Privacy policy

Our handling of your data and your rights - information in accordance with items 12 et seq. of the General Data Protection Regulation (GDPR)

We, heroal - Johann Henkenjohann GmbH & Co. KG (hereinafter also referred to as "heroal"), appreciate your interest in our website. The protection of your privacy is very important to us. Below we inform you in detail about how we handle your personal data.

This data protection declaration applies to the collection, processing and use of your personal data when using our websites and when using our heroal Communicator.

With regard to the terms used, such as "personal data" or their "processing", we refer to the definitions in Art. 4 GDPR.

I. General information

1. Controller of the data processing

We are responsible for the processing of your personal data:

heroal - Johann Henkenjohann GmbH & Co. KG, Österwieher Str. 80, 33415 Verl; Phone: +49 5246 507-0; Fax: +49 5246 507-222; Email: info@heroal.de

2. Data protection officer

Dr. Christian Lenz
dhpg IT-Services GmbH
Bunsenstr. 10a
51647 Gummersbach
E-mail: datenschutz@dhpg.de

Phone: +49 2261 8195 0

3. Which data from which sources do we process?

We process personal data that you voluntarily provide to us or that is collected in the frame of the use of our website and the heroal Communicator.

Further information on this can be found in offcut II - Processing of personal data.

4. For what purpose do we process your data and on what legal basis?

We process your personal data in accordance with the relevant data protection regulations, in particular the GDPR and the German Federal Data Protection Act (BDSG), for various purposes. In principle, the following purposes of processing can be considered: processing to fulfill contractual obligations (Art. 6 para. 1 lit. b GDPR), to safeguard legitimate interests (Art. 6 para. 1 lit. f GDPR), on the basis of your consent (Art. 6 para. 1 lit. a GDPR) and/or on the basis of legal requirements (Art. 6 para. 1 lit. c GDPR).

The specific legal bases we use for processing your personal data can be found in offcut II - Processing of personal data.

5. Who receives my data?

Service providers employed by us and acting on our behalf (so-called processors, cf. Art. 4 No. 8 GDPR) may receive personal data. We use the following processors or categories of processors:

• neusta webservices GmbH (operation, support)
• kernpunkt Digital GmbH (operation, support)
• Google Inc. (in connection with the cookies we use from Google)
• Facebook Inc.
• Matomo
• Adform A/S
• Hotjar Ltd.
• Rocket Science Group LLC d/b/a Mailchimp
• Usercentrics GmbH
• LinkedIn Inc.
• Pinterest Inc.

In addition, we sometimes transfer your personal data to third parties who process it under their own responsibility (so-called controllers, see Art. 4 No. 7 GDPR). This includes the following recipients in particular:

• Google Inc. (in connection with our embedded videos from YouTube and Google Maps);
• Microsoft Ireland Operations Ltd.

6. Transfer of personal data to third countries

Insofar as this is necessary for the purposes mentioned in offcut II, we also transfer your personal data to recipients outside the European Economic Area (EEA).

We ensure that data is only transferred to third countries if there is a legal basis for this. This means that we only transfer your data if the EU Commission has issued a decision on an adequate level of data protection for the respective third country (Art. 45 GDPR), suitable guarantees are provided for the protection of your personal data (see Art. 46 GDPR) or a legal authorization standard exists (see Art. 49 GDPR).

The appropriate safeguards within the meaning of Art. 46 GDPR include the standard data protection clauses published by the European Commission. If you would like further information on the standard data protection clauses on the basis of which we transfer your personal data to third countries, please contact the offices listed in Section I.1.

Details of the extent to which we transfer your data to certain third countries and the specific recipients can be found in the information above in offcut II. In particular in connection with the use of our newsletter mailing service and the activation of analysis and marketing cookies and plug-ins on our website, your personal data will be transferred to the USA. There is no so-called adequacy decision by the European Commission for the USA in accordance with Art. 45 GDPR.

7. Storage of data

We only process your personal data for as long as is necessary to fulfill the respective processing purpose.

In addition, we are subject to various retention and documentation obligations arising from the German Commercial Code (HGB) or the German Fiscal Code (AO), among others. These can last up to 10 years.

Finally, the storage period is also determined by the statutory limitation periods, which can be up to thirty years in accordance with Sections 195 et seq. of the German Civil Code (BGB), for example, whereby the regular limitation period is three years.

8. Your rights

If the respective legal requirements are met, you as the data subject have the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR. To exercise the aforementioned rights, you can contact the offices listed in the first offcut - General information under points 1 and 2.

If you have given us your consent to data processing, you can revoke this at any time without any formal requirements in accordance with Art. 7 (3) GDPR. If possible, the revocation should be addressed to the offices mentioned in the first offcut - General information under point 1 or 2.

In addition, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent supervisory authority for heroal is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestr. 2-4, 40213 Düsseldorf, Germany, Tel.: 0211/38424-0, Fax: 0211/38424-10, E-Mail: poststelle@ldi.nrw.de

You also have the right to object, which is explained in more detail at the end of this data protection notice.

II Processing of personal data

Which data is processed in detail and how it is used depends largely on the respective services you use. Below you will find an overview of which data we collect and process for which purposes and on which legal basis:

1. Automatic collection of access data/ server log files

When you visit our website, the following data record is automatically saved each time you access it:

• IP address of the requesting computer
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status / HTTP status code
• Amount of data transferred in each case
• Website from which the request comes
• Browser type, language and version of the browser software
• Operating system and its surface

The personal data in log files are processed on the basis of item 6 para. 1 lit. f GDPR. The purpose of data processing and our legitimate interest are to facilitate administration and display and to ensure the stability of our website and the ability to detect and track hacking.

2. Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your end device. The cookies can be transmitted to a page when it is called up and thus enable an allocation of the user. Cookies help to simplify the use of websites for users. Some of the cookies we use are deleted again at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognize your browser on your next visit (so-called persistent cookies).

Our website uses the following types of cookies, the scope and function of which are explained below.

Essential cookies:

Essential cookies ensure that all functions of the website can be fully displayed and used. Since the website cannot be provided without these cookies, these cookies are set automatically when the website is accessed. The legal basis for the processing of the data collected by these cookies is our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to provide you with a functional website and to comply with our legal obligations in connection with the activation of cookies.

Specifically, we use the following essential cookies:

• Tracking: This cookie from our processor Usercentric GmbH is used to record whether you agree to the use of cookies and whether cookies may be loaded. The following data is processed by the cookie: Device information, browser information, anonymized IP address, opt-in and opt-out data as well as the date and time of the visit. The data collected is stored for three years.
• PHPSESSID: This cookie saves your current session with reference to PHP applications and thus ensures that all functions of the page based on the PHP programming language can be displayed in full.

Functional cookies:

Functional cookies come from external companies (third-party cookies) and collect information about how our website is used so that we can improve its content and attractiveness and thus optimize user-friendliness and the user experience. Functional cookies are only activated if you have consented to the use of these cookies in accordance with Art. 6 para. 1 lit. a GDPR by ticking the corresponding box when visiting the website. You can revoke your consent at any time in the cookie settings.

Specifically, we use the following functional cookies. The respective services are explained in offcut II.3.

Marketing cookies:

Marketing cookies originate from external advertising companies (third-party cookies) and are used exclusively for marketing purposes. The cookies help to display advertisements that are more relevant to the user and tailored to their interests. They are also used to limit the frequency with which an advertisement appears and to measure the effectiveness of advertising campaigns.

Marketing cookies are only activated if you have consented to the use of these cookies in accordance with Art. 6 para. 1 lit. a GDPR by ticking the corresponding box when visiting the website. You can revoke your consent at any time in the cookie settings.

Specifically, we use the following marketing cookies. Further information on the individual functions enabled by cookies is explained in offcut II.4.

3. Analysis services

Google Analytics

This website uses Google Analytics, a web analysis service of Google Inc. (1600 Amphitheater Parkway, Mountainview, California 94043, USA; hereinafter: "Google"). Google is heroal's processor in this context. We have concluded a corresponding order agreement with Google in accordance with Art. 28 GDPR.

Google Analytics enables us to analyze how users interact with the content provided on the website. On this basis, we can optimize our offers on the website. When Google Analytics is used, the following data is collected and transmitted to Google in the USA Data on the device and browser (host name, browser type, referrer, language), IP address and the respective user interaction on the website (e.g. which page a user accesses). In addition, a cookie is used to assign a random, pseudonymous ID to a user, to which the aforementioned information is assigned. This is usually a cookie ID. This is linked to the identifier of the cookie set by Google Analytics for the specific device. In addition, we set a user ID for cross-device tracking. We have also activated the anonymization function for IP addresses. This means that as soon as the IP packet arrives on Google's servers, the data is completely anonymized by Google.

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent Google from collecting your data by refusing your consent or revoking it at a later date in the cookie settings . Alternatively, you can click on the following link. An opt-out cookie will be set to prevent the future collection of your data when you visit this website: Click here to deactivate Google Analytics.

Further information on terms of use and data protection can be found at http://www.google.com/analytics/terms/de.html or at www.google.com/intl/de/analytics/privacyoverview.html.

Matomo (formerly Piwik)

The heroal Communicator uses the web analysis service Matomo, a service of InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand (hereinafter: "InnoCraft"), to analyze and regularly improve the use of our website. InnoCraft is heroal's processor in this context.

Cookies are stored on your computer for this analysis. We store the information collected in this way exclusively on our server in Germany.

The heroal Communicator uses Matomo with the "AnonymizeIP" extension. This means that IP addresses are further processed in abbreviated form, so that they cannot be directly linked to individuals. The IP address transmitted by your browser using Matomo is not merged with other data collected by us.

The legal basis for the processing of the collected data is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent InnoCraft from collecting your data by refusing your consent or revoking it at a later date in the cookie settings .

The Matomo program is an open source project. Information from the third-party provider on data protection can be found at http://Matomo.org/privacy/policy.

Hotjar

We use Hotjar, an analysis tool of Hotjar Ltd, Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta (hereinafter "Hotjar"), to better understand the needs of our users and to optimize the offer on this website. In this context, Hotjar is the processor of heroal

Hotjar's technology gives us a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click on, what they like and dislike, etc.) and helps us to tailor our offering to our users' feedback. Hotjar works with cookies and other technologies to collect information about the behavior of our users and their devices (in particular IP address of the device (only collected and stored in anonymized form), screen size, device type (Unique Device Identifiers), information about the browser used, location (country only), preferred language for displaying our website). Hotjar stores this information in a pseudonymized user profile. The information is not used by Hotjar or by us to identify individual users or merged with other data about individual users. Further information can be found in Hotjar's privacy policy here.

