Up

Overview

Privacy

We are requested by the General Data Protection Regulation (GDPR) to provide following documents for your reference:

 

Privacy Policy

This Privacy Policy will inform you about the type, extent and purpose of the processing of personal data (hereafter referred to as "data") on our online offer and its related websites, functions and contents and on external online presences, e.g., our social media profiles (hereafter collectively referred to as the "online offer"). For the terms used, e.g., "personal data" or "processing," please see the definitions under Art. 4 of the General Data Protection Regulation (GDPR).

 

Controller:

Johannes Klais Orgelbau GmbH & Co.KG

Kölnstr. 148

53111 Bonn, Germany

Commercial Register/No.: Bonn HRA 806, Bonn HRB 597

Managing Director: Philipp C. A. Klais, Johannes Zurnieden

Telephone Number: +49 (0) 228 98240 0

Email Address: mail@klais.de

 

Data Protection Officer:

For questions about the processing of your personal data by us or on the subject of data protection in general, please contact our data protection officer under datenschutz@klais.de or the above postal address. In case of requested confidentiality, please contact our data protection officer by postal mail marked "Personal / Confidential".

 

 

Type of Data Processed:

  • Inventory data (e.g., names, addresses).
  • Contact data (e.g., email addresses, telephone numbers).
  • Content data (e.g., text entries, photographs, videos).
  • Contract data (e.g., contract object, duration, customer categories).
  • Payment data (e.g., bank details, payment history).

 

Processing of Special Category Data (Art. 9(1) of the General Data Protection Regulation):

 

  • Special categories of data will not be processed.

 

Data Subject Processing Categories:

  • Customers / prospective customers / suppliers.
  • Online contact form users.

Data subjects will hereafter also be collectively referred to as "users."

 

Processing Purpose:

  • Providing contractual services and customer support.
  • Answering inquiries and communicating with users.
  • Security measures.

Valid: 25 May 2018

 

1. Applicable Legal Bases

As required by Art. 13 of the General Data Protection Regulation, we hereby state the legal bases for our data processing. If a legal basis is not stated in this Privacy Policy, the following shall apply: The legal basis for obtaining consent is Art. 6(1) Letter a and Art. 7 of the General Data Protection Regulation. The legal basis for processing to fulfill our services, perform contractual measures and answer inquiries is Art. 6(1) Letter b of the General Data Protection Regulation. The legal basis for processing to fulfill our legal obligations is Art. 6(1) Letter c of the General Data Protection Regulation. The legal basis for processing to safeguard our legitimate interests is Art. 6(1) Letter f of the General Data Protection Regulation. If vital interests of the data subject or of another natural person require personal data to be processed, the legal basis for this will be Art. 6(1) Letter d of the General Data Protection Regulation.

 

2. Privacy Policy Changes and Updates

Please keep yourself  informed about the contents of our Privacy Policy. We adjust our Privacy Policy when required by changes to our data processing. We will notify you if the changes require your participation (e.g., consent) or if other personal notification is required.

 

3. Security Measures

3.1. As required by Art. 32 of the General Data Protection Regulation, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the respective risk and that take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons; these measures especially include ensuring the confidentiality, integrity and availability of data by monitoring physical access to the data and according access, entries and transfers and ensuring the availability and separation of the data. Furthermore, we established a process that ensures the safeguarding of data subjects' rights, the deletion of data and appropriate responses to data threats. In addition, we consider the protection of personal data already when developing or selecting hardware, software and processes according the principle of data protection by providing technical design and data protection-friendly default settings (Art. 25 of the General Data Protection Regulation).

 

4. Cooperation with Contracted Processors and Third Parties

4.1. If we disclose, transmit or otherwise provide access to data to other persons and companies (contracted processors or third parties) as part of our processing, we will only do so if required or permitted by law (e.g., if data must be provided to third parties, such as payment service providers for contract fulfillment in accordance with Art. 6(1) Letter b of the General Data Protection Regulation), with your consent or on the basis of our legitimate interests (e.g., when using the services of other commissioned parties, web hosts, etc.).

4.2. If we commission third parties to process data on the basis of a so-called "processing contract," this will be done on the basis of Art. 28 of the General Data Protection Regulation.

 

5. Transfers to Third Countries

If we process data in a third country (i.e., outside of the European Union (EU) or the European Economic Area (EEA)) or if this is done when we utilize third-party services or disclose or transmit data to third parties, we will only have data processed in a third country if required for the fulfillment of our (pre-) contractual obligations, due to legal obligations or on the basis of our legitimate interests, based on  your consent. Conditional on legal or contractual permission, we will only process data or have data processed in a third country if the special requirements of Art. 44 et seq. of the General Data Protection Regulation are met. This means that processing will be performed, e.g., on the basis of special guarantees, such as an officially recognized level of data protection as required by the EU (e.g., through "Privacy Shield" for the US) or adherence to officially recognized special contractual obligations (so-called "standard contractual clauses").

