robatherm GmbH + Co. KG
John-F.-Kennedy-Str. 1
89343 Jettingen-Scheppach, Germany
Telephone: +49 8222 999-0
E-Mail: info@robatherm.com

To the
Data Protection Officer
c/o robatherm GmbH + Co. KG
John-F.-Kennedy-Str. 1
89343 Jettingen-Scheppach, Germany
Telephone: +49 8222 999-0
E-Mail: info@robatherm.com

You are entitled

• pursuant to Art. 15 GDPR to access information concerning your personal data processed by us;
• pursuant to Art. 16 GDPR to immediately request completion or the rectification of incorrect of your personal data stored by us;
• pursuant to Art. 17 GDPR to request erasure of your personal data stored by us;
• pursuant to Art. 18 GDPR to request restricted processing of your personal data;
• pursuant to Art. 20 GDPR to receive your personal data, which you provided to us, in a structured, commonly used, and machine-readable format or to request transmission to another controller;
• pursuant to Art. 21 to object to the processing of your personal data;
• pursuant to Art. 7 Abs. 3 GDPR at any time to withdraw consent granted to us, with the consequence that our processing based on such consent will be prohibited for the future without affecting the lawfullness of any processing that occurred prior to your withdrawal of your consent;
• pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority.

In the event that you have questions that are not answered in this privacy statement or if you would like to have more in-depth information for any matter in this regard, please contact us at any time through the contact information listed above.

We do not use purely automated processing operations to reach a decision.

This Privacy Notice was last updated in october 2022. It may become necessary to modify this privacy statement due to the continuous development of our website or modified statutory or official requirements. The respective current Privacy Notice is available under https://robatherm-online.de/en/privacy-notice.

When accessing our website through telecommunication services, communication-oriented information (data (e.g. Internet protocol address, referrer, URL, browser) or usage-oriented data (e.g. information concerning start and duration of use and the telecommunication services used by you) are automatically generated by technical means. These generally do not allow us to determine the identity of the website user.

Such data is collected and used to ensure a seamless connectivity of the website and convenient use of our website. This information is furthermore used to evaluate system security and stability and for other administrative purposes. Such data is processed within the scope of our legitimate interests (Art. 6 (1) Clause 1 lit. f GDPR). Such data will be erased if they are no longer required for the stated purposes.

Our websites and the services offered thereon are supported by technical service providers on our behalf (e.g. hosting). Personal data collected through this website is generally not transmitted unless specified otherwise below. This also applies to a transfer to third countries or international organizations.

If you have given your consent, we use the service "Google Analytics" provided by Google LLC on our website. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter „Google“).

Scope of processing
Google Analytics uses cookies that enable an analysis of your use of our website. The information collected by means of the cookies about your use of this website is usually transferred to a Google server in the USA and stored there.

We use the function 'anonymizeIP' (so-called IP-Masking): Due to the activation of the IP anonymization on this website, your IP-address will be abbreviated by Google within the Member States of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.

During your website visit, the following data, among others, is collected:
• The pages you have visited on our website, i.e. your "click path”
• Achievement of "website goals" (conversions, e.g. newsletter registrations, downloads, purchases)
• Your user behavior (e.g. clicks, dwell time, bounce rates)
• Your approximate location (region)
• Your IP address (in abbreviated form)
• Technical information about your browser and the end devices you use (e.g. language settings, screen resolution)
• Your internet provider
• The referrer URL (via which website/advertising medium you came to this website)

Purpose of processing
Google uses this information on behalf of robatherm to evaluate your (pseudonymous) use of the website and to compile reports on website activities. The reports provided by Google Analytics serve to analyse the performance of our website and the success of our marketing campaigns.

Recipient
The recipient of the data we send and which is linked to cookies is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as processor on behalf of robatherm. We have entered into a data processing agreement with Google for this purpose.

The data stored by Google may also be accessed and processed by other Google group companies, including Google LLC, based in California, USA. The United States are a so-called third country, which does not guarantees for an adequate level of protection in accordance with the requirements of the GDPR based on an adequacy decision by the European Commission pursuant to Art. 45 GDPR. It can therefore not be ruled out that US authorities may have access to this data.

The data stored by Google may also be processed by Google group companies for own purposes, such as to provide Google's web analytics and tracking services, and may be linked to your Google account, search history and other data that Google has stored about you, such as your usage data from other devices. robatherm has no influence on this data processing, so that Google alone is responsible for this data processing. Further information on how Google processes your data can be found in Google's privacy policy at https://policies.google.com/privacy.

Transfer to third countries
A transfer of data to the USA cannot be excluded.

Storage period
The data sent by us and linked to cookies are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month.

You can also prevent the collection of data related to your use of our website which is linked to cookies (including your IP address) and the processing of this data by Google by
• not give your consent to the setting of the cookie or
• download and install the browser add-on for deactivating Google Analytics here.

You can also prevent the storage of cookies by setting your browser software accordingly. However, if you configure your browser to refuse all cookies, this may limit the functionality of this and other websites.