The legal basis for the processing of the collected data is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent Hotjar from collecting your data by refusing your consent or revoking it at a later date in the cookie settings . Alternatively, you can object to the processing by clicking on this opt-out link.

4. Marketing services

Google Remarketing

We use Google Remarketing from Google Ads, a service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter: "Google"). Google is heroal's processor in this context.

The purpose of the remarketing function is to be able to show you our advertisements when you continue to use the Internet after visiting our website. This is done by means of cookies stored in your browser, which are used by Google to record and evaluate your usage behavior when you visit various websites. This enables Google to determine your previous visit to our website. When Google AdServices is used, the following data is collected and transmitted to Google in the USA Data on the device and browser (host name, browser type, referrer, language), IP address and the respective user interaction on our website as well as on other websites on which our ads are placed (e.g. which page a user visits, which products the user selects and purchases, which ads a user clicks on. In addition, a cookie is used to assign a random, pseudonymous ID to a user, to which the aforementioned information is assigned.

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent Google from collecting your data by refusing your consent or revoking it at a later date in the cookie settings .

Further information on data protection when using Google Remarketing can be found at https://policies.google.com/technologies/ads.

Google DoubleClick

This website uses the online marketing tool DoubleClick, a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter: "Google"). Google is the processor of heroal in this context.

DoubleClick uses cookies to serve ads that are relevant to users, to improve campaign performance reports or to prevent a user from seeing the same ads more than once. Google uses a cookie ID to record which ads are displayed in which browser and can thus prevent them from being displayed more than once. In addition, DoubleClick can use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later visits the advertiser's website with the same browser and makes a purchase there. According to Google, DoubleClick cookies do not contain any personal information.

Due to the marketing tools used, your browser automatically constructs a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool. By integrating DoubleClick, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will find out your IP address and store it.

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent Google from collecting your data by refusing your consent or revoking it at a later date in the cookie settings . Alternatively, you can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly, in particular by suppressing third-party cookies so that you do not receive any ads from third-party providers; b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com" domain, whereby this setting will be deleted when you delete your cookies; c) by deactivating the interest-based ads of the providers that are part of the "About Ads" self-regulation campaign via the link http://www.aboutads.info/choices, whereby this setting will be deleted when you delete your cookies; d) by permanently deactivating them in your browsers under the link http://www.google.com/settings/ads/plugin.

Further information on DoubleClick by Google can be found at https://www.google.de/doubleclick and http://support.google.com/adsense/answer/2839090, as well as on data protection at Google in general: https://www.google.de/intl/de/policies/privacy.

Facebook Custom Audiences

Furthermore, the website uses the remarketing function "Custom Audiences" of Facebook Inc (1601 S California Ave, Palo Alto, California 94304, USA; hereinafter: "Facebook"). Facebook acts as a processor of heroal in accordance with Art. 28 GDPR, insofar as data is processed in the frame of the use of Facebook Business Tools for the presentation of interest-based advertisements and for reach measurement. Facebook acts as joint controller with heroal insofar as data is processed in the frame of the use of Facebook Business Tools for targeting ads and improving ad delivery.

The service enables us to display interest-based advertisements ("Facebook ads") to you in the frame of your visit to the social network Facebook or other websites that also use the process. The following personal data is collected for this purpose: pages you have viewed, topic pages visited, use of a Facebook ad, use of search terms, IP address.

If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, there is a possibility that the provider will find out and store your IP address and other identifying features.

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent Google from collecting your data by refusing your consent or revoking it at a later date in the cookie settings . Alternatively, as a logged-in user, you can deactivate the cookie under the following link: https://www.facebook.com/settings/?tab=ads#_

Further information on data processing by Facebook can be found at https://www.facebook.com/about/privacy.

Adform A/S

Cookies from Adform A/S, Wildersgade 10B, 1, 1408 Copenhagen K, Denmark (hereinafter: "Adform") are used to place interest-based advertising. Adform acts as a processor for heroal in accordance with Art. 28 GDPR.

With the help of Adform, information on the operating system, browser version, IP addresses, geographical location and number of clicks or views is stored in pseudonymous user profiles. This data is used for the following purposes:

• Recording the number of visitors to our websites
• Specification of the order in which a visitor visits the various pages of our website
• Assessment of which parts of our website need to be adapted
• Optimization of the website

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent the collection of your data by Adform by refusing your consent or revoking it at a later date in the cookie settings . Alternatively, you can use the following link to set an opt-out cookie that prevents any further data collection: https: //site.adform.com/datenschutz-opt-out/

Microsoft Advertising

We use the remarketing and conversion tracking of Microsoft Advertising (formerly Bing Ads) on our website. This is a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 - 6399, USA (hereinafter: "Microsoft"). In this context, Microsoft acts as its own controller for your data.

This solution enables us to place advertisements and track the user action for these advertisements. For this purpose, a cookie is set by Microsoft when you click on an ad placed via Microsoft Advertising for which the advertiser has opted for conversion tracking. The cookie collects the following data and forwards it to Microsoft: user ID, ad data, i.e. data on access to ads placed and their use.

Microsoft uses this collected information to provide us with statistics on website visitors. This includes, among other things, information about the number of hits on our Bing advertising and about our websites that were subsequently accessed. Cross-device tracking also enables Microsoft to track your user behavior across multiple devices. This allows Microsoft to show you personalized advertising across devices.

