Privacy Policy

We welcome you to our website and appreciate your interest. The protection of your personal data is of great importance to us. We therefore conduct our activities in accordance with the applicable legal provisions on the protection of personal data and data security. Below, we would like to inform you about which data from your visit is used and for what purposes.

Data controller under the GDPR

The controller within the meaning of the General Data Protection Regulation and other data protection laws applicable in the Member States of the European Union, as well as other provisions relating to data protection, is:

Friedrich Hippe Maschinenfabrik + Gerätebau GmbH
Töpferstraße 25
49170 Hagen a.T.W.
Mail: info@i-like-no-spam.friedrich-hippe.de
Phone: +49 5405 616700-0

Data Protection Officer

Nils Möllers
Keyed GmbH
Siemensstraße 12
48341 Altenberge, Westfalen
E-Mail: info@i-like-no-spam.keyed.de
Phone: +49 2505 639797
Web: www.keyed.de

1. What is personal data?
The term ‘personal data’ is defined in the Federal Data Protection Act and in the EU GDPR. According to these, personal data refers to specific details regarding the personal or factual circumstances of an identified or identifiable natural person. This includes, for example, your full name, your address, your telephone number or your date of birth.

2. Scope of anonymous data collection and data processing
Unless otherwise stated in the following sections, no personal data is collected, processed or used when you use our websites. However, through the use of analysis and tracking tools, we obtain certain technical information based on the data transmitted by your browser (for example, browser type/version, operating system used, web pages visited on our site including duration of visit, previously visited website). We evaluate this information solely for statistical purposes.

3. Relevant legal bases for the processing of personal data
a. Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
b. Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
c. Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.
d. Where the vital interests of the data subject or of another natural person require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis.
e. e. If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) GDPR serves as the legal basis for the processing.

4. Use of cookies
The website of Friedrich Hippe Maschinenfabrik + Gerätebau GmbH uses cookies. Cookies are data stored by the internet browser on the user’s computer system. Cookies may be transmitted to a page when it is accessed, thereby enabling the user to be identified. Cookies help to simplify the use of websites for users.

It is possible to object to the setting of cookies at any time by adjusting the settings in your web browser accordingly. Cookies that have been set can be deleted. Please note that if you disable cookies, you may not be able to make full use of all the features of our website. The user data collected in this way is pseudonymised through technical measures. Consequently, it is no longer possible to link the data to the user accessing the site. The data is not stored together with other personal data of the users. When accessing our website, users are informed via an information banner about the use of cookies for analytical purposes and referred to this privacy policy. In this context, there is also a note on how the storage of cookies can be prevented in the browser settings.

The legal basis for the processing of personal data using technically necessary cookies is Article 6(1)(f) GDPR. The legal basis for the processing of personal data using cookies for analytical purposes is Article 6(1)(a) GDPR, provided the user has given their consent. Please refer to our cookie banner and the information in this privacy policy to find out whether and to what extent cookies are used on our website.

5. Mindshape Cookie Consent

Description and purpose
We use the “Mindshape Cookie Consent” service provided by mindshape GmbH, Bonner Straße 172–176, 50968 Cologne, Germany. “Mindshape Cookie Consent” is a consent management tool (CMP) and is used to manage cookies and similar technologies on our website. Via the consent management tool, users can decide on their first visit which cookies may be set. In doing so, “Mindshape Cookie Consent” processes information relating to your consent (e.g. IP address in truncated form, time and scope of consent or refusal, device used, and browser information). The purpose of the processing is the legally compliant collection, documentation and management of consents in accordance with the GDPR and the TTDSG, as well as the correct display of the cookie banner when the website is accessed.

Legal basis
The use of “Mindshape Cookie Consent” is based on Article 6(1)(c) GDPR (legal obligation to manage consents) and Article 6(1)(f) GDPR (legitimate interest in legally compliant website operation).

Recipient
The recipient of the data is mindshape GmbH, Bonner Straße 172–176, 50968 Cologne, Germany.

Transfer to third countries
Data is not generally transferred to third countries. Nevertheless, data transfer to a third country can never be completely ruled out. In the event of a transfer of personal data, the provider ensures the level of protection required by the GDPR by complying with Articles 44 et seq. of the GDPR. If you have any questions, please contact our Data Protection Officer.