Legal basis and possibility of revocation
The legal basis for this data processing is your consent, Art.6 para.1 S.1 lit. a GDPR. You can revoke your consent at any time with future effect by calling up the cookie settings and changing your selection there (further information can be found in point 9 "Use of cookies").

Further information on Google Analytics can be found in Google's Terms of Use at https://marketingplatform.google.com/about/analytics/terms/us/ and Google's Privacy Policy at https://policies.google.com/?hl=en.

On this website - if you have consented to the use of cookies - DoubleClick of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, ("Google") (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA is utilized. This is done to deliver ads that are relevant to you, to improve campaign performance and to prevent you from seeing the same ads more than once. For this purpose, a cookie is set to register and report your actions on the website after you have seen or clicked on one of the ads. For more information about the cookies that are set, please refer to section 9.

DoubleClick also uses cookie IDs to track conversions related to ad requests. This is the case if e.g. you see a DoubleClick ad and later visit and purchase from the advertiser's website using the same browser.

Because of the use of Google DoubleClick, your browser establishes a direct connection with Google's server, which transfers data to Google, over which we have no control.

Your data will also be stored and processed by Google in third countries, i.e. in countries outside the EU that do not have an adequate level of data protection, such as the USA. In order to ensure the protection of your personal data, we have concluded EU standard contractual clauses with Google in accordance with European data protection law. You can obtain a copy upon request by contacting our data protection officer at the contact details provided above (see Part 1, Item 2).

The legal basis for this processing is your consent (Art. 6 (1) Clause 1 lit. a GDPR).

Further information about Google DoubleClick can be found at www.google.de/intl/en/policies/privacy and at https://support.google.com/dcm/answer/9015629?hl.

On this website, YouTube video content of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, ("Google") (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA is embedded. For this purpose, information such as your IP address and other technical data may be transmitted to Google. If you are logged on to YouTube, Google may assign this information to your personal user account on this platform. You can prevent such assignment by logging out of your user account from the third party service before visiting our website.

Corresponding data is collected and processed in order to be able to offer you corresponding video content. This is a legitimate interest in the sense of the GDPR. The legal basis is Art. 6 (1) Clause 1 lit. f GDPR.

Your data will also be stored and processed by Google in third countries, i.e. in countries outside the EU that do not have an adequate level of data protection, such as the USA. In order to ensure the protection of your personal data, we have concluded EU standard contractual clauses with Google in accordance with European data protection law. You can obtain a copy upon request by contacting our data protection officer at the contact details provided above (see Part 1, Item 2).

We have activated the extended data protection mode for YouTube. According to YouTube/Google, in such a case no information about the visitors is stored unless they watch a video. In such a case, a connection to the YouTube servers is established and the content is displayed on the website by notifying your browser. Due to the activation of the extended data protection mode, a "youtube-nocookie" cookie is set in order to ensure that no data is processed for video integration that is not absolutely necessary for this purpose; the legal basis for this is Art. 6 (1) Clause 1 lit. f GDPR (legitimate interest).

The privacy policy of Google can be found at https://policies.google.com/privacy?hl=en.

This website may include content from the video portal Youku Tudou Inc. 11/F, SinoSteel Plaza, 8 Haidian Street, Beijing 100080, China ("Youku") (parent company: Alibaba Group Holding Limited).

To enable the provision of the content, information such as your IP address and other technical data may be transmitted to Youku. If you are logged on to Youku as a user, Youku may assign this information with your personal user account. You can usually prevent such assignment by logging out of your user account at the corresponding third party service before visiting our website.

In this context, data is processed in order to be able to offer you video content.

We use the necessary cookies to ensure security when browsing. The legal basis for this processing is therefore Art. 6 (1) Clause 1 lit. f GDPR (legitimate interest in the secure operation of our services).

If you have agreed to the use of cookies, further cookies from "Alibab.com" or "Youku" will be used. This is done, among other things, for the purpose of displaying content in accordance with the settings you have made as well as for marketing (e.g. to display advertising that is in line with your interests, for conversion tracking and for measuring the effectiveness of online advertising) and statistical purposes (e.g. evaluation of user behavior). The legal basis for this is your consent (Art. 6 (1) Clause 1 lit. a GDPR).

For this purpose, data will be transmitted to Youku and possibly also to Alibaba Group Holding Limited in China. Please note that in China it might not exist the same level of data protection as in Europe and that, e.g. the enforcement of data subjects' rights or the control of further processing and transmission of data may be more difficult (see Art. 49 (1) lit. a GDPR).

For further information on how personal data is processed, please refer to Youku's data protection information, which can be found at http://mapp.youku.com/service/flsm2018.