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent the collection of your data by Microsoft by refusing your consent or revoking it at a later date in the cookie settings . Alternatively, you can prevent the collection of data by making the appropriate settings in your Internet browser. If you have a Microsoft account, you can also adjust the settings for personalized advertising at https://choice.microsoft.com/de-de/opt-out .

For more information on Microsoft Advertising, data collection and use, and background information on protecting your privacy, please visit: https://help.bingads.microsoft.com/#apex/3/de/53056/2.

LinkedIn Insights and conversion tracking

We use the LinkedIn Insight Tag for this website, a service provided by LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter: "LinkedIn"). acts as a processor of heroal in accordance with Art. 28 GDPR.

The LinkedIn Insight Tag creates a cookie in your web browser that collects the following data: IP address, timestamp, page activity, demographic data from LinkedIn if the user is an active LinkedIn member.

This technology allows us to generate reports on the performance of our advertisements and information on website interaction. For this purpose, the LinkedIn Insight tag is integrated on this website, which establishes a connection to the LinkedIn server if you visit this website and are logged into your LinkedIn account at the same time. We process your data to evaluate campaigns and collect information about website visitors who may have reached us via our campaigns on LinkedIn.

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent LinkedIn from collecting your data by refusing your consent or revoking it at a later date in the cookie settings .

Further information on data protection at LinkedIn can be found here.

Pinterest Pixel (Pinterest Tag)

The so-called "Pinterest tag" of Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest") is also integrated on our website, which serves to analyze and optimize our online offer.

This allows Pinterest to determine the website visitor as a target group for the display of ads. Pinterest receives the information that the user has accessed the website and which offers they were interested in. If the website visitor is also a Pinterest member, corresponding advertisements and offers can also be displayed on Pinterest (via so-called "Custom Audiences").

We want to use the Pinterest tag to ensure that our Pinterest ads correspond to the potential interest of users and are not annoying. With the help of the Pinterest tag, we can track the effectiveness of Pinterest ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Pinterest ad (so-called "conversion").

The following information is processed during use: Device information, operating system used, IP address, time of access to our website. In this context, personal data is transferred to the USA.

The legal basis for the associated data processing is Art. 6 para. 1 a) or Art. 49 para. 1 a) GDPR in connection with your consent.

Revocation: You can revoke your consent to the use of marketing cookies and smart pixels at any time with effect for the future. You can find the link to the cookie settings in the footer.

Taboola

This website uses Taboola's content discovery technology to recommend other online content that may be of interest to you. To drive these recommendations, Taboola collects information about your device and your behavior on this website (and other partner sites) through cookies and similar technologies. For more information, please see Taboola's privacy guidelines here or click here to opt-out.

5. Integrated services from third-party providers

Google Maps

This website uses the product Google Maps. Google Maps is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

Google Maps is integrated using the two-click solution. If you give your consent in accordance with Art. 6 para. 1 lit. a GDPR to activate Google Maps by clicking on the plug-in on an underside in which Google Maps is embedded, Google receives the information that you have accessed the corresponding underside of our website. In addition, data is collected that your browser transmits to Google. This includes, for example, IP address, date and time of the request, amount of data transferred, operating system and its surface, language and version of the browser software.

This takes place regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not want the allocation to your Google profile end, you must log out before activating the button. Google stores your data as user profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website.

You can find more information on the processing of your personal data by Google here: https://policies.google.com/privacy?hl=de.

YouTube

We have integrated YouTube videos into our online offering, which are stored on www.youtube.com and can be played directly from our website. YouTube is a service of Google LLC, 1600 Amphitheater Parkway, Mountainview, California 94043, USA (hereinafter referred to as "Google").

The videos are integrated in "extended data protection mode", i.e. no data about you as a user is transmitted to Google if you do not play the videos. Only when you play a video does Google receive the information that you have accessed the corresponding underside of our website. In addition, data is collected that your browser transmits to YouTube. This includes, for example, IP address, date and time of the request, amount of data transferred, operating system and its surface, language and version of the browser software.

This takes place regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. The legal basis for the processing of this data is your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you give when you click on the video.

Irrespective of the playback of the video, YouTube already sets cookies when you access the page in which the YouTube video is embedded, which send data from you (in particular IP address and pages visited) to the Google Double-Click network. The legal basis for the processing of this data is your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you give in the cookie settings.

Further information on the purpose and scope of data collection and processing by YouTube can be found in Google's privacy policy at: https://www.google.de/intl/de/policies/privacy.

Vimeo

We use plugins from Vimeo, Inc. 555 West 18th Street, New York, New York 10011, USA on our website to make our company better known and to integrate videos with further information for you into the website.

The plugins are marked with a Vimeo logo.

We integrate these plug-ins using the so-called two-click method in order to protect visitors to our website in the best possible way. This means that your personal data (in particular your IP address) is not transmitted to Vimeo as soon as you access the website. Instead, you must first activate the embedded videos by clicking on them. With this click, you give your consent in accordance with Art. 6 para. 1 lit. a GDPR for a connection to be established with the Vimeo servers.

Through this integration, Vimeo receives the information that your browser has accessed the corresponding page of our website, even if you do not have a Vimeo profile or are not currently logged in.

