1. Name and postal address of the responsible entity.
The responsible entity, as defined by GDPR, other national data protection legislation of the member states and miscellaneous data protection regulations, is:
August Brötje GmbH
Telephone: +49 (4402) 80 0
Fax: +49 (4402) 80 583
August Brötje GmbH is part of the BDR Thermea Group (https://www.bdrthermeagroup.com)
2. Data protection officer
August Brötje GmbH
Data protection officer
3. General information about data processing
3.1. Scope of the processing of personal data
We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other data protection provisions that must be observed, and only to the extent required to provide an operational website along with our content and services.
3.2. Legal basis for the processing of personal data
• Provided that we obtain the data subject's consent to the processing of personal data, Art. 6(1)(a) EU General Data Protection Regulation (GDPR) constitutes the legal basis.
• For the processing of personal data required for performance of a contract to which the user is a party, Art. 6(1)(b) GDPR constitutes the legal basis. This also applies to the processing necessary for the completion of pre-contractual arrangements.
• Insofar as processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR constitutes the legal basis.
• If processing is necessary in order to protect a legitimate interest of our company or a third party, except where the interest in question is outweighed by the interests or fundamental rights and freedoms of the data subject, Art. 6(1)(f) GDPR constitutes the legal basis for processing. In such cases, you have the right to object in accordance with Art. 21 GDPR.
3.3. Data deletion and storage period
Personal data is deleted as soon as the purpose for which it was stored no longer applies. In addition, data may be stored if provided for by the European or national legislature in European Union regulations, acts or other provisions to which the responsible entity is subject.
4. Provision of the website
4.1. Use of web-hosting service Providers
Our website is hosted by a web-hosting service provider, on servers located in the EU, on a sub-contracted processing basis in accordance with Art. 28 GDPR. The web-hosting service provider may have access to our users' personal data when providing the services, particularly technical data generated as a result of technical communications between you and our website (e.g. server log files). The provider is not permitted to use this data for its own purposes. The use of a web-hosting service provider serves our legitimate interest in making our online service secure, available and fast. The legal basis in this respect is Art. 6(1)(f) GDPR.
4.2. Server log files
Every time you access our website, your computer system automatically sends data and information to our web server. This data is required so that you can use our website with your computer system. This data consists of:
• Type and version of the browser you use;
• Type and version of the operating system you use;
• URL of the site from which you reached our website;
• Date and time of accessing our website;
• Names of the subpages you access;
• Your computer system's IP address;
• Volume of data transferred each time.
We store this data temporarily in server log files. This data is not stored alongside any other personal data pertaining to users.
It is stored in order to ensure the security of our web servers and, if necessary, in order to assert, exercise or defend legal claims (e.g. in the event of misuse of our service) on the basis of Art. 6(1)(f) GDPR.
The stored IP addresses are deleted within seven days, unless the data in question is additionally required in order to assert, exercise or defend legal claims.
We use what are known as functional cookies, which make activities such as surfing and navigating our website more convenient for you. This entails storing such information as website settings, login status and language preferences. These cookies are either deleted as soon as your browser is closed or stored on your computer system for a specific period of time. They are deleted automatically once the period has expired. The storage periods can vary depending on the cookie.
4.4. Links to other operators' websites
At some points on our website there are links to other websites. If you click on such a link, you will be taken to the linked website. The privacy policies of the entity responsible for the website you have been taken to then apply.
5. Analysis tools and advertising
The following analysis methods employed by us are implemented on the basis of Art. 6(1)(f) GDPR. By using these analysis methods, we aim to ensure that the website is constantly optimised and the design meets users' needs. The analysis tools help us record use of our website pseudonymously, and we then assess that use in order to optimise our service. The interests are considered legitimate as defined by the aforementioned provision.
The respective opt-outs are shown for the relevant analysis tools.
5.1. Google Tag Manager
We use Google Tag Manager. Google Tag Manager does not record personal data, but the IP address of the visitor to the site is sent to Google's servers when a connection is established. Tag Manager utilises only other Google components, such as Google Analytics and scripts, and it does not access these components' data. The components utilised in each case are described separately below. You can set individual privacy preferences for them, e.g. by disabling cookies for these elements.
5.2. Google Universal Analytics (with IP anonymisation)
However, IP anonymisation (code extension "_anonymizeIP()") has been activated on this website, which means that the IP address of the user's computer system is truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before transmission to the USA, hence no direct link can be established between a particular individual and the analysis data. Only in exceptional cases is the full IP address sent to a Google server in the USA and truncated there. Google will use this information on our behalf in order to analyse use of the website, compile reports on website activity, and provide us with additional services in connection with use of the website and the internet.
The analysis data collected is deleted after 14 months.
We use the latest implementation of Google Analytics, i.e. Universal Analytics. Universal Analytics makes it possible to record user behaviour based on a pseudonymous user ID and then create a pseudonymous profile of the user with information derived from the use of different devices (known as cross-device tracking). The recording of user behaviour via a user ID is disabled on this website. This website does not use Google Analytics for cross-device analysis of visitors' behaviour via a user ID.