We maintain online profiles on social media of the following platform operators and at the addresses below:

Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
• Our profile: https://www.facebook.com/robatherm
• Data privacy statement of the platform: https://www.facebook.com/about/privacy/
• Information on joint processing pursuant to Art. 26 GDPR: https://www.facebook.com/legal/terms/page_controller_addendum
• Further information on Facebook Insights: https://www.facebook.com/business/pages/manage#page_insights

Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
• Our profile: https://www.instagram.com/robatherm
• Data privacy statement of the platform: http://instagram.com/about/legal/privacy/

Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany)
• Our profile: https://www.xing.com/companies/robatherm
• Data privacy statement of the platform: https://privacy.xing.com/de/datenschutzerklaerung

Linkedin (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
• Our profile: https://www.linkedin.com/company/robatherm
• Data privacy statement of the platform: https://www.linkedin.com/legal/privacy-policy
• Cookie-Policy: https://www.linkedin.com/legal/cookie-policy

Google/ YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
• Our profile: https://www.youtube.com/robathermtv
• Data privacy statement of the platform: https://policies.google.com/privacy

Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland)
• Our profile: https://twitter.com/robatherm/
• Data privacy statement of the platform: https://twitter.com/de/privacy

Within the scope of the use of our profiles on social media, personal data are collected by different data controllers for various purposes. As soon as you visit one of our profiles, the platform operators collect and process personal data for the purpose of enabling the use of their services and possibly other purposes (see below, “Processing by platform operators”). It can also happen that you contact us about this and we collect and process personal data in the course of the contact or we process personal data that is available to us (e.g. a post) due to legal obligations (see below, “Processing by robatherm”).

Processing by robatherm
With regard to our profiles on social media, personal data are generally processed – unless described otherwise below – on the legal basis of Art. 6 (1) sent. 1 lit. f) GDPR because of our legitimate interests in public relations, communication and product improvement, unless stated otherwise herein below.
We can read posts and similar interactions on our online profiles and also see your public profile (depending on which data you have released for display). We may use this information under certain circumstances to improve our products and information, in particular on the platforms.

If you contact us via our online profiles on social media, we will process the data that you make available to us in the course of establishing contact to answer your request. Under certain circumstances, we may then answer your request via the respective platform. In this context, we would like to point out that the communication via the platform is potentially insecure and that you can contact us at any time using different channels, and you will then also receive a reply via different channels. The legal basis for this is regularly Art. 6 (1) sent. 1 lit. b) GDPR (initiation of a contract and/or performance of a contract with regard to the answering of a request).

In individual cases, it can furthermore be required that we process data posted to our online profiles on social media or transmitted to us due to legal obligations (e.g. for the purpose of transferring them to authorities or courts) or for the purpose of product monitoring and product safety (e.g. when faults of our products are reported via this channel). The legal basis for this is Art. 6 (1) sent. 1 lit. c) GDPR.

In addition, the platforms provide us in individual cases with aggregated, anonymized statistics on usage, which we use to analyze usage behavior and improve our information offer. The platform operators may have prepared these statistics, if applicable, also on the basis of personal user data. Please find more information on the relevant services and analysis options in the data privacy statements of the respective platform operators linked to above (see the separate information below regarding data processing on Facebook).

With regard to the processing activities mentioned above, you have certain rights as data subject in accordance with Art. 12 seqq. GDPR. Irrespective of whether we shall be regarded as the data controller within the meaning of the GDPR for all of the above-mentioned processing activities in the individual case, you can, of course, also assert your rights as data subject against us. Part 1 / Number 3 applies accordingly to this extend. Please use the contact details specified in Part 1 for corresponding requests. In case we do not have sufficient influence on the respective data processing in individual cases, we reserve the right to refer individual questions to the respective platform operator to the extent permitted by law.

Please refer to the respective linked data privacy statements for further information on the possible assertion of rights of data subjects against the platform operator.

Processing by the platform operator
When accessing our profiles, personal data are processed to the extent that this is required for calling up the pages and creating user statistics by the platform operator (regarding Facebook, see the particularities in the supplementing information below). We have no influence on the processing of personal data by the platform operators. We also do not know all purposes of the processing or the storage periods nor the extent of the data collection by the platform operator. According to experience, the platforms process the data for the purposes of advertising, market research and demand-oriented design of the platforms. You can find more details in the data privacy statements of the individual platform operators linked above. As far as we have the possibility to do so, we will work towards a handling of personal data by the respective platform operators in line with the principles of data protection and data minimization. However, our possible influence is limited.

Further information
If you publish data on our social media profiles (e.g. text comments, videos, photos and other posts) or interact otherwise on them (e.g. by clicking the “like” button), these data will be processed and published by the respective platform operator. To the extent that it is possible and appears necessary to us, it can happen that, in individual cases, we or the platform operator will delete inappropriate contents published by you in accordance with the common procedures and policies of the respective platform.

In principle, we do not transmit data to third countries that we receive in the course of the procedure described above under “Data processing by Robatherm”. If this should be done as an exception, we shall observe the applicable statutory provisions of Art. 44 seqq. GDPR (e.g. by concluding EU standard contractual clauses). Please refer to the data privacy statements of the respective platform operators linked above as to whether your data is transmitted to third countries by the platform operators.

Unless described otherwise in this Section, the remaining information in Part 1 applies accordingly.

In order to generate usage statistics on Facebook (Facebook Insights) various data provided by you, including personal data, is processed by Facebook Ireland and us as joint controllers within the meaning of Art. 26 GDPR. The legal basis for the processing of personal data in this context is Art. 6 (1) sent. 1, lit. f) GDPR (legitimate interests) or, if a consent has been obtained, Art. 6 (1) sent. 1 lit. a) and Art. 7 GDPR (consent). The legitimate interest in this is also in informing you effectively, being able to communicate with you, and improving the information offer, in particular our profile on Facebook.