This information (including your IP address) is transmitted directly from your browser to a Vimeo server in the USA and stored there. If you are logged in to Vimeo, Vimeo can directly associate your visit to our website with your account. If you interact with the plugins, for example by starting the video, this information is also transmitted directly to a Vimeo server and stored there.

If you do not want Vimeo to assign the data collected via our website directly to your account, you must log out of Vimeo before activating the plugins.

The data will be transferred to the USA as a third country in accordance with Art. 49 para. 1 lit. a) GDPR with your consent if you have given us this consent after we have informed you about the possible lack of or limited legal protection options and the lower level of data protection in the USA in contrast to the EU. Further information can be found in Vimeo's privacy policy: https://vimeo.com/privacy.

AddSearch

The search function on our website is provided by AddSearch Oy, Töölönkatu 4, FI-00100 Helsinki, Finland ("AddSearch"). When you use the search function (search field) on our website, data is transmitted to AddSearch. The search terms you enter and your IP address are transmitted.

AddSearch uses "Amazon Web Services" (AWS) based in the USA as a processor. This means that some data processing may also take place outside the EU or the European Economic Area (EEA). By using standard contractual clauses of the EU Commission (Art. 46 para. 2 lit. C GDPR), security measures are taken to protect your personal data in the event of a possible transfer to the USA initiated by AWS. Further information on the standard contractual clauses can be found here .

Your personal data is transmitted on the basis of our legitimate interest in improving the user experience on our website through a search function, Art. 6 para. 1 lit. f GDPR. Information is only transmitted once at least three characters have been entered in the search function. No data is transmitted to AddSearch before this.

Further information can be found in the privacy policy of AddSearch.

Friendly Captcha

Friendly Captcha is an innovative, privacy-friendly protection solution from Friendly Captcha GmbH (Am Anger 3-5, 82237 Wörthsee, Germany, hereinafter "Friendly Captcha") to make it more difficult for automated programs and scripts (so-called "bots") to use websites. Friendly Captcha thus protects websites from misuse.

The service user integrates a program code from Friendly Captcha in certain areas of its website (for example, in a contact form). This causes the visitor's device to establish a connection to the Friendly Captcha servers in connection with the protected area (for example, when submitting a contact form).

The visitor's browser receives a calculation task from Friendly Captcha. The complexity of this task depends on various risk factors. The visitor's end device solves the calculation task, which takes up certain system resources, and sends the calculation result to the service user's web server. This contacts the Friendly Captcha server via an interface and receives a response as to whether the puzzle has been solved correctly by the end device.

In addition, the visitor's browser transmits connection data, environmental data, interaction data and functional data to Friendly Captcha. Friendly Captcha evaluates this data and determines how likely it is that it is a human user or bot and sends the result to the service user.

Depending on this, the service user can treat access to their website or individual functions as human or potentially machine-based.

• All data is used exclusively for the detection and treatment of potential bots and risks as described above. The purpose of the processing is therefore to ensure the security and functionality of websites.
• Friendly Captcha does not use the data to identify a natural person or for marketing purposes.
• Friendly Captcha does not store any personal data of the visitor. Data that could identify the visitor (such as IP addresses) is anonymized using one-way hashing.
• Friendly Captcha does not use HTTP cookies and does not store any data in the persistent browser memory.

The legal basis for the data processing in this regard is Art. 6 para. 1 lit. a GDPR, insofar as you have consented to the use of Friendly Captcha. Otherwise, Art. 6 para. 1 lit. f GDPR serves as the legal basis for processing. We have a legitimate interest in ensuring the security and functionality of the website. By using Friendly Captcha, only the data absolutely necessary for this purpose is processed.

7. heroal Communicator

As a user of the heroal Communicator, you have the opportunity to view and/or download and/or otherwise use content related to our products, such as catalogs, design drawings and various software tools and software for managing and displaying content and data. On the other hand, you can communicate with us electronically via the heroal Communicator.

When you register for the heroal Communicator, we collect your personal data (mandatory fields: Title, first name, surname, address, company, e-mail address, telephone number, language; voluntary information: customer number, position in the company, fax number, website, products of interest to you) and your request. We store this inventory data in our customer relationship management system and, if necessary, merge it with contact data already stored there. Your usage data is evaluated anonymously to improve the heroal Communicator.

The processing of personal data is based on item 6 para. 1 lit. b, f GDPR. The purpose of data processing and our legitimate interest lie in customer care, providing the aforementioned content, initiating contracts and being able to respond to messages sent to us.

8. Making contact

On our website, you will find contact forms that can be used to contact us electronically (e.g. to search for specialist partners). Alternatively, you can contact us via the email addresses provided. If you contact us via one of these channels, we will collect the personal data you enter and submit.

When using the contact form, the personal data processed consists of the master data entered there (mandatory fields: first name, surname, email address, address; optional fields: telephone number, products of interest to you). If you contact us directly via email, we process your email address and, where applicable, any personal data contained in the text of the email. When using the specialist partner search, the following data is processed:

• First name
• Surname
• Email address
• Telephone number
• Postcode
• Location
• Selection of specialist partner
• Product selection
• Message content
• Consent to disclosure to other specialist partners

Processing is carried out on the basis of Article 6(1)(f) of the GDPR. The purpose of the data processing and our legitimate interest lie in customer care and in being able to respond to messages sent to us. Where consent is obtained, processing is based on Article 6(1)(a) of the GDPR.

