Privacy Notice regarding Visits to our Website pursuant to Articles 13, 14, and 21 of the EU General Data Protection Regulation (GDPR)

U.I. LAPP GmbH, Schulze-Delitzsch-Straße 25, 70565 Stuttgart, Germany, phone: +49 (0)711 78 38 – 01, email: info(at)lappkabel.de (hereinafter referred to as "LAPP", "we", "us", "our" etc.) has drafted this Privacy Notice to inform you about the ways in which we process any personal data during your visit to our website, in communication with us, as well as during your use of online offers.

We have appointed TERCENUM AG, Georgenstrasse 22, 10117 Berlin, Germany, phone: +49 (0)30 983 21 75  – 0, email: datenschutz(at)tercenum.de as our data protection officer.

1. What personal data do we always collect from you?

1.1 When visiting our website

If you do not register or provide us with any other information, we only collect the personal data that your browser transmits to our server (so-called log files). If you wish to view our website, we collect the following data, which is technically necessary for us to display our website, to establish a connection, and to guarantee system stability and security:

• the IP address of the computer/device with which you access the Internet;
• the date and time of the request;
• time zone difference to Greenwich Mean Time (GMT);
• the website/application from which the request comes;
• the access status/HTTP status code;
• respectively transferred data volumes;
• the browser used;
• the operating system used together with its user interface;
• language and version of the browser software;

This is necessary for us to display our website and to guarantee stability and security. This is in our legitimate interest within the meaning of Article 6 (1) (f) GDPR.

During contract processing, the aforementioned data is stored on the servers of Lapp Service GmbH, Oskar-Lapp-Str. 2, 70565 Stuttgart, Germany. The servers are located in Germany.

Data is stored until the end of the following year and then erased automatically.

Collection of such data for the provision of the website and storage of data in log files is strictly necessary for proper operation of the Internet website. As a result, the user does not have the option to object.

1.2 Conferințe telefonice și video, precum și comunicarea prin „Microsoft Teams”

Utilizăm Microsoft Teams ca instrument pentru a organiza conferințe telefonice și/sau video și pentru a accepta apeluri la numerele de telefon care v-au fost comunicate (denumite în continuare colectiv „Întâlniri online”). Furnizorul de servicii este Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Irlanda, care prelucrează datele în numele nostru în sensul articolului 28 din RGPD.

Vă rugăm să rețineți că această Notificare privind confidențialitatea vă informează doar cu privire la prelucrarea datelor dvs. cu caracter personal de către noi, în cazul în care participați la Întâlniri online cu noi. Dacă accesați site-ul web al Microsoft Teams, furnizorul Microsoft Teams este responsabil pentru prelucrarea datelor. Dacă doriți să primiți informații despre prelucrarea datelor dvs. cu caracter personal de către Microsoft, vă rugăm să accesați declarația relevantă a Microsoft.

La utilizarea Microsoft Teams sunt prelucrate diverse tipuri de date. Sfera acestor date depinde, printre altele, de opțiunile dvs. privind datele înainte și în timpul participării la o întâlnire online.

Sunt prelucrate următoarele date cu caracter personal:

adresa IP a computerului/dispozitivului cu care accesați internetul;

informații despre dvs. ca utilizator: de exemplu, numele afișat, eventual adresa de e-mail, fotografia de profil (opțional), limba preferată;

metadate ale întâlnirii: de exemplu, data, ora, ID-ul întâlnirii, numerele de telefon, locația;

date text, audio și video: este posibil să aveți opțiunea de a utiliza funcția de chat într-o întâlnire online. În acest sens, orice intrări de text pe care le faceți sunt prelucrate pentru a fi afișate în cadrul întâlnirii online. Pentru a vă asigura că se poate accesa video și audio, datele microfonului și ale oricărei camere video ale dispozitivului dvs. sunt prelucrate în consecință pe durata întâlnirii. Aveți întotdeauna opțiunea de a dezactiva sau de a opri microfonul prin setările relevante din aplicațiile Microsoft Teams.