You can prevent analysis cookies being stored by using the relevant setting in your browser software to disable cookies automatically at a general level, but please note that, if you do so, you may not be able to use all this website's functionality in full.
You can also prevent the recording by Google of the data generated by the analysis cookie and linked to your use of the website (including your IP address), and the processing of this data by Google, by downloading and installing the browser plugin available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
As an alternative to the browser plugin, particularly for browsers on mobile devices, you can also prevent Google Analytics from recording data by clicking this link. This sets an opt-out cookie which prevents your data from being recorded in future when you visit this website. The opt-out cookie is placed on your device, affects only that particular browser, and applies only to our website. If you delete cookies in this browser, you will have to set the opt-out cookie again.
You can find further information and Google's current privacy terms at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html.
Google has signed up to the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.
5.3. Google AdWords
This website uses Google AdWords. AdWords is online-advertising software provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google).
We use what is known as conversion tracking as part of Google AdWords. If you click on an advert placed by Google, a cookie is set for conversion tracking These conversion cookies expire after 30 days and are not used to identify the individual user. If the user visits certain pages on this website and the conversion cookie has not yet expired, we and Google can detect that the user has clicked on the advert and been taken to this page.
Every Google AdWords customer is given a different cookie. The cookies cannot be tracked across the websites of AdWords customers. The information obtained via the conversion cookie is used to generate conversion statistics for AdWords customers who have opted in to conversion tracking. We find out the total number of users who clicked on our advert and were taken to a page provided with a conversion tracking tag. However, we do not receive any information that can be used to identify users personally.
Cookies for conversion tracking are stored on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising.
If you want no part of tracking, you can opt out of such use by excluding cookies at a general level via the browser settings. You will then be excluded from conversion tracking statistics. However, you may find that you can no longer use all the functionality of our website.
You can also disable cookies for conversion tracking by configuring your browser so that cookies from the domain www.googleadservices.com are blocked.
You can find more information about Google AdWords and Google conversion tracking in Google's privacy terms: https://www.google.de/policies/privacy/.
Google is certified in accordance with the EU-US Privacy Shield https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active, which means that it guarantees compliance with EU data privacy requirements.
6.1. Google Maps
This site uses the Google Maps service to display maps. The provider of this service is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use Google Maps in order to present our online services in an attractive way and to make it easy to find the places we refer to on the website. The legal basis for the use of Google Maps is Art. 6(1)(f) GDPR.
If you click on one of the Google Maps on our website, information about your use of this website and your IP address are sent to a Google server in the USA. This happens irrespective of whether you are logged in via a user account provided by Google or whether a user account exists. If you are logged into Google, your data is linked directly to your account. If you do not want this link to be made to your Google profile, you have to log out before clicking the button. The provider of this website has no control over this data transfer.
You can find further information about the purpose and scope of data collection and processing by Google at https://www.google.de/intl/de/policies/privacy.
By being certified in accordance with the EU-US Privacy Shield, https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active, Google guarantees compliance with the EU's data privacy requirements even when data is processed in the USA.
6.2. YouTube video player
The information provided by this website contains a YouTube plugin from YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. This lets you play videos held on http://www.YouTube.com directly from our website. We have a legitimate interest in providing our users with convenient and reliable functionality for playing our YouTube videos.
We use embedded YouTube videos in privacy-enhanced mode. This means that YouTube does not store cookies for a user who displays a website containing an embedded YouTube video player but does not click on the video to start playback. Only when the YouTube video player is clicked is a connection established to YouTube and can YouTube, in some circumstances, place cookies on the user's computer system, thereby facilitating the transfer of data to YouTube. However, no cookie information specific to the individual person is stored for playback of embedded videos. (Source: YouTube "Turn on privacy-enhanced mode for embedded videos”). However, if you are logged into Google, your data is linked directly to your account. If you do not want a link to be made to your profile on YouTube, you have to log out before clicking the button.
6.3. Energy-saving checks
On the subpage www.broetje.de/de/EnergiesparChecks.htm we have included services provided by the not-for-profit consultancy company co2online, Hochkirchstr. 9, D-10829 Berlin, Germany (co2online) via an iframe. If you select and use one of these services (subsidy check, new building check, modernisation check) on our website, information about your use of this website and your IP address is sent to co2online. In addition, the data you enter on the individual check forms is sent to co2online.
If you do not want this to happen, please do not use the energy-saving check services.
7. Contact form and e-mail contact
Our website provides you with a contact form that you can use to get in touch with us electronically. If you use this option, the data entered in the input mask is sent to us and stored. Required data is marked in the input mask. Required data can be supplemented by further data entered optionally on the form.
So that we can process the data, your consent to further processing is obtained when you send the form.
Alternatively, you can contact us via the e-mail address provided. If you do, the personal data sent with the e-mail is stored.
The purpose of the processing is to deal with your query. The legal basis for processing the data from the contact form is, pursuant to Art. 6(1)(a) GDPR, your consent to the processing of personal data sent by e-mail, and our legitimate interest in dealing with and responding to your enquiries pursuant to
Art. 6(1)(f) GDPR.