Duration of data storage
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. Furthermore, the data will be deleted if you exercise your right to erasure within the meaning of Article 17(1) GDPR.

Contractual or legal obligation
Furthermore, you must provide any personal data which we are legally obliged to collect (or) the provision of which is necessary to comply with a legal obligation. This legal obligation is laid down by Union law or the law of the Member States to which the controller is subject. Failure to provide the data would mean that this legal obligation cannot be fulfilled.

Further data protection information
Further information on the processing of your personal data can be found here: https://www.mindshape.de/datenschutz/

6. Creation of log files
Every time the website is accessed, Friedrich Hippe Maschinenfabrik + Gerätebau GmbH collects data and information via an automated system. This is stored in the server’s log files. The data is also stored in our system’s log files. This data is not stored together with other personal data relating to the user.
The following data may be collected in this process:

(1)   Information about the browser type and version used
(2)   The user’s operating system
(3)   The user’s internet service provider
(4)   The user’s IP address
(5)   Date and time of access
(6)   Websites from which the user’s system accesses our website (referrer)
(7)   Websites accessed by the user’s system via our website

7. Duration of storage of personal data

Personal data is stored for the duration of the applicable statutory retention period. Once this period has expired, the data is routinely deleted, unless it is required for the initiation or fulfilment of a contract.

8. Ways to contact us

The website of Friedrich Hippe Maschinenfabrik + Gerätebau GmbH features a contact form that can be used to make contact electronically. Alternatively, contact can be made via the email address provided. If the data subject contacts the data controller via one of these channels, the personal data transmitted by the data subject is automatically stored. The storage serves solely for the purposes of processing the enquiry or contacting the data subject. The data will not be disclosed to third parties. The legal basis for the processing of the data is Article 6(1)(a) GDPR, provided the user has given their consent. The legal basis for processing data transmitted while sending an email is Article 6(1)(f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data from the contact form input field and that sent by email, this is the case once the relevant conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved.

9. Newsletter
If you subscribe to our company’s newsletter, the data entered in the relevant form will be transmitted to the data controller. Registration for our newsletter takes place via a so-called double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary to ensure that no one can register using someone else’s email address. When you subscribe to the newsletter, the user’s IP address and the date and time of registration are stored. This is to prevent misuse of the services or the data subject’s email address. The data will not be passed on to unauthorised third parties. However, data necessary for the purpose of sending the newsletter may be transmitted to relevant service providers. An exception also applies where there is a legal obligation to disclose such data. The data is used exclusively for the purpose of sending the newsletter. The data subject may cancel their subscription to the newsletter at any time. Similarly, consent to the storage of personal data may be withdrawn at any time. A link for this purpose is included in every newsletter. The legal basis for processing the data following the user’s subscription to the newsletter is Article 6(1)(a) GDPR, provided the user has given their consent. The legal basis for sending the newsletter following the sale of goods or services is Section 7(3) UWG.

10. CleverReach

Description and purpose
We use the CleverReach service to send newsletters. The provider of the service used is CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede. CleverReach is a service that enables the organisation and analysis of newsletter distribution. The data you enter when subscribing to the newsletter, such as your email address, is stored on CleverReach’s servers in Germany or Ireland. Newsletters sent via CleverReach allow us to analyse the behaviour of the respective newsletter recipient. In this context, it is possible, among other things, to analyse how many recipients have opened the respective newsletter message and how often, for example, one of the links in the respective newsletter has been clicked. Furthermore, it is possible to use so-called conversion tracking to analyse whether an action defined in advance in CleverReach has been triggered, such as the purchase of goods on this website or the use of a service, after a link in the newsletter has been clicked.

Legal basis
The legal basis for data processing is your consent in accordance with Article 6(1)(a) GDPR. You may withdraw this consent at any time by unsubscribing from the newsletter. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.

Recipient
The recipient of the data is CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede.

Transfer to third countries
The data you provide when subscribing to the newsletter, such as your email address, is stored on CleverReach’s servers in Germany or Ireland.

