Privacy Policy

When we obtain consent from the data subject for processing personal data, the legal basis is Article 6(1)(a) of the EU General Data Protection Regulation (GDPR).

If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR.

Where processing is necessary for compliance with a legal obligation to which our company is subject, the legal basis is Article 6(1)(c) GDPR.

If processing is necessary to protect the vital interests of the data subject or another natural person, the legal basis is Article 6(1)(d) GDPR.

If processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, the legal basis is Article 6(1)(f) GDPR.

Personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also occur if provided for by European or national legislation in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless further storage is necessary for the conclusion or fulfillment of a contract.

Description and Scope of Data Processing
Each time our website is accessed, our system automatically collects data and information from the accessing computer system.

The following data is collected:

• Information about the browser type and version used
• The user’s operating system
• The user’s Internet service provider
• The user’s IP address
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system via our website

The legal basis for the temporary storage of data and log files is Article 6(1)(f) GDPR.

Temporary storage of the IP address by the system is necessary to deliver the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

Storage in log files is carried out to ensure the functionality of the website. Additionally, the data serves to optimize the website and ensure the security of our information technology systems. No analysis of the data for marketing purposes is conducted in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) GDPR.

Data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collection for website provision, this occurs when the respective session ends.

In the case of data storage in log files, this occurs after no more than seven days. Storage beyond this period is possible. In such cases, users’ IP addresses are deleted or anonymized so that assignment to the accessing client is no longer possible.

The collection of data for website provision and the storage of data in log files are essential for the operation of the website. Therefore, the user has no right to object.

Description and Scope of Data Processing

We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. We also use cookies on our website that enable an analysis of users’ browsing behavior. The following data can be transmitted in this way:

• Entered search terms
• Frequency of page views

b) Legal Basis for Data Processing
The legal basis for processing personal data using cookies is Article 6(1)(f) GDPR.

c) Purpose of Data Processing
The use of analysis cookies serves to improve the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus continuously optimize our offer.

These purposes also constitute our legitimate interest in processing personal data pursuant to Article 6(1)(f) GDPR.

d) Duration of Storage, Right to Object and Removal
Cookies are stored on the user’s computer and transmitted to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may not be possible to use all functions of the website to their full extent.

Description and Scope of Data Processing

Our website includes a contact form that can be used for electronic communication. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored. These data are:

• Name
• Email address

At the time the message is sent, the following data is also stored:

• The user’s IP address
• Date and time of registration

Consent is obtained from the user before data is submitted, and reference is made to this privacy policy.

Alternatively, users may contact us via the email address provided. In that case, the personal data transmitted in the email will also be stored. This data is not shared with third parties and is used exclusively to process the correspondence.

If the user provides consent, the legal basis for processing is Article 6(1)(a) GDPR.

If the contact is initiated via email, the legal basis is Article 6(1)(f) GDPR (legitimate interest). If the email communication aims to enter into a contract, the additional legal basis is Article 6(1)(b) GDPR.

The sole purpose of processing personal data submitted via the contact form is to handle the inquiry. For email communications, our legitimate interest in processing the data also lies in handling the conversation.

Additional data collected during submission helps prevent misuse of the contact form and ensures the security of our IT systems.

We delete personal data as soon as it is no longer needed for the purpose for which it was collected. For data collected via the contact form or sent by email, this means once the respective conversation with the user is clearly concluded.

Any additional personal data collected during the submission process will be deleted after no more than seven days.

Users may revoke their consent to the processing of personal data at any time. If a user contacts us via email, they may object to the storage of their personal data at any time. In such cases, we will not be able to continue the conversation.

All personal data stored in connection with the communication will be deleted in this event.

If we process personal data relating to you, you are considered a “data subject” under the GDPR and are entitled to the following rights with respect to the data controller:

Right of access
You may request confirmation of whether we process your personal data.

If so, you may also request the following information:

(1) The purposes of the processing;

(2) The categories of personal data processed;

(3) The recipients or categories of recipients to whom your data has been or will be disclosed;

(4) The intended retention period or the criteria used to determine this period;

(5) The existence of a right to rectify, erase, or restrict processing, or to object to such processing;

(6) The right to lodge a complaint with a supervisory authority;

(7) The source of the data, if it was not collected directly from you;

(8) Whether automated decision-making, including profiling (as per Article 22(1) and (4) GDPR), is in use and, if so, meaningful information about the logic involved, as well as the significance and intended consequences of such processing.