9. Newsletter

heroal sends newsletters, e-mails and other electronic notifications (hereinafter "newsletter") on the basis of the consent of the recipient or legal permission. In our newsletter we inform you about current topics and news about heroal and the heroal product range.

We use the so-called double opt-in procedure to subscribe to our newsletter. After registering, an e-mail will be sent to the e-mail address provided asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 60 days, your information will be deleted. In addition, we store the IP addresses used and the times of registration and confirmation. The double opt-in procedure serves the purpose of being able to prove your registration and, if necessary, investigate any possible misuse of your personal data.

The only mandatory information for sending the newsletter is your e-mail address. The provision of further, separately marked data is voluntary and is used to address you personally. After your confirmation, we will save your e-mail address for the purpose of sending you the newsletter. (Legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR)

Information on opening and click behavior is recorded for the technical improvement of our newsletter. A separate revocation of the performance measurement is not possible.

You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter e-mail, by e-mail to info@heroal.de or by sending a message to the contact details given in the imprint.

We use the email marketing platform Mailchimp to send newsletters:

Email marketing platform; Service provider: "Mailchimp" - Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; Website: https://mailchimp.com; Privacy Policy: https://mailchimp.com/legal/privacy/.

10. Google web fonts

This website uses Google Web Fonts for the uniform presentation of content. When you access the website, fonts are retrieved from external Google servers in the USA. For this purpose, the browser you are using must establish a connection to Google's servers. This informs Google that our website has been accessed via your IP address.

The legal basis for the processing of the data collected is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can prevent Google from collecting your data by refusing your consent. You can also revoke your consent at any time later in the cookie settings . You can find information about Google Fonts here: https://developers.google.com/fonts/faq?hl=de-DE&csw=1

11. Social media presence

Facebook

We use the Facebook social media platform of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland (hereinafter: Meta).

Meta and we are joint controllers within the meaning of Art. 26 GDPR for the profiles www.facebook.com/heroal.Deutschland and www.facebook.com/heroal.international. A corresponding agreement between the parties can be found at https://www.facebook.com/legal/controller_addendum.

Data types:
When you interact with us on our Facebook profile, we process your (user) name, account information and any other data you provide on your profile end or in the frame of communication.

Purpose and legal basis of the processing:
Insofar as we can influence data processing, we ensure that it is carried out in compliance with data protection regulations.
We process your data for the purpose of providing information about our activities and communicating with you. We use our Facebook profile to attract new employees, customers and business partners. It is also possible to get in touch with you via direct messages or public comments on our posts. If you voluntarily visit our Facebook profile or contact us via our Facebook profile, you consent to the above-mentioned processing of your data in accordance with Art. 6 para. 1 subpara. 1 lit. a) GDPR. In addition, personal data may be processed on the basis of a legitimate interest in communication with platform users in accordance with Art. 6 para. 1 subpara. 1 lit. f).

Disclosure to third parties:
Your data will not be passed on to third parties. Data that you post publicly on our Facebook profile end is also visible to everyone.

Transfer to third countries:
The data is transferred to Meta in the USA in accordance with Art. 45 GDPR. The European Commission has issued an adequacy decision for the USA. Meta is certified in accordance with the EU-US Data Privacy Framework. In addition, we have agreed standard contractual clauses (https://de-de.facebook.com/help/566994660333381), which offer suitable guarantees within the meaning of Art. 46 GDPR.

Deletion of data:
Your public posts on our Facebook profile will not be deleted. However, you can delete them yourself at any time. We delete comments that violate legal regulations or our internal guidelines as soon as we become aware of them.
We will delete your messages to us as soon as the request has been dealt with.

Data processing by Meta:
In principle, personal data may also be processed outside the EU. User profiles are also created in order to personalize advertisements.
Information on how advertising can be customized and what to do if you do not want this can be found at www.youronlinechoices.com. Meta is responsible for the personal data collected in the Facebook profile end. For the data processed by Meta, Meta remains responsible under the GDPR for the implementation of information obligations and data subject rights. Further information on the Facebook profile end can be found at: https://de-de.facebook.com/privacy/policy/.

Instagram

We use the Instagram social media platform of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland (hereinafter: Meta).

Meta and we are joint controllers within the meaning of Art. 26 GDPR for the profiles www.instagram.com/_heroal and www.instagram.com/karriere_heroal and https://www.instagram.com/talentevent_verl/. A corresponding agreement between the parties can be found at https://www.facebook.com/legal/controller_addendum.

Data types:
When you interact with us on our Instagram profile, we process your (user) name, account information and any other data you provide on your profile end or in the frame of the communication.

Purpose and legal basis of the processing:
Insofar as we can influence data processing, we ensure that it is carried out in compliance with data protection regulations.
We process your data for the purpose of providing information about our activities and communicating with you. We use our Instagram profile to attract new employees, customers and business partners. It is also possible to get in touch with you via direct messages or public comments on our posts. We have a legitimate interest in processing for the purpose of presenting our company to the outside world in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR. In addition, we only process your data if you voluntarily contact us via our Instagram profile. The legal basis for the processing is therefore your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a) GDPR.

Disclosure to third parties:
Your data will not be passed on to third parties. Data that you post publicly on our Instagram profile end is also visible to everyone.

Transfer to third countries:
The data is transferred to Meta in the USA in accordance with Art. 45 GDPR. The European Commission has issued an adequacy decision for the USA. Meta is certified in accordance with the EU-US Data Privacy Framework. In addition, we have agreed standard contractual clauses (https://de-de.facebook.com/help/566994660333381), which offer suitable guarantees within the meaning of Art. 46 GDPR.