You can find the relevant information on the corresponding agreement according to Art. 26 GDPR between Facebook Ireland and us, and information on whom you can contact to assert your rights as a data subject at https://www.facebook.com/legal/terms/page_controller_addendum.

Regardless of the information in the referenced agreement, it is at your discretion to assert your rights as data subject against us and Facebook.

When you visit our online presence on Facebook, your data is transmitted to third countries, among others by Facebook, i.e. in countries outside the EU that do not have an adequate level of data protection, such as to Facebook Inc. in the USA, where it is stored and processed. To ensure an adequate level of data protection when transferring data to third parties, Facebook has, according to its own information, concluded so-called EU standard contractual clauses with the recipients in third countries. You can find more information about how Facebook processes personal data at https://www.facebook.com/about/privacy/?hl=en.

If you contact us via Xing or Linkedin regarding posted jobs or otherwise for the purpose of applying for a job at our company, the legal basis for the processing of the respective data is Art. 88 GDPR in conjunction with Sec. 26 (1) sent. 1 BDSG [German Federal Data Protection Act] (initiation of an employment relationship).

If you would like to apply for jobs we advertise via Xing and Linkedin and click on “apply”, you will be redirected to the website of one of our service providers. You can find more information on the processing by these providers in Part 6 – Information for job applicants – in this Data Privacy Statement.

How and for what purpose we process personal data in the context of processing job applications is also described in Part 6 – Information for job applicants.

If you, as a customer or interested party, establish business contact with us or maintain a business relationship with us, then we process the following types of personal data:

• address information,
• contact information (generally (cell) phone number, fax number, email address, including name and other details concerning contact persons or personal contact information),
• contract data,
• creditworthiness data (in this regard we are working with the credit insurer Euler Hermes Deutschland Niederlassung der Euler Hermes SA (Friedensallee 254, 22763 Hamburg), i.e. for each customer or each project, we query the commercial credit amount for the customer from Euler Hermes Deutschland),
• tax-relevant information (e.g. VAT ID no.),
• support information (e.g. customer development, product or contractual interests),
• statistical data,
• billing and service data,
• banking information.

Data is processed for the purpose of creating offers and processing orders and delivering goods. Data is also processed for invoicing and payment. Data is processed for the performance of the contract to which you are a party or in order to take steps at your request prior to entering into a contract (Art. 6 (1) Clause 1 lit. b GDPR).

Data is also processed for the purpose of a credit check. Our interest in this consists of reviewing the solvency of a customer in order to safeguard against payment defaults. This processing safeguards our legitimate interests (Art. 6 (1) Clause 1 lit. f GDPR), whereby overriding interests of the data subject do not exist.

For the rest, data is processed for the purpose of after sales service, i.e. in order to support you in your use of our products even after a purchase. In this regard, data is processed for the performance of the contract to which you are a party (Art. 6 (1) Clause 1 lit. b GDPR) or insofar as such pertains to direct marketing measures based on our legitimate interest (Art. 6 (1) Clause 1 lit. f GDPR), and subject to consent possibly to be obtained in the individual case (Art. 6 (1) Clause 1 lit. a GDPR).

If you have, in the course of an inquiry and/or the sale of one of our products, provided us with your e-mail address, we use the e-mail address to send you information about similar products and services.

You can object to this processing at any time and free of charge.
The legal basis for the processing of this personal data is - notwithstanding separate consent (Art. 6 (1) Clause 1 lit. a GDPR) - our legitimate interest (Art. 6 (1) Clause 1 lit. f GDPR) in such direct marketing.

For the purposes of the credits check listed in Section 17 and 18, our credit insurer will receive customer data (company name and address) as well as information concerning the value of goods to be insured so that the insurer can create of an offer for us.

For the rest, we are commissioning external service partners for services (e.g. rectification of defects, startup operation) at our customers. For this purpose, the service partners will receive customer data (e.g. name of the customer, contact information, address). This is for the performance of the contract to which you are a party (Art. 6 (1) Clause 1 lit. b GDPR), whereby we conclude all necessary contracts with our partners.

We process the following types of data of suppliers:

• address information,
• contact information (generally (cell) phone number, fax number, email address, including name and other details concerning contact persons or personal contact information),
• contract data,
• tax-relevant information (e.g. VAT ID no.),
• supplier evaluation,
• statistical data,
• billing and service data,
• banking information

Processing is for the purpose of creating inquiries, reviewing offers, and ordering. The data is also processed for invoicing and payment. Our interest in this regard is that we are able to order products from you. This processing safeguards are legitimate interests (Art. 6 (1) Clause 1 lit. f GDPR).

For the rest, processing is for the purpose of invoice auditing. Our interest in this regard is that we do not pay any erroneous invoice amounts. This processing is necessary for performance of the contract (Art. 6 (1) Clause 1 lit. b GDPR).