Temeiul juridic pentru prelucrarea datelor atunci când se organizează întâlniri online este articolul 6 alineatul (1) litera (b) din RGPD, în măsura în care respectivele întâlniri au fost desfășurate în contextul unei relații contractuale.

Dacă prelucrarea datelor cu caracter personal este o condiție esențială pentru utilizarea Microsoft Teams, temeiul juridic pentru prelucrarea datelor cu caracter personal ale utilizatorilor este articolul 6 alineatul (1) litera (f) din RGPD. Interesul nostru legitim este, în acest caz, desfășurarea eficientă a întâlnirilor online.

Dacă nu există o relație contractuală, temeiul juridic rămâne articolul 6 alineatul (1) litera (f) din RGPD. Interesul nostru legitim este, din nou, desfășurarea eficientă a întâlnirilor online.

Ca principiu general, datele cu caracter personal prelucrate ca urmare a participării la întâlniri online nu sunt transmise către terți, cu excepția cazului în care o astfel de distribuire este intenționată. Vă rugăm să rețineți că conținutul atât al întâlnirilor online, cât și al întâlnirilor față în față este adesea utilizat pentru a comunica informații clienților, părților interesate și terților, iar distribuirea acestor informații este, prin urmare, intenționată.

Dacă este necesar, furnizorul Microsoft Teams ia cunoștință de datele menționate mai sus, dacă acest lucru este prevăzut în cadrul acordului de prelucrare dintre noi și Microsoft Teams.

Prelucrarea datelor nu se efectuează, în general, în afara Uniunii Europene (UE), deoarece ne-am limitat locațiile de stocare la centrele de date din Uniunea Europeană. Cu toate acestea, nu putem garanta că datele nu sunt transmise prin servere de internet situate în afara UE. Un exemplu concret de astfel de redirecționare este atunci când participanții iau parte la întâlniri online într-un stat care nu este membru al UE.

Cu toate acestea, în timpul transportului prin Internet, datele sunt criptate, fiind protejate împotriva accesului neautorizat al terților.

2. What personal data do we possibly collect on a case-by-case basis?

In addition to phone and video conferences as well as calls via "Microsoft Teams", together with the use of our website for purely informative purposes, we also offer various services that you can use if you are interested. To use these services, you generally have to give us any other personal data which we need to provide the relevant service.

We may make use of service providers (processors) with which we, under observance of the legal requirements, have concluded an agreement on processing pursuant to Article 28 GDPR, i.e. subject to our instructions and under our control. These are companies in the following fields in particular: IT service providers, logistics, telecommunications, sales and marketing, and legal and tax consulting, about which we will inform you accordingly on a case-by-case basis. We remain responsible for processing in these instances; the distribution and processing of personal data by/to our processors takes place on the respective legal basis to which we are entitled when processing the data. No separate legal basis is required.

We additionally transmit personal data to recipients which fall outside of the immediate jurisdiction the GDPR ("third countries"). If the European Commission has not decided that these countries provide your personal data a sufficient level of statutory protection, we must either ensure that we implement adequate safeguards for your personal data or that one of the legal exceptions applies.

As safeguards pursuant to Article 46 (2) (c) GDPR, we regularly use the standard contractual clauses approved by the European Commission if a recipient is situated in a third country not deemed safe. Nevertheless, in some countries there is a risk that your data may be requested by national authorities for control and monitoring purposes, possibly without the conditions thereof being clearly regulated and without any corresponding legal remedies. If there are such risks and rulings of European courts that consider these risks unreasonable (in some situations this is the case in the USA, for example), we will take additional protective measures and make agreements whenever feasible.

In some instances, we will obtain your express consent for data transmissions to recipients in unsafe third countries pursuant to Article 49 (1) (a) GDPR. This is the case, for example, whenever our partners use cookies or comparable technologies on our website. If you give your consent, you accept that the risks described above, in particular the risk of foreign authorities accessing your data, are incurred, without any further relevant safeguards being agreed or additional protective measures taken.

