Privacy Policy

This is a courtesy translation. Only the German version is legally binding.

We are delighted that you have shown interest in our company. Data protection is of particularly high priority for the management of SCHMIDLIN Labor + Service GmbH & Co. KG. The use of the SCHMIDLIN Labor + Service GmbH & Co. KG websites is generally possible without providing any personal data. However, if a data subject wishes to use special services of our company via our website, the processing of personal data could become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, email address or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection provisions applicable to SCHMIDLIN Labor + Service GmbH & Co. KG. By means of this privacy policy, our company would like to inform the public about the nature, scope and purpose of the personal data we collect, use and process. Furthermore, this privacy policy informs data subjects of the rights to which they are entitled.

As the controller, SCHMIDLIN Labor + Service GmbH & Co. KG has implemented numerous technical and organisational measures to ensure the most complete protection possible of personal data processed through this website. However, internet-based data transmissions may in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by telephone.

1. Definitions

The privacy policy of SCHMIDLIN Labor + Service GmbH & Co. KG is based on the terms used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy policy should be easy to read and understand for the general public as well as for our customers and business partners. To ensure this, we would first like to explain the terminology used.

In this privacy policy, we use, among others, the following terms:

• a) Personal data: Any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly.
• b) Data subject: Any identified or identifiable natural person whose personal data is processed by the controller.
• c) Processing: Any operation or set of operations performed on personal data, whether or not by automated means.
• d) Restriction of processing: The marking of stored personal data with the aim of limiting its processing in the future.
• e) Profiling: Any form of automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to a natural person.
• f) Pseudonymisation: The processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information.
• g) Controller or controller responsible for the processing: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• h) Processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• i) Recipient: A natural or legal person, public authority, agency or other body to which personal data is disclosed.
• j) Third party: A natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons acting under their instructions.
• k) Consent: Any freely given, specific, informed and unambiguous indication of the data subject's wishes.

2. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union and other provisions of a data protection nature is:

SCHMIDLIN Labor + Service GmbH & Co. KG
Karlstraße 80/1
72581 Dettingen an der Erms
Germany

Phone: 071239102100
Email: info@schmidlin-labor.de
Website: schmidlin-labor.de

3. Collection of general data and information (log files)

The website of SCHMIDLIN Labor + Service GmbH & Co. KG collects a series of general data and information each time it is accessed, which is stored in the server log files. The following may be collected: (1) browser types and versions, (2) the operating system, (3) the referrer URL, (4) the sub-pages accessed, (5) the date and time of access, (6) the IP address, (7) the internet service provider and (8) other similar data used for averting threats in the event of attacks.

When using this data, SCHMIDLIN Labor + Service GmbH & Co. KG does not draw any conclusions about the data subject. This information is needed to deliver the content correctly, to optimise it, to ensure the long-term functionality of the systems and to provide law enforcement authorities with information in the event of a cyberattack.

Storage period: For security reasons (e.g. to investigate misuse or fraud), server log files are stored for a maximum of 14 days and then automatically deleted. Data whose further retention is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally resolved.

4. Routine erasure and blocking of personal data

The controller processes and stores personal data of the data subject only for the period necessary to achieve the purpose of storage, or where this has been provided for by the European legislator or another legislator in laws or regulations.

If the purpose of storage ceases to apply or a prescribed storage period expires, the personal data is routinely blocked or erased in accordance with the statutory provisions.

5. Rights of the data subject

Every data subject is entitled to the rights granted by the European legislator under the GDPR. To exercise these rights, the data subject may contact an employee of the controller at any time:

• a) Right to confirmation: The right to request confirmation as to whether personal data concerning you is being processed.
• b) Right of access: The right to obtain free information about the personal data stored about you and a copy of this information.
• c) Right to rectification: The right to have inaccurate data rectified or incomplete data completed without undue delay.
• d) Right to erasure (right to be forgotten): The right to erasure without undue delay, provided there are no statutory retention obligations to the contrary.
• e) Right to restriction of processing: The right to request the restriction of processing if the accuracy of the data is contested or the processing is unlawful.
• f) Right to data portability: The right to receive the data you have provided in a structured, commonly used and machine-readable format.
• g) Right to object: The right to object at any time, on grounds relating to your particular situation, to the processing of data concerning you that is based on Art. 6 (1) (e) or (f) GDPR.
• h) Automated individual decision-making, including profiling: The right not to be subject to a decision based solely on automated processing.
• i) Right to withdraw consent under data protection law: The right to withdraw consent to the processing of personal data at any time with effect for the future.
• j) Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, email: poststelle@lfdi.bwl.de

6. Data protection in applications and the application process

The controller collects and processes the personal data of applicants for the purpose of handling the application process, including by electronic means (e.g. by email). If the controller concludes an employment contract with an applicant, the transmitted data is stored for the purpose of handling the employment relationship in compliance with the statutory provisions.