Retention period
Recipients’ activities are stored in CleverReach for three to six months. The exact duration depends on the total number of newsletter recipients. In the event of a withdrawal of consent, the data will be deleted. Further information on the storage period and regarding the activities generated by CleverReach can be found at: https://support.cleverreach.de/hc/de/articles/202372941-Wie-lange-speichert-CleverReach-die-Aktivit%C3%A4ten

Contractual or legal obligation to provide personal data
The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are also not otherwise obliged to provide personal data. However, failure to provide such data would mean that we cannot offer you a newsletter and therefore cannot send it to you.

Right to withdraw consent
If you do not wish to be analysed by CleverReach, you must unsubscribe from the newsletter by clicking on the relevant link contained in every newsletter email. You can also unsubscribe from the newsletter directly via the website. The data you have provided to us for the purpose of receiving the newsletter will be stored until you unsubscribe from the newsletter and, in the event that you unsubscribe from the newsletter, will be deleted from both our servers and the CleverReach servers. If your data has been stored by us for another purpose, such as your email address for registering on our website, this data will continue to be stored regardless of whether you unsubscribe from the newsletter.

Further data protection information
Further information on data protection at CleverReach is available at: https://www.cleverreach.com/de/datenschutz/ Information on data analysis by the CleverReach newsletter is available at: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.

11. Routine deletion and blocking of personal data
The data controller shall process and store the data subject’s personal data only for as long as is necessary to fulfil the purpose of storage. Data may also be stored if this is provided for by European or national legislation in EU regulations, laws or other provisions to which the data controller is subject. As soon as the purpose of storage ceases to apply or a retention period prescribed by the aforementioned provisions expires, the personal data is routinely blocked or deleted.

12. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

12.1 Right of access pursuant to Article 15 GDPR
You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request the following information from the controller:

a) the purposes for which the personal data is processed;
b) the categories of personal data being processed;
c) the recipients or categories of recipients to whom your personal data have been or will be disclosed;;
d) the envisaged period for which your personal data will be stored, or, if this is not possible, the criteria used to determine that period;
e) the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller, or a right to object to such processing;
f) the existence of a right to lodge a complaint with a supervisory authority;
g) any available information as to the source of the data, where the personal data are not collected from the data subject;
h) the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether your personal data is being transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer.

12.2 Right to rectification pursuant to Article 16 GDPR
You have the right to request from the controller the rectification and/or completion of your personal data if the personal data concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

12.3 Right to erasure pursuant to Article 17 GDPR
12.3.1You may request that the controller erases your personal data without undue delay, and the controller is obliged to erase such data without undue delay, provided that one of the following grounds applies:

a) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
b) You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for the processing.
c) You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.
d) The personal data concerning you has been processed unlawfully.
e) The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject
f) The personal data concerning you was collected in relation to information society services offered pursuant to Article 8(1) GDPR.

12.3.2 Where the controller has made your personal data public and is obliged to erase it pursuant to Article 17(1) GDPR, the controller shall, taking into account available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to such personal data or of copies or replicas of such personal data.

12.3.3 The right to erasure does not apply where the processing is necessary

a) for the exercise of the right to freedom of expression and information;
b) to comply with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
e) for the establishment, exercise or defence of legal claims.

12.4 Right to restriction of processing pursuant to Article 18 GDPR
You may request the restriction of the processing of your personal data under the following conditions:

a) if you contest the accuracy of your personal data for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of the use of the personal data;
c) the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
d) if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds.
Where the processing of your personal data has been restricted, such data – apart from storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State. If the restriction on processing has been imposed in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

12.5 Right to be informed pursuant to Article 19 GDPR
If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller of these recipients.

12.6 Right to data portability pursuant to Article 20 GDPR
You have the right to receive the personal data you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

a) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR, and
b) the processing is carried out by automated means. In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, insofar as this is technically feasible. This must not adversely affect the rights and freedoms of others. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

12.7 Right to object pursuant to Article 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller shall no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to processing for the purposes of direct marketing, your personal data will no longer be processed for these purposes. In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you have the option of exercising your right to object by means of automated procedures using technical specifications.

12.8 Right to withdraw consent under data protection law pursuant to Article 7(3) GDPR
You have the right to withdraw your consent to data processing at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.