On this basis, we would like to inform you of the following data processing activities when making use of our separate optional services:

2.1 Customer account and performance of contract

We process the personal data submitted by you when opening a customer account and/or to perform a contract. This data includes:

• title;
• first name;
• surname;
• (email) address;
• phone and fax number;
• company name;
• customer number;
• role;
• department;
• VAT identification number.

In this respect, our identification system is used for unambiguous personal identification and helps all customers to log in securely. We also collect the LAPP ID – consisting of an email address and password – when registering for our online shop and also assign your inquiries and your user behaviour to it, particularly when and how often you log into the online shop, whether you register for any webinars, when submitting questions via the chat, or when you are configuring cables via the configurator. In addition to managing customer identity and profile data, the standardised login also serves to protect customer information against attacks.

We use the Auth0 Single-Sign-On authentication service to allow log ins to our website. The service provider is the American company Auth0 Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA. Auth0 processes data in the USA, among other countries. We would like to point out that, according to the European Court of Justice, there is currently no adequate level of protection when transmitting data to the USA. This can result in a range of risks for the legality and safety of data processing. We use the standard contractual clauses approved by the EU Commission in accordance with Article 46 (2) and (3) GDPR as the basis for data processing for recipients based in third countries (in particular the USA) or data transfers to such countries. These safeguards commit Auth0 to comply with the EU level of data protection when processing relevant data, also outside of the EU. These safeguards are based on an implementation decision of the European Commission.

Upon full execution of the contract or erasure of your customer account, your data will be blocked for the relevant tax and commercial retention periods, and erased thereafter, unless you have expressly consented to the continued use of your data or unless we have reserved continued usage of the data on a legally permissible basis.

We store and use the data communicated by you to perform the contract. The legal basis for the use of the login data is Article 6 (1) (b) GDPR insofar as the initiation, conclusion, and performance of the contract is concerned, and Article 6 (1) (f) GDPR to the extent that you are an employee of our customer and we have a legitimate interest through the conclusion of the contract). The legal basis for making optimal adjustments to the website is Article 6 (1) (f) GDPR; our legitimate interest here is based on the optimisation and personalisation of our (online shop) offers.

2.2 Contact forms and contact via email

Contact forms can be used on our website in a range of ways in which you can contact us electronically regarding the following, among other things:

• initial contact;
• product details (EPLAN, AUCOTEC, special cables, or similar);
• product enquiries (ETHERLINE, Skintop, Train, or similar);
• configuration/configurator enquiries;
• requests for electronic invoicing;
• submitting complaints;
• trade fair registrations;
• registrations for consultation appointments.
• (This list is not exhaustive and will be continuously expanded to make sure we offer you the best way to get in touch with us)

If you take advantage of one or more of these options, the data entered by you in the input form is transmitted to us and stored. Depending on the input field, this data might include:

• title;
• first name;
• surname;
• (email) address;
• phone and fax number;
• company name;
• customer number;
• department.
• subject;
• message.

Additionally, at the moment of submitting your message, the following data is collected:

• IP address;
• date and time.

Alternatively, you can contact us using one of the email addresses provided or over the phone. In this case, the personal data transmitted by you via email is stored.

When contacting us, we will process the data provided by you for the purpose of processing your enquiry. Additionally and in particular, we process the email address communicated by you to analyse the performance of the contact form you have used. With these processing activities, your personal data will not be passed on to third parties.

The legal basis for processing your data when using our contact forms is your consent pursuant to Article 6 (1) (a) GDPR. If you contact us by sending an email, the legal basis for processing your personal data is Article 6 (1) (f) GDPR. If you contact us via email with the intention to conclude a contract, the additional legal basis for the processing is Article 6 (1) (b) GDPR. We process the personal data from the input fields solely for the purpose of processing the relevant enquiry. In the event of contact by email, this also includes the necessary legitimate interest in the processing of the data. The other personal data processed as you send your message is exclusively used to prevent misuse of the contact form and to safeguard the security of our information technology (IT) systems.

