Principles of Data Processing at Hermann Paus Maschinenfabrik GmbH

Information pursuant to Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR)

We hereby inform you about the processing of your personal data by us and the claims and rights to which you are entitled under data protection law. This notice applies to customers, prospective customers, suppliers, and visitors. Separate privacy notices apply to applicants and employees (see below).

The controller within the meaning of Art. 4 No. 7 GDPR is:

Hermann Paus Maschinenfabrik GmbH
Siemensstraße 1–9
D-48488 Emsbüren
E-mail: datenschutz@paus.de
Imprint: https://www.paus.de/impressum.html
(hereinafter also "Hermann Paus Maschinenfabrik GmbH" or "we")

If you have any questions about this privacy notice or about the protection of your data by Hermann Paus Maschinenfabrik GmbH, you may also contact our Data Protection Officer at any time:

Carla Holterhus
E-mail: datenschutz@paus.de

Customers and Prospective Customers

The purpose of processing personal data is to carry out pre-contractual measures and to initiate and manage existing contractual relationships pursuant to Art. 6 para. 1 lit. b GDPR. This includes in particular the preparation of quotations, order processing, communication within the business relationship, invoicing and quality assurance measures. The data processed includes in particular contact details (e.g. name, address, email address, telephone number), communication content, contract data and billing information. Any further processing of personal data is carried out exclusively on the basis of explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. The retention period is governed by the statutory retention obligations and is regularly ten years pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

Direct Marketing

In addition to contract-related processing, personal data of customers and prospective customers is processed for the purpose of direct marketing of our own products and services. This processing is based on Art. 6 para. 1 lit. f GDPR in conjunction with Recital 47 GDPR and is carried out in our legitimate interest in customer retention. You may object to this data processing at any time with effect for the future. If an objection is raised, the data will no longer be processed for this purpose and, where not subject to other retention obligations, will be deleted.

Suppliers

For the purpose of initiating and carrying out contractual relationships with suppliers, we process personal data on the basis of Art. 6 para. 1 lit. b GDPR. This includes in particular contact and communication data, quotation documents, and contract and billing information. Any further processing is carried out only on the basis of explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. The retention period is governed by the statutory retention obligations and is generally ten years after completion of the respective business transaction pursuant to Section 147 AO and Section 257 HGB.

Visitors (On-site)

When you visit our premises, we process personal data of visitors to the extent necessary for organising the visit, ensuring security and fulfilling our duty of care obligations. The data processed includes in particular name, company, contact details, time of arrival and departure, the relevant contact person on site, and, where applicable, vehicle registration number. The legal basis is Art. 6 para. 1 lit. b GDPR where the visit serves the initiation or performance of a contract, and otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in security and the proper conduct of operations). In certain areas of the premises, video surveillance is also carried out on the basis of Art. 6 para. 1 lit. f GDPR; further information is available on-site via the relevant signage. Visitor data is deleted as soon as it is no longer required for the purposes stated, provided no statutory retention obligations apply.

Use of Our Website

Information on the processing of personal data when visiting our website (e.g. cookies, web analytics, integrated services) can be found in the separate privacy notice for the website at https://www.paus.de/datenschutz.html.

Applicants

Information on the processing of your personal data during the application process can be found in our separate privacy notice for applicants, which we provide to you as part of the application process.

Employees

Information on the processing of your personal data in the context of your employment can be found in our separate privacy notice for employees, which is made available to you separately by the HR department.

Technically Assisted and AI-Supported Services

We may use technically assisted or AI-supported services to support internal processes, analyse operational information and improve communication. The personal data processed in this context is subject to the general principles of this privacy notice. Processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR where it is necessary for the performance of a contract, or on the basis of Art. 6 para. 1 lit. f GDPR where there is a legitimate interest in the efficiency and quality of our workflows. No automated decision-making within the meaning of Art. 22 GDPR takes place. Where processing is based on your consent, it is carried out on the basis of Art. 6 para. 1 lit. a GDPR.

The retention period is governed by the applicable statutory retention obligations. Where no more specific provisions apply, the standard retention period for documents relevant under commercial and tax law is ten years (Sections 147 AO, 257 HGB). Data processed solely on the basis of consent will be deleted upon withdrawal of that consent, unless another legal basis exists. Otherwise, we delete personal data as soon as it is no longer required for the respective purposes.

Recipients of personal data are exclusively those bodies to which we are permitted or required to disclose such data on the basis of statutory provisions or contractual agreements. These include in particular public authorities where overriding legal provisions apply, such as tax authorities or social security institutions. In addition, we transfer personal data to external service providers where this is necessary for the proper conduct of our business processes. These include in particular IT service providers, hosting providers, accounting and tax advisory service providers, payment and payroll service providers, printing and mailing service providers, transport and logistics companies, and providers of insurance and travel expense reimbursement services. Data is only passed on to further third parties where a legal authorisation exists, an overriding legitimate interest applies, or the explicit consent of the data subject has been given.

Where personal data is transferred to processors outside the European Union or the European Economic Area, for example to the United States of America, this is done exclusively in compliance with the data protection requirements of Art. 44 et seq. GDPR. In particular, the standard contractual clauses published by the European Commission are concluded, or comparable appropriate safeguards are agreed to ensure an adequate level of data protection.