Your data is also processed for the purpose of payment. This is necessary for the performance of the contract to which you are a party (Art. 6 (1) Clause 1 lit. b GDPR).

Your data is collected only to fill positions within robatherm. We keep your data confidential and do not pass it on to third parties.

If you apply for a job via the websites of other providers (currently yourfirm.de, operated by yourfirm GmbH, to which it may be referred in our social media profiles), your data will be gathered by the respective provider and transferred to us for the purpose of processing your job application, whereby your data will not be stored by the service providers. Furthermore, the click rates of the respective job ad will be gathered and transferred to us. In addition, the service provider will send you a confirmation when the application has been successfully sent to us and a copy of the transmitted data if requested by you. You can find the data privacy statement of the currently engaged service provider yourfirm GmbH at https://www.yourfirm.de/datenschutz/.

We also cooperate with service providers that publish our job ads and merely set a link to our website to which you can then transmit your application data. In that case, no application data will be processed by the service providers and merely the click rates of the respective ad will be documented. These service providers currently include stellenanzeigen.de GmbH & Co. KG (data privacy statement available at https://www.stellenanzeigen.de/ueber-uns/datenschutzerklaerung/) and Presse- Druck- und Verlags-GmbH (data privacy statement available at https://www.augsburger-allgemeine.de/unternehmen/Datenschutzerklaerung-und-Informationspflichten-nach-Art-13-DSGVO-id10487051.html).

We use the click rates to analyze how worthwhile corresponding job ads are so we can improve the design of the job ads in the future. This, however, involves merely aggregated data that we cannot attribute to any specific person.

When calling up the websites of the respective service providers, the personal data are processed by the service provider to the extent that this is necessary for retrieving the pages. We have no influence on the processing of personal data by the respective service providers. Neither do we know all purposes of the processing nor the storage periods nor the extent of the data collection by the service providers. According to experience, the platforms process the data for the purposes of advertising, market research and demand-oriented design of the platforms. You can find more details in the data privacy statements of the individual platforms linked above. As far as we have the possibility to do so, we will work towards a handling of personal data by the respective service providers in line with the principles of data protection and data minimization. However, our possible influence is limited.

Regarding the possible assertion of rights of data subjects against the respective service providers, please find more information in the respectively linked data privacy statements or the data privacy information that is accessible on the website of the respective service provider.

Irrespective of whether we shall be regarded as data controller within the meaning of the GDPR regarding the aforementioned processing activities in the individual case, you can, of course, also assert any rights as data subject arising from the respective processing activities (also such in the area of responsibility of our service provider) against us. Part 1 / Number 3 applies accordingly to this extend. Please use the contact details specified in Part 1 for corresponding requests. In case we do not have sufficient influence on the respective data processing, we reserve the right to refer individual questions to the respective platform operator to the extent permitted by law.

We process the following personal data within the scope of the job application process:

• your master data (e.g. first name, last name, affixes, date of birth),
• work permit/residence permit, if necessary,
• contact information (e.g. personal address, (cell) phone number, email address),
• photo, if applicable
• skill information (e.g. special skills and proficiencies),
• if relevant for the advertised position: fitness for duty.

Your personal data is generally collected directly from you within the scope of the application process, in particular from the job application documents, the job interview, and the staff questionnaire.
We may also receive data from third parties, (e.g. employment agencies).
We also process your personal data that we permissibly gain from publicly accessible sources (e.g. professional networks).

Data processing chiefly serves to establish an employment relationship. The predominant legal basis for this is Art. 88 (1) GDPR in conjunction with Section 26 (1) German Federal Data Protection Act (new) (Bundesdatenschutzgesetz (neu), BDSG).

Your data is processed exclusively to fill the specific position for which you have applied.

The processing of health data may also be necessary for the assessment of your working capacity pursuant to Art. 9 (2) lit.h GDPR in conjunction with Section 22 (1) lit.b BDSG.

If, in the event of a rejection, you wish to be included in our pool of applicants or if your application is to be taken into consideration for other vacancies in the company/group, we require a declaration of consent from you for this purpose.

If contact is initiated via corresponding service providers, the legal basis for their involvement, besides Art. 88 (1) GDPR in conjunction with Sec. 26 (1) BDSG, is also Art. 6 (1) lit. f) GDPR if applicable (legitimate interests). Our legitimate interests are being able to organize our application processes and HR marketing efficiently. With regard to the processing of the transmitted anonymized click rates, our legitimate interest is being able to analyze the efficiency of cooperating with the service providers and improve the design of the job ads in the future.

If you are hired, we transfer your application records to your personnel file. After the end of your employment, the personal data that we are legally obligated to retain will continue to be stored. This generally is the based on statutory retention obligations and obligations to provide proof, which, among other things, are stipulated in the German Commercial Code (Handelsgesetzbuch, HGB) and the German Tax Code (Abgabenordnung, AO). According to these, retention periods are up to 10 years. Personal data may also be retained for the duration during which claims can be asserted against us (statutory limitation period from 3 or to up to 30 years).

In the event of a rejection, your application documents will be deleted no later than 6 months after the completion of the application process, unless you have granted us consent for a longer retention period (applicant pool).