12.9 Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

a) is necessary for the conclusion or performance of a contract between you and the controller,
b) is authorised by Union or Member State law to which the controller is subject, and that law provides for appropriate measures to safeguard your rights and freedoms and your legitimate interests; or
c) is based on your explicit consent.

However, such decisions must not be based on special categories of personal data as referred to in Article 9(1) GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests.
With regard to the cases referred to in (a) and (c), the controller shall take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

12.10 Right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

14. Integration of other third-party services and content

Description and purpose
It may happen that third-party content, such as videos, fonts or graphics from other websites, is integrated into this online service. This always requires that the providers of this content (hereinafter referred to as “third-party providers”) receive the user’s IP address. Without the IP address, they would not be able to send the content to the user’s browser. The IP address is therefore necessary for the display of this content. We endeavour to use only such content whose respective providers use the IP address solely for the delivery of the content. However, we have no influence over whether third-party providers store the IP address, for example for statistical purposes. Where we are aware of this, we inform users accordingly. We aim to provide and improve our online service through these integrations.

Legal basis
The legal basis for the integration of other third-party services and content is Article 6(1)(f) GDPR. Our overriding legitimate interest lies in the intention to present our online presence appropriately and to provide user-friendly and economically efficient services on our part. For further information, please refer to the respective privacy policies of the providers.

Contractual or legal obligation to provide personal data
The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are also not obliged to provide personal data. However, failure to provide such data may, under certain circumstances, result in you being unable to use this function at all or to the full extent.

Data transfer to third countries
The controller may transfer personal data to a third country. In principle, the controller can ensure an adequate level of protection for the processing by means of various appropriate safeguards. Data transfers may be carried out on the basis of an adequacy decision, internal data protection regulations, approved codes of conduct, standard data protection clauses or an approved certification mechanism in accordance with Article 46(2)(a) to (f) GDPR.

If the controller carries out a transfer to a third country on the legal basis of Article 49(1)(a) GDPR, you will be informed here of the potential risks of a data transfer to a third country.

There is a risk that the third country receiving your personal data may not be able to provide a level of protection equivalent to that afforded to personal data within the European Union. This may be the case, for example, if the European Commission has not issued an adequacy decision for the third country in question or if certain agreements between the European Union and the third country in question are declared invalid. Specifically, in some third countries there are risks regarding the effective protection of EU fundamental rights due to the application of surveillance laws (for example, the USA). In such a case, it is the responsibility of the controller and the recipient to assess whether the rights of data subjects in the third country enjoy a level of protection equivalent to that in the Union and can also be effectively enforced.

However, the General Data Protection Regulation should not undermine the level of protection guaranteed throughout the Union for natural persons when personal data is transferred from the Union to controllers, processors or other recipients in third countries or to international organisations, even where personal data is transferred from a third country or an international organisation to controllers or processors in the same or another third country or to the same or another international organisation.

15. Links to social media platforms
Our website contains links to external social media platforms (e.g. LinkedIn, YouTube, Facebook, Instagram). These are exclusively hyperlinks that redirect to the respective platforms. No social media plug-ins are used that establish a direct connection to the providers’ servers.

Processing of personal data
When you click on such a link, you leave our website and are redirected directly to the page of the respective social media provider. From this point onwards, the processing of your personal data is carried out by the respective provider. We have no influence over the collection, processing and use of personal data by these providers.

Social media providers

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland Datenschutzerklärung LinkedIn
YouTube Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland Datenschutzerklärung YouTube
Meta Platforms Ireland Ltd. (Facebook), 4 Grand Canal Square, Dublin 2, Irland Datenschutzerklärung Facebook
Meta Platforms Ireland Limited (Instagram), Merrion Road, Dublin 4, D04 X2K5, Irland Meta Privacy Policy – How Meta collects and uses user data | Privacy Centre | Manage your privacy on Facebook, Instagram and Messenger | Facebook Privacy

Recipients of the data / Transfer to third countries
By clicking on the link, data (e.g. your IP address, time of visit) is transmitted to the respective provider. Providers may also transfer data to third countries (in particular the USA). Please refer to the privacy policy of the respective platform.

Retention period
We do not store any personal data in connection with the links. Please refer to the privacy policies of the social media providers for information on their retention periods.

