I. Information concerning collection of personal data

1. Personal data
Below, we will inform you about collection of personal data when you use our website. Personal data are any data that permit a conclusion to you personally, e.g. your name, address, email addresses, user behaviour.

2. Controller within the meaning of the GDPR
The controller in accordance with sect. 4 para. 7 EU General Data Protection Regulation (GDPR) is
CVS engineering GmbH
Grossmattstr. 14
D-79618 Rheinfelden
Phone: +49 (0)7623 71741-0
Fax: +49 (0)7623 71741-90
E-Mail: info[at]cvs-eng.de
(Also see our Legal notice).
You can reach our data protection officer at datenschutzbeauftragter@cvs-eng.de or our postal address with the addition "The data protection officer".

3. Note on contact
When you contact us by email or through a contact form, the complete data disclosed by you (your email address, possibly your name and phone number) will be saved by us in order to answer your questions. We will erase the data arising in this context after storage is no longer required, or we shall restrict processing if there are any legal archiving obligations.

4. External service providers
If we use any charged service providers for individual functions of our offer, or if we want to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also indicate the specified criteria for the storage duration in this context.

5. SSL or TLS encryption
This page uses SSL or TLS encryption for reasons of safety and to protect the transmission of confidential contents, such as orders or queries that you send to us as the page operator. An encrypted connection can be recognised by the address line of the browser switching from “http://” to “https://” and the lock icon being shown in your browser line.

II. General information on processing activities

1. Scope of processing of personal data
We generally only process personal data of our users if this is required to provide a functional website or our contents and services. Processing of personal data of our users shall usually only take with the user's consent. A derogation shall apply in such cases where collection of advance consent is not possible for factual reasons and where processing of the data is permitted by the law.

2. Legal basis relating to processing of personal data
As far as we collect the consent of the data subject for processing of personal data, sect. 6 para. 1, lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. For legal processing of personal that is required to perform a contract of which the data subject is a party, sect. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing activities that are required to perform pre-contractual measures. As far as processing of personal data is required to perform a legal obligation that our company is subject to, sect. 6 para. 1, lit. c GDPR serves as the legal basis. If any vital interests of the data subject or any other natural person requires processing of personal data, sect. 6 para. 1 lit. d GDPR serves as the legal basis. If processing is required to maintain a justified interest of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not override the former interest, sect. 6 para. 1 lit. f GDPR serves as the legal basis for processing.

3. Data erasure and duration of storage
The personal data of the data subject will be erased or looked as soon as the purpose of storage is removed. Storage may further take place when this is stipulated by the European or national legislator in regulations under Union law, laws or other rules that the controller is subject to. Blocking or erasure of the data shall also take pace if a storage period required by the standards named expires, except if further storage of the data is required for conclusion of a contract or performance of a contract.

4. Data transmission at conclusion of a contract for services and digital contents
We transmit personal data to third parties only if this is necessary within the context of contract processing, e.g. to a bank charged with processing of payments. Further transmission of the data shall not take place, or shall only take place if you have expressly consented to transmission. Your data will not be passed on to any third parties without express consent, e.g. for advertising purposes. The basis for processing activities shall be sect. 6 para. 1 lit. b GDPR, which permits processing of data to meet a contract or pre-contractual measures.


III. Rights of the data subject
If any personal data of you are processed, you are a data subject within the meaning of GDPR and you have the following rights towards the controller:

1. Information Rights
You may demand that the controller confirm whether any personal data concerning you are processed by us. In case of such processing, you may demand the following information from the controller:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data concerned;
(3) the recipients or categories of recipients to whom the personal data concerning you have been disclosed or will be disclosed;
(4) the planned duration of storage of the personal data concerning you or, if specific information on this cannot be provided, criteria for specification of the storage duration;
(5) the existence of the right to request from the controller rectification or erasure of personal data or a right to restriction of processing of personal data concerning the data subject or to object to such processing;
(6) the existence of the right to lodge a complaint with a supervisory authority;
(7) all available information on the origin of the data, if the personal data are not collected from the data subject;
(8) the existence of automated decision—making, including profiling, referred to in section 22 para. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You have the right to be informed on whether the personal data concerning you are transmitted to a third country or an international organisation. In this context, you may demand provision of information about suitable safeguards pursuant to sect. 46 GDPR in connection with transmission.