Your online application data will be encrypted and transferred with state-of-the-art technology. If you transmit an unsolicited online application to robatherm or apply for a current vacancy, your application data will be stored in our software-based applicant management system.

From processing technology aspects, your written application will be handled like an online application. Your original documents will be returned to you at the latest upon conclusion of the staffing process.

robatherm GmbH + Co. KG
John-F.-Kennedy-Str. 1
89343 Jettingen-Scheppach, Germany
Telephone: +49 8222 999-0
Email: info@robatherm.com

To the
Data Protection Officer
c/o robatherm GmbH + Co. KG
John-F.-Kennedy-Str. 1
89343 Jettingen-Scheppach, Germany
Telephone: +49 8222 999-0
Email: info@robatherm.com

You are entitled

• pursuant to Art. 15 GDPR to request information concerning your personal data processed by us;
• pursuant to Art. 16 GDPR to immediately request completion or the rectification of your incorrect personal data stored by us;
• pursuant to Art. 17 GDPR to request erasure of your personal data stored by us;
• pursuant to Art. 18 GDPR to request restricted processing of your personal data;
• pursuant to Art. 20 GDPR to receive your personal data, which you provided to us, in a structured, commonly used, and machine-readable format or to request transmission to another controller;
• pursuant to Art. 21 to object to the processing of your personal data;
• pursuant to Art. 7 (3) GDPR at any time to withdraw consent granted to us, with the consequence that our processing based on such consent will be prohibited for the future without affecting the legality of any processing that occurred prior to your withdrawal of your consent;
• pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority.

In the event that you have questions that are not answered in this privacy statement or if you would like to have more in-depth information for any matter in this regard, please contact us at any time through the contact information listed above.

When using the app, we collect the following personal data to enable the comfortable use of functions. We collect the following data if you would like to use the app, as they are necessary for us from a technical aspect to offer you the functions of our mobile app and to ensure stability and security:

• IP address,
• Date and time of inquiry,
• Time zone difference to Greenwich Mean Time (GMT),
• Content of the request (specific page),
• Access status / HTTP status code,
• The respective transmitted data volume,
• Website from which the inquiry originates,
• Browser,
• Operating system and its interface,
• Language and version of the browser software.

This serves to safeguard our legitimate interests, the legal basis for this is Art. 6 (1) Clause 1 lit. f GDPR. Our interest in this regard is the ability to offer a comfortable use of functions to users.

Data will be erased if the data is no longer required for the stated purposes.

If you register, the following data will be processed (mandatory information):

• First name,
• Last name,
• Password,
• Email.

Insofar as such is voluntarily provided by you, the following data is also processed (optional information):

• Company,
• Address,
• Postal code,
• Town.

This data is collected to prevent abuse because it allows individual users to be excluded from further use. Name and first name are also requested to enhance the user experience. This is covered by our legitimate interests, Art. 6 (1) Clause 1 lit. f GDPR. Company and address are voluntary information and can be used by the user for customization. Processing is also based on our legitimate interests and also serves to enhance the user experience. This is necessary to safeguard our legitimate interests. The legal basis for this collection is Art. 6 (1) Clause 1 lit. f GDPR.

Data will be erased if it is no longer required for the stated purposes. Data retention may, among other things, continue for as long as claims can be asserted against us based on the provided services and/or for as long as we may require the relevant data for the purpose of a legal defense.

The collection of this data is not required by law or contractually, nor is it obligatory, however, mandatory information is necessary for registration. Non-provision of data will result in your inability to register. As a consequence, the full functionality of the app will not be available to you. A data exchange across multiple devices will then, for example, not be possible.

If you establish contact with us by email or through a contact form, your email address, and - if provided by you - your name and your telephone number will be stored by us to answer your questions. This is necessary for the performance of the contract to which you are a party or in order to take steps prior to entering into a contract (Art. 6 (1) Clause 1 lit. b GDPR) or to safeguard our legitimate interests (Art. 6 (1) Clause 1 lit. f GDPR). Our legitimate interest in this is a satisfactory processing of your inquiry.

We will erase the data collected in this regard after retention is no longer necessary.

This privacy notice is valid as of october 2022. It may be necessary to modify this privacy statement due to continued development of our website or modified statutory or official requirements. The respective updated privacy notice is available at https://www.robatherm.com/en/privacy-notice.

robatherm GmbH + Co. KG
John-F.-Kennedy-Str. 1
89343 Jettingen-Scheppach, Germany
Telephone: +49 8222 999-0
Email: info@robatherm.com

To the
Data Protection Officer
c/o robatherm GmbH + Co. KG
John-F.-Kennedy-Str. 1
89343 Jettingen-Scheppach, Germany
Telephone: +49 8222 999-0
Email: info@robatherm.com

You are entitled

• pursuant to Art. 15 GDPR to request information concerning your personal data processed by us;
• pursuant to Art. 16 GDPR to immediately request completion or the rectification of your incorrect personal data stored by us;
• pursuant to Art. 17 GDPR to request erasure of your personal data stored by us;
• pursuant to Art. 18 GDPR to request restricted processing of your personal data;
• pursuant to Art. 20 GDPR to receive your personal data, which you provided to us, in a structured, commonly used, and machine-readable format or to request transmission to another controller;
• pursuant to Art. 21 to object to the processing of your personal data;
• pursuant to Art. 7 (3) GDPR at any time to withdraw consent granted to us, with the consequence that our processing based on such consent will be prohibited for the future without affecting the legality of any processing that occurred prior to your withdrawal of your consent;
• pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority.