Deletion of data:
Your public posts on our Instagram profile will not be deleted. However, you can delete them yourself at any time. We delete comments that we become aware of that violate legal regulations or our guidelines.
We will delete your messages to us as soon as the request has been dealt with.

Data processing by Meta:
In principle, personal data may also be processed outside the EU. User profiles are also created in order to personalize advertisements. The parent company Meta Platforms, Inc., based in California, USA, is certified in accordance with the EU-US Data Privacy Framework.
Information on how advertising can be customized and what to do if you do not want this can be found at www.youronlinechoices.com. Meta is responsible for the personal data collected in the Instagram profile end. For the data processed by Meta, Meta remains responsible under the GDPR for the implementation of information obligations and data subject rights. Further information about the Instagram profile end can be found at: https://privacycenter.instagram.com/policy/.

TikTok

We use the social media platform TikTok from TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, D02 HD23, Dublin, Ireland (hereinafter referred to as TikTok). This privacy policy applies to our profiles https://www.tiktok.com/@heroal_karriere and https://www.tiktok.com/@talentevent_verl?_r=1&_t=ZG-92ILGUmxTiS.

TikTok and we are joint controllers within the meaning of Art. 26 GDPR for some data processing. In some cases, TikTok acts as a processor for us in accordance with Art. 28 GDPR. For these purposes, we have concluded both a joint controllership agreement and a data processing agreement with TikTok, which are available here: https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms.

Purpose and legal basis of the processing:
Insofar as we can influence data processing, we ensure that it is carried out in compliance with data protection regulations.
We process your data for the purpose of informing you about our activities and communicating with you. We use our TikTok profile to attract new employees, customers and business partners. It is also possible to get in touch with you via direct messages or public comments on our posts. We have a legitimate interest in processing for the purpose of presenting our company to the outside world in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR. In addition, we only process your data if you voluntarily contact us via our TikTok profile. The legal basis for the processing is therefore Art. 6 para. 1 subpara. 1 lit. a) GDPR.

Disclosure to third parties:
We do not pass on the data we receive from you through your TikTok profile to third parties. Data that you post publicly on our TikTok profile end is visible to everyone.

Deletion of the data:
Your public posts on our TikTok profile will not be deleted. However, you can delete them yourself at any time. We delete comments that violate legal regulations or our guidelines.
We will delete your messages to us as soon as the request has been dealt with.

Data processing by TikTok:
In principle, personal data may also be processed outside the EU. User profiles are also created in order to personalize advertisements. Further information on data protection on TikTok can be found at: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE.

LinkedIn

We use the social media platform LinkedIn of LinkedIn Corp., 2029 Stierlin Court, Mountain View, CA 94043, USA (hereinafter: LinkedIn).

LinkedIn and we are joint controllers within the meaning of Art. 26 GDPR for the profile www.linkedin.com/company/heroal---johann-henkenjohann-gmbh-&-co.-kg/. A corresponding agreement between the parties can be found at https://legal.linkedin.com/pages-joint-controller-addendum.

Data types:
If you interact with us on our LinkedIn profile, we process your (user) name, account information and any other data you provide on your profile end or in the frame of the communication.

Purpose and legal basis of the processing:
We process your data for the purpose of providing information about our activities and communicating with you. We use our LinkedIn profile to present ourselves to the outside world and to provide information on current topics and our activities. It is also possible to contact you via direct messages or public comments on our posts. We have a legitimate interest in processing for the purpose of presenting our company to the outside world in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR. In addition, we only process your data if you voluntarily contact us via our LinkedIn profile. The legal basis for the processing is therefore Art. 6 para. 1 subpara. 1 lit. a) GDPR.

Disclosure to third parties:
We do not share the data we receive from you through your LinkedIn profile with third parties. Data that you post publicly on our LinkedIn profile end is visible to everyone.

Transfer to third countries
Your data is processed on LinkedIn servers in the USA. LinkedIn is certified according to the EU-US Data Privacy Framework, so that the transfer is based on an adequacy decision in accordance with Art. 45 GDPR. In addition, the standard contractual clauses pursuant to Art. 46 GDPR have been agreed, which you can view at https://de.linkedin.com/legal/l/dpa.

Deletion of the data:
Your public posts on our LinkedIn profile will not be deleted. However, you can delete them yourself at any time. We delete comments that violate legal regulations or our guidelines.
We will delete your messages to us as soon as the request has been dealt with.

Data processing by LinkedIn:
Information on data processing by LinkedIn can be found at https://de.linkedin.com/legal/privacy-policy.

XING

We use the social media platform XING of New Work SE, Am Strandkai 1, 20457 Hamburg, Germany (hereinafter: XING).

XING and we are each independent controllers. Information on data processing by XING can be found at https://privacy.xing.com/de/datenschutzerklaerung.

Data types:
If you interact with us on our XING profile, we process your (user) name, account information and any other data that you provide on your profile or in the frame of communication.

Purpose and legal basis of the processing:
We process your data for the purpose of providing information about our activities and communicating with you. We use our XING profile to present ourselves to the outside world and to provide information on current topics and our activities. It is also possible to contact you via direct messages or public comments on our posts. We have a legitimate interest in processing for the purpose of presenting our company to the outside world in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR. In addition, we only process your data if you voluntarily contact us via our XING profile. The legal basis for the processing is therefore Art. 6 para. 1 subpara. 1 lit. a) GDPR.

