Privacy Policy

With this privacy policy, we would like to inform you about the processing of your data. With regard to the terms used, such as "processing" or "controller", we refer to the definitions from Art. 4 of the General Data Protection Regulation (GDPR). Our websites are not aimed at children and young people under the age of 16.

Who is the entity responsible for processing?

Hälssen & Lyon GmbH
Pickhuben 9
20457 Hamburg
Germany

represented by the Managing Directors Christian Meckel (Chairman) and Dietmar Scheffler

Phone   +49 40-36 14 3-0 
info@haelssen-lyon.com

How to contact our data protection officer?

The contact details of our external data protection officer (DPO) are as follows: Mauß Datenschutz GmbH, Neuer Wall 10, 20354 Hamburg, Germany. You can reach our DPO by mail (see above) or at phone: +49 40 999 99 52-0 and via e-mail: datenschutz@datenschutzbeauftragter-hamburg.de. 

How do we process your data?

In the following, you will learn which data is collected when, how it is used (type, scope and purpose of the processing of personal data) as well as the legal basis and the duration of storage.

Operation of the web Server, delivery of the web pages

When you visit our websites, we automatically process the following data from you in order to be able to provide our websites and the services provided via them:

• Date and time of access
• Your IP address
• The URL of the website from which you came to us
• The URLs you visit on our site
• Information about your Internet browser (browser type and version)
• The operating system of the device with which you access our website
• Your Internet service provider 

For security reasons, we store this information in log files and automatically delete it after 60 days . The data in the log files is stored separately from other data about you.

Longer storage only takes place in justified individual cases (e.g. in the event of suspected abuse or fraud or in the event of attacks on our web server). In these cases, the respective log files are stored until the facts of the case have been clarified and the resulting measures have been completed.

In order to be able to provide you with our website and the services provided via them, we use a service provider (web hoster) who processes your data on our behalf and exclusively in accordance with our instructions.

Mittwald CM Service GmbH & Co.KG 
Königsberger Straße 4-6 
32339 Espelkamp
Germany

The legal basis for the processing of your data is Art. 6 Par. 1 lit. f GDPR. We have a legitimate interest in processing your data so that we can offer you our websites and the services provided via them in a technically flawless, secure manner and optimized for your needs. In addition, our other legitimate interest is to detect and prevent fraud attempts or attacks on our websites.

Use of an externally hosted tool to obtain and manage consent

We use several tools and technologies on our websites, including cookies, for the operation of which we need your consent.

To obtain and manage your consents, we use a so-called consent manager. Specifically, we use the product Cookiefirst (CookieFirst by Digital Data Solutions B.V., Plantage Mid-denlaan 42a, 1018 DH Amsterdam, https://cookiefirst.com/legal/privacy-policy).

The consent manager stores information on your device to save your consents. The storage period of this data can be found in the information in the consent manager.

You can give us all consents for the tools and technologies we use in the consent manager and also revoke them there at any time. The consent manager is automatically displayed the first time you visit our website. In addition, you can open it again at any time by clicking on the icon shown as a "fingerprint" at the very bottom. All necessary details regarding cookies or tools and technologies requiring consent can be found in the consent manager.

The legal basis for the use of the Consent Manager is our obligation to obtain your consent for certain processing and our legal obligation to be able to prove what kind of consent you have given us (Art. 6 Par. 1 lit. c GDPR in conjunction with Art. 7 GDPR and Art. 5 Par. 2 GDPR). The decision to use an external provider is based on our legitimate interest (Art. 6 Par. 1 lit. f GDPR) to use a modern, secure and cost-effective solution.  

Storage and retrieval of data in your device

In order to provide the functionalities you have requested, including the provision of the website, we store data in your browser in accordance with § 25 TDDDG and also access it afterwards. For this purpose, we use so-called cookies as well as the session storage and the local storage of the browser. Without this storage and retrieval of data, our website will not function correctly.

The legal basis for the storage and retrieval of data from your browser is our legitimate interest pursuant to Art. 6 Par. 1 lit. f GDPR in conjunction with § 25 TDDDG to implement our websites in an appealing and secure manner and to comply with your wishes regarding the usability and functionality of the pages.

All further information on this type of data storage and retrieval can be found in the consent manager (see previous section), which you can access by clicking on the icon shown as a "fingerprint" at the very bottom of the page.

Tracking

We would like to constantly develop and improve our websites. For this purpose, we would like to statistically evaluate user behaviour. We use Google Analytics, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, https://policies.google.com/privacy, for the collection of data and statistical analysis. The data collected includes, for example, the number of page views, the sub-pages visited and the length of stay, as well as entry and exit points . In addition, you can be recognized on the basis of the data for a period of 2 months. We store the user ID required for this on your end device.