In the event that you have questions that are not answered in this privacy statement or if you would like to have more in-depth information for any matter in this regard, please contact us at any time through the contact information listed above.

If you register, the following data will be processed (mandatory information):

• First name,
• Last name,
• Password,
• Email

This data is collected to prevent abuse because it allows individual users to be excluded from further use. Name and first name are also requested to enhance the user experience. This is covered by our legitimate interests, Art. 6 (1) Clause 1 lit. f GDPR. Company and address are voluntary information and can be used by the user for customization. Processing is also based on our legitimate interests and also serves to enhance the user experience. This is necessary to safeguard our legitimate interests. The legal basis for this collection is Art. 6 (1) Clause 1 lit. f GDPR.

Data will be erased if it is no longer required for the stated purposes. Data retention may, among other things, continue for as long as claims can be asserted against us based on the provided services and/or for as long as we may require the relevant data for the purpose of a legal defense.

The collection of this data is not required by law or contractually, nor is it obligatory, however, mandatory information is necessary for registration. Non-provision of data will result in your inability to register. As a consequence, the full functionality of the app will not be available to you. A data exchange across multiple devices will then, for example, not be possible.

If you establish contact with us by email or through a contact form, your email address, and - if provided by you - your name and your telephone number will be stored by us to answer your questions. This is necessary for the performance of the contract to which you are a party or in order to take steps prior to entering into a contract (Art. 6 (1) Clause 1 lit. b GDPR) or to safeguard our legitimate interests (Art. 6 (1) Clause 1 lit. f GDPR). Our legitimate interest in this is a satisfactory processing of your inquiry.

We will erase the data collected in this regard after retention is no longer necessary.

The app uses cookies. Cookies are small text files that are stored on the drive of your mobile end device and that are allocated to the mobile app used by you. We can receive certain information through cookies. Cookies cannot execute any programs or transfer viruses to your mobile end device. They serve to make mobile apps more user-friendly and more effective overall.

This mobile app uses the following types of cookies:

• Transient cookies: These are erased automatically if you close our mobile app. It includes specifically session cookies. Session cookies store a so-called session ID, which can be used to allocate various inquiries to your mobile app. This allows a recognition of your mobile end device when you next use our mobile app. Session cookies are erased if you log out or close the app.
• Persistent cookies: These are automatically erased after a prespecified period that may differ depending on the cookie.

You can configure the settings of your mobile operating system and of the app as you wish and, e.g., refuse acceptance of third party cookies or all cookies. However, in such a case you may not be able to use all functions of our mobile app.

This privacy notice is valid as of october 2022. It may be necessary to modify this privacy statement due to continued development of our website or modified statutory or official requirements. The respective updated privacy notice is available at https://www.robatherm.com/en/privacy-notice.

The contact detail of your local data protection officer/representative is as follows:
Email: DataProtectionChina@robatherm.com

You are entitled

• pursuant to Art. 44 PIPL to be informed, decide on, restrict, or reject the processing of your personal information;
• pursuant to Art. 45 PIPL to access and duplicate your personal information;
• pursuant to Art. 46 PIPL to request correction and completion of your personal information;
• pursuant to Art. 47 PIPL to request erasure of your personal information by us under certain circumstances;
• pursuant to Art. 48 PIPL to request explanation of our personal information processing rules;
• pursuant to Art. 15 PIPL at any time to withdraw consent granted to us, with the consequence that our processing based on such consent will be prohibited for the future without affecting the lawfullness of any processing that occurred prior to your withdrawal of your consent;
• to other rights as provided for by PRC laws and regulations

In the event that you have questions that are not answered in this privacy notice or if you would like to have more in-depth information for any matter in this regard, please contact us at any time through the contact information listed above.

Further information, paragraph 2
In principle, we do not transfer your personal information that we receive in the course of the procedure described above under “Processing by robatherm” to third parties. If this should be done due to our business needs, we will ask for your separate consent to this effect and fulfill all applicable obligations as stipulated by PIPL and other PRC data protection laws and regulations before transferring your personal information. As to whether your personal data is transmitted out of PRC by the platform operators, please refer to the data privacy statements of the respective platform operators.

In order to generate usage statistics on Facebook (Facebook Insights) various data provided by you, including personal data, is processed by Facebook Ireland and us as joint controllers within the meaning of Art. 26 GDPR. The legal basis for the processing of personal data in this context is Art. 6 (1) sent. 1, lit. f) GDPR (legitimate interests) or, if a consent has been obtained, Art. 6 (1) sent. 1 lit. a) and Art. 7 GDPR (consent). The legitimate interest in this is also in informing you effectively, being able to communicate with you, and improving the information offer, in particular our profile on Facebook.