2. Right to rectification
You have a right to rectification and/or completion towards the controller, provided that the personal data processed concerning you are inaccurate or incomplete. The controller shall rectify them without undue delay.

3. Right to restriction of processing
You may demand restriction of processing of the personal data concerning you under the following conditions:
(1) if you dispute the accuracy of the personal data concerning you for a duration that enables the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead;
(3) the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or
(4) if you have objected to processing in acceptance with sect. 21 para. 1 GDPR and it is not yet certain if the legitimate reasons of the controller override your reasons.
Where processing of the personal data concerning you has been restricted, such personal data must — with the exception of storage - only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing was limited according to the above conditions, you will be informed by the controller before the restriction is revoked.

4. Right to erasure
a) Erasure obligation
You may demand that the controller erase the personal data concerning you without undue delay and the controller shall have the obligation to erase such data without undue delay where one of the following grounds applies:
(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or othenivise processed.
(2) You withdraw consent on which the processing was based according to sect. 6 para. 1 lit. a or sect. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.
(3) You object to processing in accordance with sect. 21 para. 1 GDPR and there are no overruling legitimate grounds for processing, or you object to processing in accordance with sect. 21 para. 2 GDPR.
(4) The personal data concerning you have been unlawfully processed.
(5) Erasure of the personal data concerning you is required for compliance with a legal obligation under Union or Member State law to which the controller is subject.
(6) The personal data concerning you have been collected in relation to the offer of information society services referred to in sect. 8 para. 1 GDPR.
b) Information to third parties
Where the controller has made the personal data concerning you public and is obliged pursuant to sect. 17 para. 1 GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing of the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
c) Derogations
The right to erasure shall not exist if processing is required
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with sect. 9 para. 2 lit. h and i as well as sect. 9 para. 3 GDPR;
(4) f for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with sect. 89 para. 1 GDPR in so far as the right referred to in lit. a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the assertion, exercise or defence of legal claims.

5. Right to provision of information
If you have asserted a right to rectification, erasure or restriction of processing towards the controller, the controller is obligated to inform all recipients to whom the personal data concerning you were disclosed of this rectification or erasure of data or reconstruction of processing, except if this turns out to be impossible or subject to unreasonable effort. You are due the right to provision of information about such recipients by the controller.

6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, common and machine-readable format. In addition to this, you have the right to transmit these data to another controller without any impairment by the controller to whom the personal data were provided, as long as
(1) processing is based on consent in accordance with sect. 6 para. 1 lit. a GDPR or sect. 9 para. 2 lit. a GDPR or a contract in accordance with sect. 6 para. 1 lit. b GDPR and
(2) the processing is carried out by automated means. In exercising this right, you further have the right to demand that the personal data concerning you be transmitted directly from one controller to another, where technically feasible. Freedoms and rights of other persons must not be impaired by this. That right to data portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object
You shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning you which is based on sect. 6 para. 1 lit. e or fGDPR, including profiling based on those provisions. The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where personal data concerning you are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes. You have the option to exercise the right to object in connection with use of information society services, irrespective of directive 2002/58/EC, where technical specifications are used.

8. Right to revocation of the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision
(1) is necessary for entering into, or performance of, a contract between you and the controller,
(2) is authorised by provisions of Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and your legitimate interests or
(3) is made with your express consent.
However, such decisions shall not be based on special categories of personal data referred to in sect. 9 para. 1 GDPR, unless sect. 9 para. 2 lit. a or g GDPR applies and suitable measures to safeguard the rights and freedoms and your legitimate interests are in place. Regarding the cases referred to in (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority
You also have the right to complain to a data protection supervisory authority about processing of your personal data by us. The supervisory authority relevant for us is: The state officer for data protection and freedom of information Baden—Wiirttemberg, Dr. Stefan Brink, PO box 10 29 32, D-70025 Stuttgart, phone: 07 11/61 55 41-0, telefax: 07 11/61 55 41-15, email: poststelle@lfdi.bwl.de