You also have the right to know whether your personal data has been transferred to a third country or international organization. In such cases, you may request information about the appropriate safeguards in accordance with Article 46 GDPR.

You have the right to request that we correct or complete any inaccurate or incomplete personal data concerning you. We are required to make such corrections without undue delay.

You have the right to request the restriction of processing of your personal data under the following conditions:

(1) You contest the accuracy of your personal data for a period enabling the controller to verify the accuracy of the data;

(2) The processing is unlawful and you oppose the erasure of the data and instead request the restriction of its use;

(3) The controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims; or

(4) You have objected to processing pursuant to Article 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override yours.

Where processing of your personal data has been restricted, such data shall—apart from being stored—only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been imposed under the above conditions, you will be informed by the controller before the restriction is lifted.

Obligation to Erase
You may request the immediate erasure of your personal data, and the controller is obligated to erase this data without undue delay where one of the following grounds applies:

(1) The data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.

(2) You withdraw your consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal ground for the processing.

(3) You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object pursuant to Article 21(2) GDPR.

(4) Your personal data has been unlawfully processed.

(5) The erasure of your data is required to comply with a legal obligation under Union or Member State law to which the controller is subject.

(6) The data has been collected in relation to the offer of information society services pursuant to Article 8(1) GDPR.

If the controller has made your personal data public and is obliged under Article 17(1) GDPR to erase it, the controller shall take reasonable steps, including technical measures—considering available technology and implementation costs—to inform other data controllers processing the personal data that you have requested the erasure of any links to, or copies or replications of, such personal data.

The right to erasure does not apply to the extent that processing is necessary:

(1) For exercising the right of freedom of expression and information;

(2) For compliance with a legal obligation that requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) For reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR;

(4) For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) GDPR, insofar as the right referred to under Section 18 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(5) For the establishment, exercise, or defense of legal claims.

If you have exercised your right to rectification, erasure, or restriction of processing, the controller is obligated to notify all recipients to whom your personal data has been disclosed of such rectification, erasure, or restriction—unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about these recipients.

You have the right to receive the personal data concerning you that you have provided to a controller in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the original controller, where:

(1) The processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR; and

(2) The processing is carried out by automated means.

In exercising this right, you may also have the personal data transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data which is based on Article 6(1)(e) or (f) GDPR; this includes profiling based on those provisions.

The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent it is related to direct marketing.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

You may exercise your right to object through automated means using technical specifications in the context of the use of information society services, notwithstanding Directive 2002/58/EC.

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.

You have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

(1) Is necessary for entering into, or performance of, a contract between you and the controller;

(2) Is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

(3) Is based on your explicit consent.

These decisions may not be based on special categories of personal data referred to in Article 9(1) GDPR unless Article 9(2)(a) or (g) GDPR applies and suitable measures to protect your rights and freedoms and legitimate interests are in place.

In the cases referred to in (1) and (3), the controller must implement appropriate measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention, to express your point of view, and to contest the decision.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement—if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

Google Analytics
If you have given your consent, this website uses Google Analytics, a web analytics service provided by Google LLC. The responsible service provider within the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Scope of Processing
Google Analytics uses cookies that enable an analysis of your use of our website. The information generated by the cookies about your use of this website is generally transmitted to a Google server in the United States and stored there.

We use the “anonymizeIP” function (so-called IP masking): Due to the activation of IP anonymization on this website, your IP address is truncated by Google within Member States of the European Union or in other states party to the Agreement on the European Economic Area before transmission. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data.

During your visit to our website, the following data may be collected:

• Pages you visit and your click path
• Goal completions on the website (conversions, e.g., newsletter sign-ups, downloads, purchases)
• Your user behavior (e.g., clicks, duration of stay, bounce rate)
• Your approximate location (region)
• Your IP address (in truncated form)
• Technical information about your browser and the devices you use (e.g., language settings, screen resolution)
• Your internet service provider
• The referrer URL (the website or advertising medium through which you accessed this website)

Purpose of Processing
On behalf of the operator of this website, Google will use this information to evaluate your pseudonymous use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website [OPTIONAL] and the success of our marketing campaigns.

Recipient
The recipient of the data is:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,

which acts as a processor. We have concluded a data processing agreement with Google for this purpose.
Google LLC, based in California, USA, and potentially U.S. authorities may access data stored by Google.

Transfer to Third-Party Countries
A transfer of data to the USA cannot be ruled out.