Once the data is no longer required for the collection purpose(s), it is erased. This is also the case for the personal data from the input field/contact form and for data sent by you via email, once the respective conversation has ended. The conversation ends when it can be concluded from the circumstances that the matter in question has definitively been clarified. The personal data that is additionally collected at the moment of sending the message will be erased after a period of seven days at the latest.

2.3 Direct marketing

2.3.1 Subscribing to our email newsletter

If you subscribe to our email newsletter, we regularly contact you with information about our offers. The only mandatory information (marked with an asterisk) for us to send you the newsletter is your email address. The provision of any additional, separately marked data is voluntary and is used to address you personally. This data includes:

• title;
• first name;
• surname;
• email address;
• company name;
• customer number;
• role;
• department.

Additionally, at the moment of submitting your message, the following data is collected:

• IP address;
• date and time.

The personal data collected by us when subscribing to our newsletter is exclusively used to establish contact for marketing purposes in the form of our newsletter. In addition, you as a newsletter subscriber will be notified by email in all instances in which this is necessary for the operation of the newsletter service, as could be the case in the event of changes to the newsletter offer or changes in technical circumstances.

We use the double opt-in procedure for sending the newsletter. This means that we will not send you an email newsletter until you have expressly confirmed your consent to receiving our newsletter. We do so by means of a confirmation email, prompting you to reconfirm your intent to receive the newsletter in future by clicking a link.

Through your interaction with the confirmation link, you grant us your consent for using your personal data pursuant to Article 6 (1) (a) GDPR. Pursuant to Article 6 (1) (f) GDPR, to be able to retroactively trace any possible misuse of your email address at a later date, we also have a legitimate interest in storing the data collected at the time you sent your message.

You can unsubscribe from our newsletter at any time using the relevant link included in the newsletter or by notifying the controller named at the beginning. After unsubscribing, your email address will without undue delay be erased from our newsletter distribution list, unless you have expressly consented to continued use of your data or if we reserve the right to use your personal data for any other purpose permitted under the law, and about which we inform you accordingly in this statement.

2.3.2 Electronic marketing to existing customers

If you, when purchasing goods and/or services, provided us with your email address, we reserve the right to regularly send you offers via email for goods and/or services from our range similar to those previously purchased by you. Pursuant to Article 7 (3) of the German Act against Unfair Competition [Gesetz gegen den unlauteren Wettbewerb, UWG], this does not require your separate consent. The data are as such solely processed on the legal basis of our legitimate interest in personalised direct marketing pursuant to Article 6 (1) (f) GDPR. If you have initially objected to the use of your email address for this purpose, we will not send you any emails. You are entitled to, at any time and with effect from the future, object to the use of your email address for the aforementioned marketing purpose, by notifying the controller named at the beginning. The only charges you will incur in this regard are the base rate charges for transmitting the message. After receiving your objection, we will immediately stop using your email address for marketing purposes.

2.3.3 Newsletters sent through Inxmail

We use email marketing software to send our newsletter. This software can organise and analyse distribution. The service provider is Inxmail GmbH, Wentzingerstr. 17, 79106 Freiburg, Germany. The data you enter for the purpose of receiving the newsletter is processed on Inxmail servers. By sending our newsletter with Inxmail, we can track whether a newsletter was opened, if any links were clicked, and if so which ones. This takes place on an anonymised basis (anonymous link tracking). Inxmail furthermore allows us to categorise newsletter recipients (co-called tagging). Newsletter recipients can be categorised, e.g. by gender.

Furthermore, we offer the personalised ''Profile management" website, which can be accessed through the Inxmail newsletter tool by clicking the corresponding link. In this link, encrypted information about the recipient is stored in the form of so-called online parameters. All data stored in Inxmail (for marketing purposes) about this recipient is displayed. If you click the link, these parameters are transferred to customise the website. This ensures that only you as a registered newsletter recipient can confirm a logout, submit information about a survey, or provide information about a profile.