Specific further processing of the data you enter may take place depending on the nature of your query. Data may be passed to third parties (service providers, e.g. Brötje Kundendienst GmbH and logistics companies), if necessary for dealing with the enquiry/order. If and as long as you do not consent to other use, the data will be processed solely for dealing with enquiries/orders.
Data is deleted from our systems as soon as it is no longer required to achieve the purpose for which it was collected, for example, when your query is subsequently answered.
You have the option, at any time, of withdrawing your consent to the processing of personal data or objecting to the processing of data sent by e-mail. Please contact our data protection officer regarding such matters.
We can no longer communicate with you if you make use of this option. All personal data stored by us when contact was made will be deleted.
8. Partner registration
Only customers and interested commercial parties can apply to register as Brötje partners on our website. An application form is used to apply for registration. Required data is marked in the input mask. Required data can be supplemented by further data entered optionally on the form.
We process the data so that traders and their employees can register as Brötje partners. Any processing of the applicant's personal data is based on Art. 6(1)(b) GDPR.
The data we collect is required so that we can assess whether registration as a Brötje partner is possible and whether the registration request has been made by an authorised employee, and also so that we can manage access permissions if registration goes ahead.
We use the data we receive to assess whether registration as a Brötje partner is possible. In the event of a refusal, you will receive a message to that effect by e-mail. The data you sent will then be deleted.
If registration is successful, the registration data is stored as long as the registration is active. Personal data is deleted after the registration is deactivated, unless it is necessary to retain it for reasons related to tax or commercial legislation pursuant to Art. 6(1)(c) GDPR.
Registered customers may cancel their registration at any time. You can amend the data held about you, or have it amended, at any time. All you have to do is send a message using the contact form or an e-mail to firstname.lastname@example.org.
9. Closed area (partner login)
We provide a closed area (partner login) on our website for our registered trade partners. Only registered partners and their employees are granted access.
10. Job applications
You can send us job applications by e-mail.
The data and files you send are processed and utilised solely for the purposes of dealing with your e-mail application. The legal basis for processing in this respect is Art. 6(1)(b) GDPR in conjunction with Section 26 para. 1 German Federal Data Protection Act (BDSG).
Your personal application data is passed to third parties only with your prior express consent.
If your application is successful, we may process and utilise the data and files you provide for employment purposes when we employ you. Otherwise, your personal application data is, in principle, deleted automatically six months after the application process ends. This does not apply if deletion is precluded by statutory provisions, if we need to continue to store the information so that it can serve as evidence, or if you have given your express consent to it being stored for longer.
In the event that we are unable to offer you a currently vacant post, but believe that, based on your profile, your application could be of interest with respect to future vacancies, we will hold your personal application data for 12 months, provided that you give your express consent to such storage and use.
You may withdraw your application at any time. Please contact email@example.com. No particular format is required.The personal data held about you up to that point will then be deleted without delay.
11. Rights of the data subject
If personal data regarding you is processed, then you are a data subject, as defined by GDPR, and you have the following rights vis-à-vis the responsible entity.
Right to information
To the extent stipulated in Art. 15 GDPR, you have the right, upon request at any time, to receive from us information about personal data concerning you and processed by us.
Right to rectification
Pursuant to Art. 16 GDPR, you have the right to request that we rectify and/or complete your personal data without delay if the processed personal data concerning you is incorrect or incomplete.
Right to erasure
Pursuant to Art. 17 GDPR, you have the right to request that we delete personal data concerning you without delay.
Right to restriction of processing
Pursuant to Art. 18 GDPR, you have the right to request that processing of personal data concerning you is restricted.
Right to notification
If you have exercised your right to rectification, erasure or restriction of processing by us, all recipients to whom personal data concerning you has been disclosed will be informed by us of such rectification, erasure or restriction of processing, unless such action proves impossible or involves a disproportionate level of effort. Pursuant to Art. 19 GDPR, you have the right to request that we inform you of these recipients.
Right to data portability
Pursuant Art. 20 GDPR, you have the right to receive from us, in a structured, commonly-used and machine-readable format, personal data concerning you that you have provided to us, and to pass this data to other responsible entities. You also have the right to have personal data concerning you sent directly by us to another responsible entity, to the extent that such is technically feasible.
Right to object
Pursuant to Art. 21 GDPR, you have the right, for reasons related to your particular situation, to object at any time to the processing of personal data concerning you on the basis of Art. 6 (1)(f) GDPR.
If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing. If you object to data processing for direct marketing purposes, personal data concerning you will no longer be processed for such purposes.
Exercising your rights
If you wish to exercise one or more of your aforementioned rights, please contact our data protection officer.
Right to withdraw consent with regard to data protection
Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent with regard to data protection at any time. The withdrawal of consent does not affect the legality of the processing that was carried out on the basis of the consent up to the point it was withdrawn.
Right to lodge a complaint with a supervisory authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of personal data concerning you is in contravention of GDPR.