help us to continuously improve our data protection policy. Please let us know what you think. We are always open to your suggestions.