Data protection declaration in accordance with GDPR

Below we will inform you about the collection of personal data when using our website. Personal data means all the data, which refers to you personally, e.g. name, address, email addresses, user behavior, IP address.

I. Name and address of the controller

The controller in accordance with Art. 4 Para. 7 EU General Data Protection Regulation (GDPR) and other national data protection laws in Member States as well as other provisions under data protection law is:

GRASS GmbH
Grass Platz 1
6973 Höchst
Austria
Phone: +43 5578 701 -0
E-mail: info@grass.eu
Website: designguide.grass.eu

II. Name and address of the data protection officer

The data protection officer of the controller is:

c/o migosens GmbH
Wiesenstr. 35
45473 Mülheim an der Ruhr
E-Mail: dsb-grass-at@migosens.net

III. General information about data processing

1. Scope of the processing of personal data

In principle we collect and use personal data from our users only insofar as this is required to provide a functional website and our content and services. The collection and use of the personal data of our users takes place on a regular basis only with the consent of the user. An exception applies in such cases where it is not possible to obtain prior consent for effective reasons and processing of the data is permitted by statutory provisions.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing procedures regarding personal data, Art. 6 Para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.

When processing personal data, which is required to satisfy a contract, whose contracting party is the data subject, Art. 6 Para. 1 lit. b GDPR serves as the legal basis. This also applies to processing procedures required to implement pre-contractual measures. Insofar as the processing of personal data is necessary to satisfy a legal obligation, to which our company is subject, Art. 6 Para. 1 lit. c GDPR serves as the legal basis.

In the event that essential interests of the data subject or another individual make the processing of personal data necessary, Art. 6 Para. 1 lit. d GDPR serves as the legal basis.

If processing is required to maintain a justified interest of our company or a third party and if the interests, basic rights and basic freedoms of the data subject do not outweigh the first-mentioned interest, then Art. 6 Para. 1 lit. f GDPR serves as the legal basis for processing.

3. Data deletion and duration of retention

The personal data of the data subject will be deleted or blocked, as soon as the purpose of retention lapses. Retention can take place beyond this if this was envisaged by the European or national legislator in decrees, laws or other provisions under Union law, to which the controller is subject. Blocking or deletion of the data will also take place if a period of retention prescribed by the standards mentioned expires, unless the necessity for continued retention of the data exists for the conclusion of a contract or satisfaction of a contract.

4. Use of service-providers as part of the website

Sometimes we use external service-providers to process your data on our website. They have been selected and instructed carefully by us. They are bound to follow our instructions and are monitored on a regular basis. Data transmission in countries outside the EU or the EEA (so-called third countries) will not take place.

IV. Provision of the website and compilation of log files

1. Description and scope of data processing

Every time our website is called up, our system collects automated data and information from the computer system of the calling device. When the website is used merely for information purposes, we collect only the personal data that your browser transmits to our server. When this occurs, the following data is collected:

• IP address • Information about the browser type and version used • Operating system of the user • Date and time of access • Relevant data volume transmitted • Websites, from which the user’s system reaches our website • Websites, which are called up by the user’s system via our website

The data is also saved in the log files of our system. The IP addresses of the user or other data, which enable a user’s data to be assigned, are not affected by this. Retention of this data together with other personal data of the user will not take place.

2. Legal basis for data processing

The legal basis for temporary retention of the data is Art. 6 Para. 1 lit. f GDPR.

3. Purpose of data processing

The temporary retention of the IP address by the system is necessary so that the website can be provided to the user’s computer. For this the user’s IP address must be saved for the duration of the session.

Our justified interest in data processing is also based on these purposes in accordance with Art. 6 Para. 1 lit. f GDPR.

4. Duration of retention

The data will be deleted as soon as it is no longer required to achieve the purpose of its collection. In the event of collection of the data for the provision of the website, this is the case if the relevant session has ended.

5. Options for objection and removal

The collection of the data to provide the website and the retention of the data in log files is urgently required for the operation of the website. There is therefore no option for an objection on the part of the user.

V. Use of technically necessary cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files, which are saved in the web browser or by the web browser on the user’s computer system. If a user calls up a website, then a cookie can be saved on the operating system of the user. This cookie contains a characteristic sequence of characters, which make it possible to clearly identify the browser when the website is called up again.

We use cookies to make our website more user-friendly. Some elements of our website make it necessary for the browser calling up to also be identified after moving to a different page.

2. Legal basis for data processing

The legal basis for the processing of personal data using cookies is Art. 6 Para. 1 lit. f GDPR.

3. Purpose of data processing

The purpose of using the technically necessary cookies is to simplify the use of websites for the user. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that the browser can also be recognized after moving to a different page.

The user data collected through the technically necessary cookies will not be used to compile user profiles.