Your rights
You have the rights set out in Articles 15 et seq. GDPR (right of access, rectification, erasure, restriction of processing, data portability and objection) in relation to us. To exercise your rights in relation to the social media providers, please contact them directly.

16. Other website features

16.1 Matomo web analytics service

Description and purpose
Our website uses Matomo (formerly Piwik), an open-source software for the statistical analysis of visitor traffic. Matomo is provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Matomo uses cookies that are stored on your computer and enable an anonymised analysis of your use of the website. It is generally not possible to identify a specific individual, as your IP address is anonymised immediately after processing and before storage. Matomo is used for the purpose of improving the quality of our website and its content. This enables us to understand how the website is used and thus continuously optimise our offering. When individual pages of our website are accessed, the following data is stored: 1. Two bytes of the IP address of the user’s system accessing 2. The webpage accessed 3. The website from which the user accessed the webpage (referrer) 4. The subpages accessed from the webpage in question 5. The duration of the visit to the website 6. The frequency of visits to the website. The software runs exclusively on our website’s servers. Personal data of users is stored only there. The data is not passed on to third parties. The software is configured so that IP addresses are not stored in full; instead, 2 bytes of the IP address are masked. In this way, it is no longer possible to link the truncated IP address to the accessing computer. The processing of users’ personal data enables us to analyse our users’ browsing behaviour.

Legal basis
The legal basis for the processing of your personal data is Article 6(1)(a) GDPR.

Recipient
The recipient of your personal data is Matomo, InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand.

Transfer to third countries
By using the service, personal data may be transferred to a third country. In the event of a transfer of personal data, the provider ensures the level of protection required by the GDPR by complying with Articles 44 et seq. GDPR. Unless there is an adequacy decision in place with the third country in which the data importer is established, the transfer is subject to appropriate safeguards. If you have any queries, please contact our Data Protection Officer.

Right to withdraw consent
You have the right to withdraw your consent at any time, cf. Article 7(3) sentence 1 GDPR. This may be done informally and without giving reasons and takes effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. Further information on this can be found above in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation
There is no contractual or legal obligation to provide the data.

Further data protection information
Further information on the processing of your personal data can be found here: https://matomo.org/privacy-policy/

16.2 Applications (Apprenticeships & Job Vacancies)
By submitting their application to us, applicants consent to the processing of their data for the purposes of the application process in the manner and to the extent set out in this privacy policy. The legal basis for the processing of applicant data is Article 88 GDPR, Section 26 of the BDSG-neu and Article 9(2)(b) GDPR. Where, in the context of the application process, special categories of personal data within the meaning of Article 9(1) GDPR are provided voluntarily, their processing is additionally carried out in accordance with Article 9(2)(b) GDPR (e.g. health data, such as severe disability status or ethnic origin).

Where special categories of personal data within the meaning of Article 9(1) GDPR are requested from applicants as part of the application process, their processing is additionally carried out in accordance with Article 9(2)(a) GDPR (e.g. health data, where this is necessary for the performance of the job). Where available, applicants may submit their applications to us via an online form on our website. The data is transmitted to us in encrypted form using state-of-the-art technology. Furthermore, applicants may submit their applications to us via email. However, please note that emails are generally not sent in encrypted form and applicants must ensure encryption themselves. We cannot therefore accept any responsibility for the transmission of the application between the sender and our server, and we therefore recommend using an online form or sending the application by post. This is because, instead of applying via the online form or email, applicants still have the option of sending their application to us by post. The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job vacancy is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Deletion takes place after a period of six months has elapsed, so that we can answer any follow-up questions regarding the application and fulfil our obligations to provide evidence under the General Equal Treatment Act. Invoices for any travel expense reimbursements are archived in accordance with tax regulations.

17. Recipients of data
Where permitted or required by law, or where you have given your consent, we also disclose your personal data to other recipients who provide services on our behalf. We limit the disclosure of your personal data to what is strictly necessary. In some cases, our service providers receive your personal data as data processors and are then strictly bound by our instructions when handling your personal data (data processing agreement in accordance with Article 28 GDPR). In other cases, the recipients act independently with the data we transfer to them. The following categories of service providers/recipients may receive your data:

Providers of email marketing via newsletters
Providers of hosting services for the operation of our servers
Service providers in the field of recruitment to assist with the selection of applicants
Service providers for development work, including programming, development, maintenance and support of software applications
Postal service providers
External legal advisers
Marketing agencies/website management
Other IT service providers (e.g. system integrators)
Other services and tools

The service providers we engage must comply with strict confidentiality requirements. They are granted only the access to your data that is necessary to carry out their assigned tasks.