Your data is processed pursuant to Article 6 (1) (f) GDPR and serves our legitimate interest in using an effective (in terms of marketing), secure, and user-friendly newsletter system.

2.3.4 Marketing through the post

On the basis of our legitimate interest in personalised direct marketing, we reserve the right to store your first name and surname, your (email) address and any data received from you in relation to the contractual relationship, pursuant to Article 6 (1) (f) GDPR, and use said data to send you interesting offers and information about our products through the post.

You are entitled to, at any time and with effect from the future, object to the storage and use of your data for this purpose, or your email address for the aforementioned marketing purpose, by notifying the controller named at the beginning.

2.4 Webinars

Every now and then, we offer you the option of registering for different webinars on various current topics via our website. Webinars are video seminars run with computer support. We use the Conference Manager tool from Conference Manager GmbH, Türkenstr. 7, 80333, Munich, Germany, to offer webinars over the Internet; this provider processes the data on our behalf pursuant to Art. 28 GDPR.

The following mandatory data is requested when registering:

• title;
• first name;
• surname;
• company name;
• email address;
• country.

To register for a webinar, enter this data on the landing page via the link on our website. If you take part in a webinar, we will receive information from the webinar service provider, along with your registration details, about the duration of participation, interest in the webinar, questions asked or answers given to them for the purpose of further customer support or for improving the webinars.

The webinar is carried out via an encrypted connection between you and Conference Manager. The audio or image information transmitted is only recorded by us if expressly communicated before the start of the webinar. If you ask questions in the webinar, these questions will also be recorded and reproduced when you call up the webinar at a later date. If you want to avoid this recording, please submit your questions via email afterwards. Conference Manager processes anonymised statistical data during and after the webinar. You are not permitted to create any recordings or screenshots of the webinar.

The personal data that you provide to us with your registration will, on the legal basis provided by Art. 6 (1) (b) GDPR, only be used to process your registration, conduct the webinar, and for communication in the period leading up to and the period after your participation in the webinar.

2.5 Configurators

Our website has the following configurators:

• Cable finder
• Cable assembly finder
• Cable gland finder
• Cable protection finder
• Cable marking finder
• Connector finder
• Housing configurator
• Servo configurator
• Chain configurator
• Fibre optic cable configurator

These can only be used after creating/registering for a customer account as described in 2.1, with the corresponding LAPP ID, or by using one of the individual contact forms described in 2.2. We exclusively use the data specified here to create, dispatch, and negotiate the requested offer.

We forward the data that you enter in the context of the configurators to the LAPP company of the relevant country specified by you. You can see which country this is by clicking the following link:https://www.lappgroup.com/de.html

The data provided by you in the context of the chain configurator is also passed on to our service provider SOTEHA srl a Socio Unico, with registered office at Via Ticino, 6, 20095 Cusano Milanino (MI, Italy) and the following address: Via Zucchi, 39/C, 20095 Cusano Milanino (MI, Italy). Our service provider’s servers are located in the EU (Data Centre Verizon Business, Pero (MI), Italy). In the context of the LWL Lichtwellenleiteibrer / FO Fiber Optic configurator, the service provider that receives any data is: Encoway GmbH, Buschhöhe 2, 28357 Bremen, Germany

Data is stored only to the extent necessary to fulfil the purpose of preparing a personal offer for you on the basis of the data provided, and negotiating this offer. Once the data is no longer required, it is erased. We also only store the data if this is necessary under commercial and tax law. The legal basis for processing the data is Article 6 (1) (b) GDPR for aspects relating to the preparation of the possible contract; otherwise, Article 6 (1) (f) GDPR applies with regard to answering other enquiries.

We sometimes use cookies when you use a configurator; refer to Section 5 for exhaustive information on our use of cookies.

2.6 Userlike

If you contact us via the chat on the website, you do so using the Userlike software, which is live chat software from our processor Userlike UG (limited liability), Probsteigasse 44-46, 50670, Cologne, Germany, which is bound by instruction.