You can find the relevant information on the corresponding agreement according to Art. 26 GDPR between Facebook Ireland and us, and information on whom you can contact to assert your rights as a data subject at https://www.facebook.com/legal/terms/page_controller_addendum.

Regardless of the information in the referenced agreement, it is at your discretion to assert your rights as data subject against us and Facebook.

When you visit our online presence on Facebook, your data is transmitted to third countries, among others by Facebook, i.e. in countries outside the EU that do not have an adequate level of data protection, such as to Facebook Inc. in the USA, where it is stored and processed. To ensure an adequate level of data protection when transferring data to third parties, Facebook has, according to its own information, concluded so-called EU standard contractual clauses with the recipients in third countries. You can find more information about how Facebook processes personal data at https://www.facebook.com/about/privacy/?hl=en.

If you contact us via Xing or Linkedin regarding posted jobs or otherwise for the purpose of applying for a job at our company, the legal basis for the processing of the respective data is Art. 88 GDPR in conjunction with Sec. 26 (1) sent. 1 BDSG [German Federal Data Protection Act] (initiation of an employment relationship).

If you would like to apply for jobs we advertise via Xing and Linkedin and click on “apply”, you will be redirected to the website of one of our service providers. You can find more information on the processing by these providers in Part 6 – Information for job applicants – in this Data Privacy Statement.

How and for what purpose we process personal data in the context of processing job applications is also described in Part 6 – Information for job applicants.

Your personal information as mentioned in section 17 is mainly processed for the purposes of:
(1) establishing the contract with you, e.g. creating offers, processing orders, credit check by which we review the solvency of a customer in order to safeguard against payment defaults, taking steps at your request prior to entering into a contract;
(2) performing the contract concluded with you, e.g. delivering goods, invoicing and payment, after sales service.

You hereby agree that we may process your personal information for the purposes and in the way described above. As far as the processing of your sensitive personal information is concerned, we will ask for your separate consent in advance.

You hereby agree for us to disclose or use your personal information for the purpose of identifying or confirming your identity, settling disputes, or helping protect the safety of this website and restrict fraud, illegal or other criminal activities, in order to implement our agreement with you.

You agree for us to disclose or use your personal information for the purpose of protecting your life and property, preventing the serious infringement upon others' legitimate rights and interests or safeguarding public benefits.

You agree for us to disclose or use your personal information for the purpose of improving our services, which will enable our services to better satisfy your needs and ensure you have better user experience whiling using our services.

Without prejudice to your statutory right to withdraw your consent, we may still process your personal information for above purposes after your withdrawal of consent to the extent permitted by applicable PRC laws, in particular Art. 13 PIPL.

If you have, in the course of an inquiry and/or the sale of one of our products, provided us with your e-mail address, we use the e-mail address to send you information about similar products and services subject to your prior consent. Such consent can be withdrawn at any time by contacting us.

We may disclose information on your personal identifications upon request of any court summons or court order from any place of the world or as required by any law enforcement organs or other government institutions. We may also disclose information on your personal identifications under the following circumstances where we deem it necessary to do so, for example, to investigate or prevent any confirmed or suspected illegal activity or any other misconduct, or to take any other action against such activity or misconduct, or to protect and defend the rights, properties and safety of robatherm and its affiliates, our users or others. If any of the above-said circumstances (where any serious security flaw appears) arises, we will adopt commercially reasonable methods to make you aware of the fact that we will disclose information on your personal identifications to others beyond clauses as agreed in this Privacy Notice.

Processing is for the purpose of creating inquiries, reviewing offers, and ordering. The data is also processed for invoicing and payment. For the rest, processing is for the purpose of invoice auditing. Your data is also processed for the purpose of payment. This is necessary for the performance of the contract to which you are a party (Art. 13 PIPL).

Your personal information as mentioned in section 22 is mainly processed for the purposes of:
(1) establishing the contract with you, e.g. creating inquiries, reviewing your offers and our ordering;
(2) performing the contract concluded with you, e.g. invoicing, payment invoice auditing.

You hereby agree that we could process your personal information for the purposes and in the way described above. As far as the processing of your sensitive personal information is concerned, we will ask for your separate consent in advance.

Without prejudice to your statutory right to withdraw your consent, we may still process your personal information for above purposes after your withdrawal of consent to the extent permitted by applicable PRC laws.

If you register, this shall be deemed as consent and the following data will be processed (mandatory information):

• First name,
• Last name,
• Password,
• E-Mail,

Insofar as such is voluntarily provided by you, the following data is also processed (optional information):

• Company,
• Address,
• Postal code,
• Town,

Please note that non-provision of mandatory information will result in your inability to register. As a consequence, the full functionality of the app will not be available to you. A data exchange across multiple devices will then, for example, not be possible.

Your above personal information will be erased if it is no longer required for the stated purposes. To the extent permitted by applicable laws, retention period may, among other things, continue for as long as claims can be asserted against us based on the provided services and/or for as long as we may require the relevant personal information for the purpose of a legal defense.