IV. Analysis tools and marketing

1. Google Analytics
This website uses functions of the web analysis service Google Analytics. The provider is Google inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses "cookies". These are text files that are stored on your computer and that permit analysis of your use of the website. As a rule, the information generated by the cookie through your use of this website is sent to a Google server in the USA and stored there. Goog|e—Ana|ytics cookies are stored based on sect. 6 para. 1 lit. 1‘ GDPR. The website operator has a legitimate interest in analysis of the user behaviour in order to optimise both its web offer and its advertisement.
IP anonymisation
We activated the function IP anonymisation on this website. This way, your IP address will be abbreviated first by Google within member states of the European Union or in other contracting states of the convention on the European Economic Area before transmission to the USA. Only in exceptions will your full IP address be transferred to a server of Google in the USA and abbreviated there. On the order of the provider of this website, Google will use this information to evaluate your use of the website, in order to compile reports on the website activities and to render further services connected to website use and internet use towards the website operator. The IP address transmitted by your browser within the context of Google Analytics will not be combined with any other Data of Google.
Browser plugin
You may prevent saving of the cookies by making the corresponding settings in your browser software; however, note that you may be unable to fully use all functions of the website in such a case. You may furthermore prevent recording of the data generated by the cookie and referring to your use of the website (incl. your Internet Protocol address) and processing of these personal data by Google by downloading and installing the browser p|ug—in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
Objection to data collection
You may prevent recording of your data by Google Analytics by clicking the following link. An opt-out cookie is set that will permanently prevent recording of your data during future visits to this website: deactivate Google Analytics. For more information on handling user data by Google Analytics, see the data protection statement of Google: https://support.google.com/analytics/answer/6004245?hl=de.
Contract data processing
We have concluded a contract with Google for contract data processing and implement the strict specifications of the German and European data protection authorities when using Google Analytics completely.

2. Google Analytics Remarketing
Our websites use the functions of Google Analytics Remarketing in connection with the device-comprehensive functions of Google AdWords and Google Doub|eC|ick. The provider is Google inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. These functions make it possible to link the advertising target groups compiled with Google Analytics Remarketing to the device-comprehensive functions of Google AdWords and Google Doub|eC|ick. This way, interest-based personalised advertising messages that were adjusted to you based on your earlier usage and surfing behaviour on an end device (e.g. mobile phone) can also be shown on any other of your end devices (e.g. tablet or computer). If you have given the corresponding consent, Google will link your web and app browser history to your Google account for this. This way, the same personalised advertising messages can be shown on every end devices on which you log in with your Google account. To support this function, Google Analytics records google-authenticated IDs of the users that are temporarily linked to our Google-Analytics data in order to define and compile target groups for device-comprehensive advertisements. You may permanently object to device-comprehensive remarketing/targeting by deactivating personalised advertisements in your Google account; follow the following link for this: https://www.google.com/settings/ads/onweb/. The data recorded will be summarised in your Google account only based on your consent that you can give to and withdraw from Google (sect. 6 para. 1 lit. a GDPR). At data recording processes that are bot combined to your Google account (e.g. because you do not have a Google account or because you have objected to combination), the data will be recorded based on sect. 6 para. 1 lit. fGDPR. The legitimate interest results from the website operator having an interest in anonymised analysis of the website visitors for purposes of marketing. Further information and the data protection provisions can be found in the data protection statement of Google at: https://www.google.com/policies/technologies/ads/.


V. Further plugins and tools

Google Maps
This page uses the map service Google Maps via an API. The provider is Google inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Your IP address must be stored for using the functions of Google Maps. This information will usually be transferred to a sewer of Google in the USA and stored there. The provider of this page cannot influence this data transmission. Google Maps are used in the interest of an attractive presentation of our online offer and to make it easier to find the places named by us on the website. This is a legitimate interest within the meaning of sect. 6 para. 1 lit. fGDPR. For more information on handling user data, see the data protection statement of Google: https://www.google.de/intl/de/policies/privacy/.

Status of the data protection statement: 17.05.2018