Data is processed on the basis of Article 6 (1) (b) GDPR. The purposes of the processing include enabling the use of our specific products and services within the framework of our online offers.

In this context, we would like to point out that the data that you voluntarily provide us with via the chat will be stored for the purposes of processing your enquiry and for statistical purposes. Only the chat log and associated IP address are stored. The data contained herein is not used to personally identify visitors to this website, nor for other purposes, particularly for marketing purposes. The chat log is erased after one year.

Userlike uses, among other technologies, cookies in this regard; refer to Section 5. for more information.

3. Data transmissions to third parties acting on their own behalf

In some cases, we also transfer your data to third parties, i.e. partners, in a cooperation that falls outside of processing on our behalf. Such partners provide their services as independent controllers; the processing of your data by these partners is solely governed by their privacy policies.

3.1. Payment service providers

You can pay on our website using the payment service of EVO Payments International GmbH, Elsa-Brändström-Straße 10, 50668 Cologne, Germany (EVO). EVO processes the transaction. In this context, personal data is also transmitted to EVO, such as bank details or credit card numbers. Said processing is necessary for the verification and processing of the payment order triggered to fulfil the contract you have concluded with us. The legal basis is Article 6 (1) (b) GDPR.

EVO also reserves the right to carry out a credit check. To this end, your payment details may be transmitted to credit agencies, based on the legitimate interest of EVO in determining your creditworthiness, pursuant to Article 6 (1) (f) GDPR. EVO uses the result of the creditworthiness check to determine the statistical probability of default and to then decide whether or not to offer the respective payment method. The credit check may contain probability values (so-called scores). If scores are included in the credit check results, they are based on scientifically accepted, mathematical-statistical methods. Address data are (not exclusively) used to calculate scores. For more information on privacy, including information on any involved credit agencies, please refer to EVO's Privacy Policy under the following link: https://www.evopayments.eu/datenschutz/

You can always object to the processing of your data by sending a message to EVO. Nevertheless, EVO Payments might still be entitled to process your personal data if this is required for the contractual handling of payments.

3.2 Carrying out credit checks

If we make any advance performance (such as delivery on invoice), we reserve the right to carry out a credit check on the basis of mathematical-statistical methods to safeguard our legitimate interest in verifying the solvency of our customers. We will, pursuant to Article 6 (1) (f) GDPR, submit the personal data required for a credit check to the following service providers:

• Creditreform Stuttgart Strahler KG, Theodor Heuss Strasse 2, 70174 Stuttgart, Germany
• Bürgel Wirtschaftsinformationen Vertriebsgesellschaft mbH, Am Wallgraben 100, 70565 Stuttgart, Germany
• Bisnode Deutschland GmbH, Robert-Bosch-Str. 11, 64295 Darmstadt, Germany
• Coface Rating GmbH, Isaac-Fulda-Allee1, 55124 Mainz, Germany

The credit check may contain probability values (so-called scores). If scores are included in the credit check, they are based on a scientifically accepted, mathematical-statistical method. Address data are (not exclusively) used to calculate scores. We use the result of the creditworthiness check to determine the statistical probability of default and to make decisions on the substantiation, performance, or termination of a contractual relationship.
You can always object to this processing of your data by sending a message to the controller or the aforementioned credit agencies. Nevertheless, we might still be entitled to process your personal data if this is required for the contractual handling of payments.

3.3 The use of ratings and seals (Trusted Shops)

In order to display our Trusted Shops seal together with any reviews, and to offer Trusted Shops products to buyers after placing an order, we have integrated the Trusted Shops Trustbadge on our website.

This processing serves to protect our legitimate interest in optimally marketing our offer, deemed overriding after a balancing of interests, pursuant to Article 6 (1) (f) GDPR. The Trustbadge and services it advertises are an offer of Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany. We are joint controllers within the meaning of Article 26 GDPR. In this Privacy Notice, we will now inform you of the material contents of the contract pursuant to 26 (2) GDPR.