In the event of a suspected criminal offence, data may be passed on to law enforcement agencies.

18. Company social media presence

Below, we provide information on the relevant social networks that process personal data in the context of joint controllership pursuant to Article 26 GDPR with Friedrich Hippe Maschinenfabrik + Gerätebau GmbH. The company has set out in a transparent manner in an agreement with each social media network which of them fulfils which obligation under the General Data Protection Regulation in accordance with Article 26(1) GDPR, in particular with regard to the exercise of the data subject’s rights, and which of them complies with which information obligations in accordance with Article 12 et seq. GDPR.

Notwithstanding the details of this agreement, the data subject may exercise their rights under this Regulation with and against each of the controllers.

18.1 Facebook

The joint controller is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

In order to inform prospective customers and clients about our company and our services or promotions, we operate so-called Facebook business pages on the social media platform “Facebook”. When you visit our Facebook page, the platform processes, among other things, personal data such as your IP address and other information retrieved from your device via cookies. Page Insights may be based on personal data collected in connection with a visit or interaction by individuals on or with a page and its content.

This information is processed to provide us with statistical information, such as the number of people who have visited the Facebook page and demographic information. You can find more details at: https://de-de.facebook.com/help/pages/insights.

Obligations of the joint controllers
Meta Platforms Ireland Limited is obliged to assume primary responsibility in accordance with our agreement within the meaning of Article 26(1) GDPR for the processing of personal data and to fulfil all obligations under the GDPR with regard to the principles and lawfulness of the processing of personal data. This includes, in particular, fulfilling information obligations, safeguarding the rights of data subjects and ensuring the security of processing.

Contacting us to exercise data subject rights
We forward enquiries regarding the rights of data subjects (Articles 15–22 GDPR) to the primary controller, Meta Platforms Ireland Limited, via a dedicated form. This also includes requests for access to, rectification, erasure and/or objections to or restriction of data, as well as requests from supervisory authorities in connection with the processing of data under the General Data Protection Regulation.

Recipients
It cannot be ruled out that the data may be transferred to third parties by the social network. For further information on this, please refer to the social network’s privacy policy. We do not transfer the data to third-party recipients.

Transfer to third countries
Your personal data processed in this context may be transferred by Meta Platforms Ireland Limited to a third country. It cannot be ruled out that Meta Platforms Ireland Limited may transfer data to its affiliated company “Meta Platforms Inc.”, based in the United States. Further information on this can be found in Facebook’s privacy policy, which is referred to under “Further privacy information”.

Duration of data storage
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

Contractual or legal obligation to provide data
There is no contractual or legal obligation to provide the data.

Right to object
SYou can prevent the collection and transmission of personal data (in particular your IP address) and the processing of this data by the social network by disabling the execution of script code in your browser, installing a script blocker in your browser or activating the ‘Do Not Track’ setting in your browser. Furthermore, Meta Platforms Ireland Limited offers the option to regulate data processing operations. Further details can be found at: www.facebook.com/settings.

You have the right to object to the processing operations, in particular the processing of direct messages, by Friedrich Hippe Maschinenfabrik + Gerätebau GmbH. You may send your reasoned objection in accordance with Article 21 GDPR to the contact details of Friedrich Hippe Maschinenfabrik + Gerätebau GmbH provided above.

Further data protection information
Further information on the Page Insights supplement regarding the data controller can be found at: https://www.facebook.com/legal/terms/page_controller_addendum

The privacy policy of Meta Platforms Ireland Limited can be found at:

18.2 Instagram

The joint controller is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

To promote our products and services and to communicate with prospective customers or clients, we operate a business account on the social media platform “Instagram”. When you visit our online presence on the Instagram platform, Facebook Ireland Ltd., as the platform operator, processes user data (e.g. personal information, IP address, etc.).