If no employment contract is concluded, the application documents are automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests of the controller conflict with deletion (e.g. a burden of proof in proceedings under the German General Equal Treatment Act – AGG).

7. Data protection provisions on the use of LinkedIn

Our website contains a link to our company page on LinkedIn (icon in the header and footer). The service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. This is a plain link only; no LinkedIn plugins or other LinkedIn components are embedded in our website. Simply visiting our website therefore does not transmit any data to LinkedIn.

Only when you click the link are you forwarded to LinkedIn. From that point on, LinkedIn processes your data under its own responsibility in accordance with LinkedIn's privacy policy. Where data is transferred to LinkedIn Corporation in the USA, an adequate level of data protection is ensured by the fact that LinkedIn Corporation (as a subsidiary of Microsoft Corp.) is certified under the EU-US Data Privacy Framework. If the data subject is logged in to LinkedIn at the same time, LinkedIn can assign the visit to their LinkedIn account.

8. Legal basis for processing

Art. 6 (1) (a) GDPR serves as the legal basis for our company for processing operations for which we obtain consent for a specific processing purpose.

Art. 6 (1) (b) GDPR serves as the legal basis where processing is necessary for the performance of a contract to which the data subject is party, or for taking steps prior to entering into a contract (e.g. in the case of product or service enquiries).

Art. 6 (1) (c) GDPR applies where our company is subject to a legal obligation, such as fulfilling retention obligations under tax or commercial law.

Art. 6 (1) (d) GDPR covers cases in which the vital interests of the data subject or of another natural person must be protected.

Art. 6 (1) (f) GDPR forms the basis for processing operations carried out to safeguard a legitimate interest of our company or of a third party, provided that the interests, fundamental rights and freedoms of the data subject do not override them (e.g. to ensure IT security or to conduct our business).

9. Legitimate interests in the processing pursued by the controller or a third party

Where the processing of personal data is based on Article 6 (1) (f) GDPR, our legitimate interest is to carry out our business for the benefit of the well-being of all our employees and our shareholders.

10. Period for which personal data is stored

The criterion for the duration of storage of personal data is the respective statutory retention period. After this period has expired, the corresponding data is routinely deleted, provided it is no longer required for the performance or initiation of a contract.

11. Statutory or contractual requirements to provide personal data; necessity for the conclusion of a contract; consequences of failure to provide

The provision of personal data is in part required by law (e.g. tax regulations) or may result from contractual provisions. Concluding a contract may sometimes require that data be provided to us. Failure to provide the data would mean that the contract with the data subject could not be concluded. Before providing data, the data subject may contact one of our employees, who will explain on a case-by-case basis whether the provision is necessary and what the consequences would be.

12. Existence of automated decision-making

As a responsible company, we do not use automated decision-making or profiling.

13. Web hosting and provision of the website

This website is hosted by an external service provider (web host). The personal data collected on this website is stored on the host's servers. This primarily includes IP addresses, metadata and communication data, website access data and other data generated via a website.

We use our host for the purpose of the secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR). To ensure processing in compliance with data protection law, we have concluded a data processing agreement (DPA) with our host in accordance with Art. 28 GDPR.

14. Contact by email and telephone

If you send us enquiries by email or telephone, the information you provide, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions.

This data is processed on the basis of Art. 6 (1) (b) GDPR if your enquiry relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR), if this has been requested. The data you send us by email or telephone remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions – in particular tax retention periods – remain unaffected.

15. Audience measurement with Matomo (without cookies)

To design our website according to our visitors' needs, we evaluate its use statistically. For this we use the open-source software Matomo, which we operate ourselves on our server at our web host. No data is transferred to third parties – in particular not to analytics or advertising providers.

Only the following is recorded: the page visited and its title, the page from which you came to us (referrer), the date and time of the visit, the browser type and operating system in general form, and clicks on email and telephone links, downloads (e.g. product brochures) and links to external websites. Your IP address is shortened by two bytes before it is stored (e.g. 192.168.xxx.xxx) so that it can no longer be attributed to you. No cookies are set, no characteristics of your device (such as screen resolution or plugins) are read, and no profiles across devices or sessions are created.

The legal basis is our legitimate interest in the statistical analysis and improvement of our website (Art. 6(1)(f) GDPR). Raw data is deleted after six months at the latest; after that, only aggregated statistics without personal reference remain. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, no measurement takes place.

You can object to the measurement at any time (Art. 21 GDPR). Your objection is stored in your browser and applies until you delete your browser data.