The Trustbadge is provided in joint responsibility by a CDN (Content Delivery Network) provider from the US. An adequate level of data protection is maintained through the use of the standard data protection clauses and additional contractual measures. You can find further information on data protection at Trusted Shops GmbH in their Privacy Policy: https://www.trustedshops.de/impressum-datenschutz/

When calling up the Trustbadge, the website automatically stores a so-called server log file, which, for example, might contain your IP address, the date and time of access, transmitted data quantities, and the requesting provider (access data) and therewith documents the request. This access data is not analysed and is automatically overwritten seven days after you stopped visiting the website at the latest.

After finishing an order, your email address, cryptologically hashed using a one-way function, will be transmitted to Trusted Shops GmbH. The legal basis is Article 6 (1) (f) GDPR. This is done to check whether you have already registered for Trusted Shops GmbH's services and is thus required to satisfy our overriding legitimate interest in providing the buyer protection linked to the specific order and transactional evaluations, pursuant to Article 6 (1) (f) GDPR. If so, further processing will be carried out in accordance with the contractual agreement between you and Trusted Shops. If you have not yet registered for the services, you will receive the option of setting up an account. Any further processing after registration is governed by the contractual agreement between you and Trusted Shops GmbH. If you do not register for an account, all transmitted data will be automatically erased by Trusted Shops GmbH and this data can then no longer be linked to a person.

Any additional personal data is only transmitted to Trusted Shops if you have consented thereto, if we are allowed to send you service emails under Article 7 (3) of the German Act against Unfair Competition (cf. Section 2.3.2), if you opt to use Trusted Shops products after completing an order, or if you have already registered for use. In this case, the contractual agreement concluded between you and Trusted Shops shall apply.

Within the framework of the joint responsibility existing between us and Trusted Shops GmbH, we kindly recommend that you first contact Trusted Shops GmbH if you have any questions concerning data protection or to assert any rights using the contact options specified in the privacy policies linked in this section. Regardless of this, you do, however, have free choice in contacting a controller. If necessary, your request will then be forwarded to another controller for processing.

4. Cookies

To design our website in the most user-friendly way possible and to display more relevant advertisements to visitors of our website, we and our partners use so-called cookies. Cookies are small files stored on the device of a user. They can capture information for a certain period and identify the device of the user. This is sometimes also done using tracking pixels, which are not stored on the hard drives of users, but can also help in identifying visitors in a similar way as cookies. In the following, the word cookie covers both cookies in the technical sense as well as tracking pixels and similar technical methods.

4.3 Configurators cookie list

In addition to the cookies listed in Section 4.2, the following cookies are used for the configurators:

Strictly Necessary Cookies

Performance Cookies

5.2 Google Tag Manager

Our website uses Google Tag Manager. The Google Tag Manager service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google).

The Google Tag Manager allows us to integrate various codes and services on our website in an orderly and simplified manner. The Google Tag Manager implements the tags or "triggers" the embedded tags. When a tag is triggered, Google may collect information (including personal data) and process it. In doing so, it cannot be ruled out that Google also transmits the information to a server in a third country.

In particular, the following personal data is processed by the Google Tag Manager:

• Online identifiers (including cookie identifiers).
• IP address

5.3 Google Ads

We have integrated Google Ads on our website. The Google Ads service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Ads is an Internet advertising tool, which allows us to show Ads in both Google search engine results as well as within the Google advertising network. Google Ads allows us to predefine keywords that ensure that Ads are shown in the Google search engine results if you use a search word that is related to the keyword. Within the Google advertising network, the Ads are distributed to topically relevant Internet websites by means of an automatic algorithm, taking into consideration the predefined keywords.

Google uses the collected data and information to create visitor statistics for our website. We, in turn, use these visitor statistics to determine the total number of users mediated to us through Ads advertisements, i.e. to assess the success or failure of the corresponding Ads and thus optimise our Ads in future. Neither LAPP nor other Google Ads customers receive information from Google that can help identify data subjects.