Disclosure to third parties:
We do not pass on the data we receive from you via your XING profile to third parties. Data that you post publicly on our XING profile end is visible to everyone.

Transfer to third countries:
We do not transfer your data to third countries. A transfer by XING cannot be ruled out. XING complies with the requirements of the GDPR: https://privacy.xing.com/de/datenschutzerklaerung/wer-erhaelt-daten-zu-ihrer-person/drittlaender. Data transfers are therefore carried out exclusively in accordance with Art. 45 et seq. GDPR on the basis of an adequacy decision or through the completion of standard contractual clauses.

Deletion of the data:
Your public posts on our XING profile will not be deleted. However, you can delete them yourself at any time. We delete comments that violate legal regulations or our guidelines.
We will delete your messages to us as soon as the request has been dealt with.

Data processing by XING:
Information about data processing by XING can be found at https://privacy.xing.com/de/datenschutzerklaerung.

YouTube

We use the YouTube video platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: YouTube).

YouTube acts as a processor for us. We have concluded an order processing contract with YouTube, which you can view here: https://www.youtube.com/t/terms_dataprocessing.

Data types:
When you interact with us on our YouTube profile, we process your (user) name, account information and any other data you provide on your profile end or in the frame of the communication.

Purpose and legal basis of the processing:
We process your data for the purpose of providing information about our activities and communicating with you. We use our YouTube profile to present ourselves to the outside world and to provide information about current topics and our activities. It is also possible to contact you via direct messages or public comments on our posts. We have a legitimate interest in processing for the purpose of presenting our company to the outside world in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR. In addition, we only process your data if you voluntarily contact us via our YouTube profile. The legal basis for the processing is therefore Art. 6 para. 1 subpara. 1 lit. a) GDPR.

Disclosure to third parties:
We do not share the data we receive from you through your YouTube profile with third parties. Data that you post publicly on our YouTube profile end is visible to everyone.

Transfer to third countries:
We have concluded the standard contractual clauses as a suitable guarantee in accordance with Art. 46 GDPR (https://business.safety.google/adsprocessorterms/sccs/).

Deletion of the data:
Your public posts on our YouTube profile will not be deleted. However, you can delete them yourself at any time. We delete comments that violate legal regulations or our guidelines.
We will delete your messages to us as soon as the request has been dealt with.

Data processing by YouTube:
In principle, personal data may also be processed outside the EU. Further information on data protection on YouTube can be found at: https://policies.google.com/privacy?hl=de.

Pinterest

We operate our presence on Pinterest together with Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). This privacy policy applies to our Pinterest at www.pinterest.com/heroalJohannHenkenjohann. In the frame of certain processing operations (in particular for statistics/insights, reach measurement, audience targeting, playout and measurement of content/ads), there is joint responsibility in accordance with Art. 26 GDPR. The main contents of the distribution of responsibility are provided by Pinterest at https://business.pinterest.com/de/pinterest-advertising-services-agreement/germany/. Irrespective of this, you can assert your data subject rights both against us and against Pinterest.

Pinterest also acts as a processor for us. We have concluded an order processing contract with Pinterest, which you can also view here: https://business.pinterest.com/de/pinterest-advertising-services-agreement/germany/.

Data types:
When you interact with us on our Pinterest profile, we process content and communication data (e.g. comments, messages, interactions with our pins/boards, times), profile end data (e.g. profile name, photo, public information, follower status, if visible in the frame of your Pinterest settings), usage data (e.g. page views, interaction metrics, device/log data)

Purpose and legal basis of the processing:
We process your data for the purpose of providing information about our activities and communicating with you. We use our Pinterest profile to present ourselves to the outside world and to provide information about current topics and our activities. It is also possible to get in touch with you via direct messages or public comments on our posts. We have a legitimate interest in processing for the purpose of presenting our company to the outside world in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR. In addition, we only process your data if you voluntarily contact us via our Pinterest profile. The legal basis for the processing is therefore Art. 6 para. 1 subpara. 1 lit. a) GDPR.

Disclosure to third parties:
We do not pass on the data we receive from you through your Pinterest profile to third parties. Data that you post publicly on our Pinterest profile end is visible to everyone.

Transfer to third countries:
Pinterest may transfer data to third countries, in particular the USA. Such transfers are made on the basis of adequacy decisions (Art. 45 GDPR) or suitable guarantees, such as standard contractual clauses (Art. 46 GDPR).

Deletion of the data:
Your public posts on our Pinterest profile will not be deleted. However, you can delete them yourself at any time. We delete comments that violate legal regulations or our guidelines.
We will delete your messages to us as soon as the request has been dealt with.

Data processing by Pinterest:
In principle, personal data may also be processed outside the EU. Further information on data protection on Pinterest can be found at: https://policy.pinterest.com/de/privacy-policy.

Information about your right to object in accordance with Art. 21 General Data Protection Regulation (GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR (data processing on the basis of a balance of interests); this also applies to any profiling based on this provision within the meaning of Article 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

In individual cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is in connection with such direct advertising.

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

The objection can be made in any form and should, if possible, be addressed to the bodies named in the data protection declaration in the first offcut - general part under points 1 and 2.

As of: 21 March 2026