The processing of users’ personal data serves the purpose of providing us with statistical information about the use of our online presence. Furthermore, this data is processed by Meta Platforms Ireland Limited for market research and advertising purposes. If users are logged in to the platform, Meta Platforms Ireland Limited may also use this data to display personalised advertising outside of Instagram.

If you use the option on Instagram to contact us via a direct message, your data will be used to answer your question and clarify the matter. The conversation will then be deleted.

Instagram Insights may be based on personal data collected in connection with a visit or interaction by individuals on or with a page and its content. You can find more details about Insights at: https://de-de.facebook.com/business/help/441651653251838?id=419087378825961

It cannot be ruled out that Meta Platforms Ireland Limited may also use the content of these messages for its own purposes. Further information on the data collected by Instagram can be found at: https://help.instagram.com/519522125107875/?helpref=hc_fnav&bc[0]=Instagram-Help-Centre&bc[1]=Policies%20and%20Reports

Obligations of the joint controllers
Meta Platforms Ireland Limited is obliged to assume primary responsibility for the processing of personal data in accordance with our agreement within the meaning of Article 26(1) GDPR, and to fulfil all obligations under the GDPR with regard to the principles and lawfulness of the processing of personal data. This includes, in particular, fulfilling information obligations, safeguarding the rights of data subjects and ensuring the security of processing.

Transfer to third countriesr
Your personal data processed in this context may be transferred by Meta Platforms Ireland Limited to a third country. It cannot be ruled out that Meta Platforms Ireland Limited may transfer data to its affiliated company “Meta Platforms Inc.”, based in the United States. Further information on this can be found in Instagram’s privacy policy, which is referred to under “Further privacy notices”.

Duration of data storage
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

Contractual or legal obligation to provide data
There is no contractual or legal obligation to provide the data.

Right to object
You can prevent the collection and transmission of personal data (in particular your IP address) and the processing of this data by the social network by disabling the execution of script code in your browser, installing a script blocker in your browser or activating the ‘Do Not Track’ setting in your browser.

You have a right to object to the processing operations, in particular the processing of direct messages, vis-à-vis Friedrich Hippe Maschinenfabrik + Gerätebau GmbH. You may send your reasoned objection in accordance with Article 21 GDPR to the contact details of Friedrich Hippe Maschinenfabrik + Gerätebau GmbH provided above.

Further data protection information
The privacy policy of Meta Platforms Ireland Limited can be found at: https://www.facebook.com/privacy/

Instagram’s privacy policy, which includes information on, among other things, the nature, scope and purpose of data processing by Instagram, can be found at: https://help.instagram.com/519522125107875/?helpref=hc_fnav
https://help.instagram.com/519522125107875/?maybe_redirect_pol=0

18.3 LinkedIn

The joint controller is LinkedIn Ireland Unlimited Company, Wilton Place, Grand Canal Square 24, Dublin, Ireland.

To promote our products and services and to communicate with prospective customers or clients, we operate a business account on the social media platform “LinkedIn”. When you visit our online presence on the LinkedIn platform, LinkedIn Ireland Unlimited Company, as the platform operator, processes user data (e.g. personal information, IP address, etc.).

The processing of personal data relating to users of the social network serves the purpose of providing us with statistical information regarding the use of our online presence. Furthermore, this data is processed by LinkedIn Ireland Unlimited Company for market research and advertising purposes. If users are logged in to the platform, LinkedIn Ireland Unlimited Company may also use this data to display personalised advertising outside of LinkedIn.

Should you use the option on LinkedIn to contact us via a direct message, your data will be used to answer your question and clarify the matter. The conversation will then be deleted.

LinkedIn provides company profile insights, which supply us with anonymised statistical data about the visitors to our fan page. These so-called ‘Profile Insights’ are aggregated statistics generated on the basis of specific actions and logged by LinkedIn when users and visitors interact with our company profile and the associated content.

It cannot be ruled out that LinkedIn Ireland Unlimited Company may also use the content of these messages for its own purposes. For further information, please refer to the social network’s privacy policy.