The legal basis for the processing is your consent (Art. 6 Par. 1 lit. a GDPR).

The statistical data is anonymized immediately after collection and stored permanently. Your IP address is also only stored in anonymized form. In addition, Google also uses the anonymized data for its own purposes. For more information on this, please visit the service provider's privacy policy.

Regarding the storage period of the data stored in your browser: This data is stored for 2 months and then automatically deleted by the browser.

The data may be transmitted to US servers of subcontractors of Google Ireland Limited, among others. This transfer is based on the Data Privacy Framework; for transfers to other non-EU countries, there are either also adequacy decisions or appropriate guarantees have been concluded in the form of standard contractual clauses. 

Contact form

You can contact us via the form on our website. Your data is processed in order to handle your requests, insofar as this is necessary to answer them and provide any requested measures. The data processed in this context are:

• Your name
• Your e-mail address (mandatory)
• Subject
• Your message (mandatory)

The legal basis for processing your data in the context of contacting us is Art. 6 Par. 1 lit. f GDPR, our legitimate interest in responding to your request.

Something else only applies if the content of your contact directly serves to initiate or to carry out a contractual relationship existing between you and us. In these cases, we base the processing of your data on Art. 6 Par. 1 lit. b GDPR.

Your data will be deleted as soon as it is no longer required and is not subject to any statutory retention obligations.

Google Tag Manager

We use the third-party service Google Tag Manager from Google. The Google Tag Manager is used to flexibly load other content that may itself process personal data.

The legal basis for processing within the scope of Google Tag Manager is Art. 6 Par. 1 lit. f GDPR, our legitimate interest in optimising our services and facilitating website operation.

Google Tag Manager processes your IP address, among other things. The Google Tag Manager itself does not set cookies, however, the services it loads may set cookies.

Automated decision making

We refrain from any automated decision-making.

Transfer of personal data to non-EU countries, server location

We may transfer personal data to non-European countries within the scope of our website. The specific cases of this transfer are indicated above for the services used. Adequacy decisions of the EU Commission are always available or other sufficient guarantees for the protection of personal data according Art. 44 ff GDPR have been concluded.

Our web servers are located in Germany.

Obligation to provide data

You are under no legal or contractual obligation to provide us with personal data when using our website. However, our pages cannot be accessed without providing your IP address. 

Your rights

If you wish to exercise any of your rights, please contact us as the controller at the contact details provided above or use one of the other methods we offer to send us this notice.

Right of access

According to Art. 15 GDPR, you have the right to request confirmation from us whether personal data concerning you is being processed by us. If this is the case, you have a right to information about this personal data and to further information mentioned in Art. 15 GDPR.

Right to rectification

According to Art. 16 GDPR, you have the right to demand that we correct any inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.

Right to erasure

You have the right to demand that we delete personal data relating to you without delay. We are obliged to delete personal data without delay, provided that the relevant requirements of Art. 17 GDPR are met. For details, please refer to Art. 17 GDPR.

Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right under certain conditions to demand that we restrict the processing of your personal data.

Right to erasure

You have the right to request that we immediately erase personal information concerning you. We are obliged to erase personal information immediately, provided that the relevant requirements of Art. 17 GDPR are met. For details, please refer to Art. 17 GDPR. 

Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right, under certain conditions, to request us to restrict the processing of your personal information.

Right to data portability

According to Art. 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format, and you have the right to transfer this data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Art. 6 Par. 1 lit. a GDPR or Art. 9 Par. 2 lit. a GDPR or on a contract pursuant to Art. 6 Par. 1 lit. b GDPR or the processing is carried out with the help of automated processes.

Right to revoke consent

According to Art. 7 GDPR, you have the right to revoke your consent at any time and without giving reasons. Please note that a revocation applies exclusively to the future and does not affect the lawfulness of processings carried out in the past.

Right to objection

If we name our legitimate interest according to Art. 6 Par. 1 lit. f GDPR as the legal basis, you have the following right of objection according to Art. 21 GDPR.

According to Art. 21 GDPR, you have the right to object to the processing of personal data concerning you that is based on Article 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.

If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority in accordance with Article 77 of the GDPR, without prejudice to any other administrative or judicial remedy. This right exists in particular in the member state of your place of residence, your place of work or the place of the alleged infringement, if you are of the opinion that the processing of personal data concerning you violates the GDPR.

Subject to change

We reserve the right to change the security and data protection measures at any time. Please therefore note the current version of this data protection notice.