Our justified interest in processing the personal data is also based on these purposes in accordance with Art. 6 Para. 1 lit. f GDPR.

4. Duration of retention, options for objection and removal

Cookies are saved on the user’s computer and transmitted from the latter to our website. As a user you therefore also have full control over the use of cookies. By changing the settings in your web browser, you can deactivate or limit the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also take place automatically. If cookies are deactivated for our website, it might be the case that not all the functions of the website can be used in full.

VI. Registration

1. Description and scope of data processing

On our website we offer users the option to register by providing personal data. As part of this process, the data are entered into an input mask and transmitted to us and saved. Transmission of the data to a third party will not take place.

As part of the registration process, the consent of the user to processing of this data will be obtained.

2. Legal basis for data processing

The legal basis for the processing of the data is Art. 6 Para. 1 lit. a GDPR if there is consent from the user for this.

In addition, the registration is used to implement pre-contractual measures or following the satisfaction of a contract, whose contracting party becomes the user. Processing of the data is carried out on the basis of Art. 6 Para. 1 lit. b GDPR.

3. Purpose of data processing

Registration of the user is required for the satisfaction of a contract with the user or to implement pre-contractual measures.

4. Duration of retention

The data is deleted immediately after the cancellation of the registration or any change to the latter.

5. Options for objection and removal

As a user, you have the option of canceling the registration as any time. You can arrange for the data saved about you to be amended at any time. The cancellation or amendment can take place without completing any forms and should be directed to the controller.

Insofar as the data is required for the satisfaction of a contract or to implement pre-contractual measures, early deletion of the data is possible only insofar as contractual or statutory obligations do not stand in the way of a deletion.

VII. Use of Google Analytics

1. Description and scope of data processing

This website uses Google Analytics, a web analysis service of Google Inc. (“Google”). Google Analytics uses so-called “cookies”, namely text files, that are saved on your computer and make it possible to analyze your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a server of Google in the USA and saved there. If IP anonymization is activated on this website, your IP address will however be abbreviated in advance by Google within Member States of the European Union or in other contracting states to the Treaty on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a server of Google in the USA and abbreviated there. On behalf of the operator of this website, Google will use this information to assess your use of the website, to compile reports about the website activities and to provide additional services associated with the use of the website and the Internet to the website operator.

The IP address transmitted by Google Analytics from your browser will not be merged with other data by Google.

This website uses Google Analytics with the extension “_anonymizeIp()”. This continues to process the IP address in an abbreviated form so that any relationship to the person in question is ruled out. Insofar as a reference to you as an individual is made via the data collected about you, this will therefore be immediately ruled out and the personal data will therefore be deleted immediately.

2. Legal basis for data processing

The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 Para. 1 lit. f GDPR if there is consent from the user for this.

3. Purpose of data processing

We use Google Analytics to analyze the use of our website and to be able to improve this on a regular basis. The statistics provided enable us to improve our services and to make them more interesting for you as the user. For exceptional cases where personal data is transmitted to the USA, Google is subject to the EU-US Privacy Shield , https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 Para. 1 p. 1 lit. f DS-GVO.

4. Duration of retention, option for objection and removal

You can prevent the cookies being saved by a corresponding setting of your browser software; however, we would like to point out to you that in this case you may not be able to use all the functions of this website in full. In addition, you can prevent the collection of the data generated by the cookie related to your use of the website (including your IP address) by Google and the processing of this data by Google, by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

5. Information about the third-party provider

Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User conditions: http://www.google.com/analytics/terms/de.html, overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, and the data protection declaration: http://www.google.de/intl/de/policies/privacy.

This website also uses Google Analytics for cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate cross-device analysis of your use in your customer account under “My data”, “personal data”.

VIII. Rights of the data subject

Every data subject has the right to obtain information in accordance with Article 15 GDPR, the right to correction in accordance with Article 16 GDPR, the right to deletion in accordance with Article 17 GDPR, the right to restriction of processing in accordance with Article 18 GDPR, the right to object arising from Article 21 GDPR and the right to data portability arising from Article 20 GDPR. The restrictions in accordance with §§ 34 and 35 Federal Data Protection Act (BDSG) apply to the right to obtain information and the right to deletion. In addition, there is a right to complain to a data protection authority (Article 77 GDPR in conjunction with § 19 BDSG).

You can withdraw the consent you have granted to us for the processing of personal data at any time. This also applies to the withdrawal of consent declarations, which were issued to us before the validity of the EU General Data Protection Regulation, in other words before 25 May 2018. Please note that withdrawal of consent is effective only for the future. Processing, which took place before the withdrawal of consent, is not affected by this. Withdrawal of consent can take place without completing any forms and should be directed to the controller.