Obligations of the joint controllers
LinkedIn Ireland Unlimited Company is obliged to assume primary responsibility in accordance with our agreement within the meaning of Article 26(1) GDPR for the processing of personal data and to fulfil all obligations under the GDPR with regard to the principles and lawfulness of the processing of personal data. This includes, in particular, fulfilling the information obligations, safeguarding the rights of data subjects and ensuring the security of the processing.

Contacting us to exercise data subject rights
We forward enquiries regarding the rights of data subjects (Articles 15–22 GDPR) to the primary controller, LinkedIn Ireland Unlimited Company, via a dedicated form. This includes requests for access to, rectification, erasure and/or objections to or restriction of data, as well as enquiries from supervisory authorities in the context of data processing under the General Data Protection Regulation.

Transfer to third countries
Your personal data processed in this context may be transferred by LinkedIn Ireland Unlimited Company to a third country. It cannot be ruled out that LinkedIn Ireland Unlimited Company may transfer data to its affiliate “Microsoft Corp.”, based in the United States. Further information on this can be found in LinkedIn’s privacy policy, which is referred to under “Further privacy notices”.

Duration of data storage
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

Contractual or legal obligation to provide data
There is no contractual or legal obligation to provide the data.

Further data protection information
The privacy policy of LinkedIn Ireland Unlimited Company can be found at: https://www.LinkedIn.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

LinkedIn’s privacy policy, which includes information on, amongst other things, the nature, scope and purpose of data processing in relation to cookies, can be found at: https://de.LinkedIn.com/legal/cookie-policy

18.4 YouTube

The joint controller is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

To promote our products and services and to communicate with prospective customers or clients, we operate a business account on the social media platform “YouTube”. When you visit our online presence on the YouTube platform, Google Ireland Limited, as the platform operator, processes user data (e.g. personal information, IP address, etc.) within the European Economic Area and in Switzerland.

The processing of personal data relating to users of the social network serves the purpose of providing us with statistical information regarding the use of our online presence at . Furthermore, this data is processed by Google Ireland Limited for market research and advertising purposes. If users are logged in to the platform, Google Ireland Limited may also use this data to display personalised advertising outside of YouTube.

Should you use the option on YouTube to contact us via a direct message, your data will be used to answer your question and clarify the matter. The conversation will then be deleted.

YouTube provides company profile insights, which supply us with anonymised statistical data about the visitors to our fan page. These so-called ‘Profile Insights’ are aggregated statistics generated on the basis of specific actions and logged by YouTube when users and visitors interact with our company profile and the associated content.

It cannot be ruled out that Google Ireland Limited may also use the content of these messages for its own purposes. For further information, please refer to the social network’s privacy policy.

Obligations of the joint controllers
Google Ireland Limited is obliged to assume primary responsibility in accordance with our agreement within the meaning of Article 26(1) GDPR for the processing of personal data and to fulfil all obligations under the GDPR with regard to the principles and lawfulness of the processing of personal data. This includes, in particular, fulfilling information obligations, safeguarding the rights of data subjects and ensuring the security of processing.

Contacting us to exercise data subjects’ rights
We forward enquiries regarding the rights of data subjects (Articles 15–22 GDPR) to the primary controller, Google Ireland Limited, via a dedicated form. This includes requests for access to, rectification, erasure and/or objections to or restriction of data, as well as enquiries from supervisory authorities in connection with the processing of data under the General Data Protection Regulation.

Transfer to third countries
Your personal data processed in this context may be transferred by Google Ireland Limited to a third country. It cannot be ruled out that Google Ireland Limited may transfer data to its affiliated company “Google LLC”, based in the United States. Further information on this can be found in Google’s privacy policy, which is referred to under “Further privacy information”.

Duration of data storage
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

Contractual or legal obligation to provide data
There is no contractual or legal obligation to provide the data.

Further data protection information
The privacy policy of Google Ireland Limited can be found at: https://policies.google.com/privacy?hl=de

19. Security

We have implemented comprehensive technical and organisational safeguards to protect your data against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons. Our security procedures are regularly reviewed and adapted to technological advancements. Furthermore, we ensure continuous data protection through ongoing auditing and optimisation of our data protection organisation.

20. Conclusion

Friedrich Hippe Maschinenfabrik + Gerätebau GmbH reserves all rights to make changes and updates to this privacy policy. This privacy policy was created on 28 May 2026.