If you still wish to object to Google Ads, you can generally disable it by making the necessary settings at www.google.com/settings/ads

You can find further information on Google AdWords and the Google Privacy Policy at: www.google.com/privacy/ads/

6. Security

Both we and our service providers take the necessary technical and organisational security precautions to protect personal data under our control against both accidental and intentional manipulation, loss, and destruction, as well as against access by unauthorised parties. Our data processes and security measures are continuously improved to keep up with technological advancements.

Personal data that is exchanged between you and us or other involved companies is generally transmitted via encrypted connections that correspond with the state-of-the-art.

Our employees and any commissioned service providers are – of course – bound to confidentiality.

7. Links to other Internet websites

Our website contains links to other Internet websites. We have no influence over operators of these websites complying with data protection regulations, including the GDPR. Even after carefully reviewing the content, we can not assume any liability for external links to third-party content, either. For more information on the data processing procedures on these pages, we kindly ask you to review the data protection information on the respective websites.

8. Your rights

Every natural person whose personal data we process generally (i.e. depending on the circumstances) has the following rights towards us:

• If you have any questions about the ways in which we process your personal data, we would be happy to provide you with information about your personal data we store, free of charge and at any time (Article 15 GDPR, possibly with the restrictions under Sec. 34 German Federal Data Protection Act [Bundesdatenschutzgesetz, BDSG] applying).
• You have the right to rectification of incorrect and completion of incomplete data (Article 16 GDPR).
• You have a right to the blocking/restriction of processing or erasure of any of your personal data that is no longer required or was stored to comply with statutory obligations (Articles 17 and 18 GDPR).
• You have the right to data portability in a structured, commonly used, and machine-readable format, if you have provided us said data based on consent or a contract concluded between us (Article 20 GDPR).
• You have the right to object to the processing of your data for direct marketing purposes at any time (Article 21 (2 and 3) GDPR).
• You have the right to object to the processing of personal data on the basis of a legitimate interest, with us having the opportunity to demonstrate compelling legitimate grounds for the processing (Article 21 (1) GDPR). Please refer to earlier sections of this Privacy Notice to find out when such grounds exist.
• If you have given your consent to data processing, you can withdraw said consent at any time with effect for the future. In other words, the lawfulness of data processing up to the time of withdrawal shall remain unaffected. After withdrawing your consent, you may no longer be able to use our services.

You additionally have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). We do, however, recommend you first direct your complaint to us.

Please submit your request in writing (using the keyword: data protection) or by email, using the contact details specified at the beginning of this Privacy Notice. We reserve the right to verify your identity in order to make sure that unauthorised persons do not gain knowledge of your personal data.

9. Retention obligations

If you no longer use our services and send us an erasure request, we will erase all your personal data, with the exception of some categories of data required for us to fulfil our statutory retention obligations. This data will be erased without undue delay after expiry of said retention periods, without you having to again request erasure.

If retention of your personal data is required, said retention is mandatory for the following purposes and to comply with the following laws:

• To meet retention periods under commercial and tax law, underpinned by the following laws: the German Commercial Code [Handelsgesetzbuch, HGB], the German Fiscal Code [Abgabenordnung, AO], and the German Value-Added Tax Act (Umsatzsteuergesetz, UStG). The statutory retention periods vary between six (6) and ten (10) years.
• To safeguard proper disaster recovery, to carry out IT audits: General Data Protection Regulation (GDPR) and the German Civil Code [Bürgerliches Gesetzbuch, BGB]. The statutory retention periods and obligatory documentation periods are three (3) years.
• Receivables and evidence management: General Data Protection Regulation (GDPR) and the German Civil Code. The statutory retention periods and obligatory documentation periods are three (3) years from the end of the calendar year in which the event to be documented took place.

10. Changes

Occasionally, we need to make changes to the present Privacy Notice. We reserve the right to do so at any time. The updated version of the Privacy Notice will be published here. Whenever you visit us, you should therefore read through this Privacy Notice again.

Version 2.02

Last updated 2 November 2022