Storage Duration
The data we send and link with cookies is automatically deleted after 14 months. Data that has reached the end of its retention period is deleted automatically once a month.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by: 

a. not giving your consent to the use of cookies, or
b. downloading and installing the browser add-on to deactivate Google Analytics available HERE [DEDICATED LINK: https://tools.google.com/dlpage/gaoptout?hl=en].

You can also prevent the storage of cookies by adjusting your browser settings accordingly. However, please note that if you configure your browser to reject all cookies, some functionality of this and other websites may be limited.

Legal Basis and Withdrawal Option
The legal basis for this data processing is your consent in accordance with Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by accessing and changing your cookie settings.

For more information on the terms of use of Google Analytics and data protection at Google, please visit:
https://marketingplatform.google.com/about/analytics/terms/us/ and https://policies.google.com/?hl=en.

You have the option to subscribe to our newsletter via our website, i.e., to receive emails from us. The specific content of the newsletter depends on the description provided during the registration process (e.g., special offers, products, and events). Additionally, our newsletters contain information about our services and our company.

To register, it is generally sufficient to provide your email address. This email address is used exclusively to send you the subscribed newsletter. After registration, a confirmation email will be sent to the provided address, asking you to confirm your subscription. This double-opt-in procedure ensures that no one can subscribe with someone else’s email address. To document compliance with legal requirements, we log all newsletter registrations. This includes the storage of the registration and confirmation timestamps, as well as the IP address used.

The newsletter is sent based on the recipients’ consent, which can be withdrawn at any time (Article 6(1)(a) GDPR). If such consent is not legally required, the newsletter may be sent on the basis of our legitimate interest in direct marketing (Article 6(1)(f) GDPR), where permitted by law (e.g., to existing customers). The logging of the registration process is based on our legitimate interests in verifying proper and lawful registration (Article 6(1)(f) GDPR). If we engage a service provider for email delivery, this is done based on our legitimate interest in a secure and efficient mailing system (Article 6(1)(f) GDPR).

Please Note:
Our newsletters may contain a “web beacon” (also known as a tracking pixel), a tiny image file retrieved from our server or that of our email delivery service when the newsletter is opened. This retrieval collects technical information such as your browser type, system information, IP address, and the time of access. This data is used to improve the technical performance of our newsletter and to tailor content to audience interests based on access location (determined via IP address) and access times.

Additionally, we analyze whether newsletters are opened, when they are opened, and which links are clicked. Although technically this information could be linked to individual email addresses, neither we nor our service provider will do so. The evaluation is carried out solely to adapt our content to the reading habits of our users. This analysis is conducted, subject to explicit user consent, based on our legitimate interest in operating a user-friendly and secure newsletter system that serves our business goals and meets user expectations.

You may unsubscribe from our newsletter at any time by emailing us at newsletter@entzmann.de/en or by clicking the unsubscribe link included at the end of every newsletter email.

Our company maintains online presences on various social media platforms to communicate with active users and to provide information about PackPart. Data processing in this context is based on our legitimate interest in effective communication and user engagement, pursuant to Article 6(1)(f) GDPR. If the respective social media platforms require user consent (e.g., by checking a box), data processing is based on that consent in accordance with Article 6(1)(a) GDPR.

Where we have technical means to influence data processing on these platforms, we make use of such capabilities in accordance with the data minimization principle under Article 5(1)(c) GDPR. Please note, however, that your use of these platforms is subject to the respective platforms’ own terms of service and privacy policies. This means that your data may also be processed outside the European Union, where the enforcement of your data protection rights may be more difficult.

Moreover, data collected via your use of these platforms may be used for market research and advertising purposes. This typically includes the creation of usage profiles based on your behavior and interests. These profiles are stored using cookies and may be used to serve targeted ads—both within and outside the social media platforms—that are presumed to match your interests (online marketing). If you are also a member of a social network and logged into your account, the data can be linked across devices and sessions.

For information about specific types of data processing and how to opt out (where possible), please refer to the privacy policies of the respective platform providers. Since only the platform providers have access to the data collected on their platforms, any requests for information or to exercise your rights as a data subject should be directed to them. If you require assistance, we are happy to support you in this process.

Platforms and Service Providers Used

LinkedIn
Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Website: https://www.linkedin.com
Privacy Policy: https://www.linkedin.com/legal/privacy-policy
Opt-out options: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Xing
Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany
Website: https://www.xing.de
Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung

Google My Business
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Website: https://www.google.com/intl/de_de/business/
Privacy Policy: https://policies.google.com/privacy