 

6. Data Subject Rights

6.1. Under Art. 15 of the General Data Protection Regulation, you have the right to demand confirmation about whether your data is processed and the right to information about this data and to additional information about and copies of the data.

6.2. Under Art. 16 of the General Data Protection Regulation, you have the right to completion and correction of your data in case of inaccuracies.

6.3. Under Art. 17 of the General Data Protection Regulation, you have the right to erasure of your data and, alternatively, under Art. 18 of the General Data Protection Regulation, you have the right to restriction of the processing of your data.

6.4. Under Art. 20 of the General Data Protection Regulation, you have the right to receive the data you provided to us and the right to have your data transmitted to other controllers.

6.5. Under Art. 77 of the General Data Protection Regulation, you have the right to submit complaints to competent data protection supervisory authorities.

 

7. Revocation Rights

Under Art. 7(3) of the General Data Protection Regulation, you have the right to revoke any granted consent with future effect.

 

8. Right to Object

Under Art. 21 of the General Data Protection Regulation, you may object to future processing of your data at any time. Objections may especially be submitted for the processing of data for direct marketing purposes.

 

9. Cookies

We only use technical cookies required for website operation. Since such cookies do not collect or save user-related data, they do not have to be declared.

 

10. Data Deletion

10.1. Any data we process will be deleted or its processing will be restricted in accordance with Art. 17 & Art. 18 of the General Data Protection Regulation. Unless expressly stated otherwise by this Privacy Policy, any data we save will be deleted once it is no longer required for its intended purpose and if its deletion is not prevented by legal storage requirements. If the data is not deleted because it is needed for other and legally permitted purposes, its processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies to data that must be saved, e.g., for commercial or tax law purposes.

10.2. In accordance with legal requirements, we will especially save data for 6 years as required by Section 257(1) of the German Commercial Code [Handelsgesetzbuch, HGB] (trading books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting records, etc.) and for 10 years as required by Section 147(1) of the German Fiscal Code [Abgabenordnung, AO] (books, records, status reports, booking documents, commercial and business letters, documents relevant for taxation, etc.).

 

11. Contacting Us

11.1. When contacting us (via contact form or email), the information you provide will be processed to handle and answer your inquiry in accordance with Art. 6(1) Letter b of the General Data Protection Regulation.

11.2. Information provided by our users may be saved in our customer relationship management system ("CRM System") or by a comparable request organization.

11.3. We will delete inquiries once they are no longer needed. We review their necessity every two years; we permanently save inquiries by customers who have a customer account and refer to the customer account deletion notices. In case of legal archiving obligations, inquiries will be deleted once the required archiving periods expire (when storage obligations under commercial law (6 years) and tax law (10 years) end).

 

 

12. Access Data and Log File Collection

12.1. On the basis of our legitimate interests in the sense of Art. 6(1) Letter f of the General Data Protection Regulation, we collect data about any access to servers which contain this service (so-called server log files). This access data includes the name of the retrieved website and the file, time and date of retrieval, amount of data transferred, successful retrieval report, browser type and version, operating system of the user, referrer URL (last visited page), IP address and the requesting provider.

12.2. For security reasons (e.g., to investigate abuse or fraud), log file information will be saved for up to seven days after which it will be deleted. Data which must be saved as evidence is excluded from deletion until the investigation of the respective incident is completed.

 

13.       Social Media Online Presence

We do not maintain online presences on social networks and platforms.The facebook presence "Johannes Klais Orgelbau" is an inofficial presence. It is not linked to the company "Johannes Klais Orgelbau GmbH & CO.KG" or to any person related to this company.

 

14. Inclusion of Third-Party Services and Contents

14.1. On the basis of our legitimate interests (i.e., interests in the analysis, optimization and economic operation of our online offer in the sense of Art. 6(1) Letter f of the General Data Protection Regulation), we use content and service offers of third parties on our online offer to feature third-party contents and services, e.g., videos or fonts (hereafter collectively referred to as "contents"). This requires third-party content providers to use our users' IP addresses to send contents to users' browsers. An IP address is therefore required for displaying these contents. We strive to only include contents of providers who only use users' IP addresses to offer their contents. In addition, third-party providers may use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. "Pixel tags" allow information to be assessed, such as on our website's visitor traffic. Furthermore, this pseudonymous information may be saved on users' devices through cookies and may include technical information about the user's browser, operating system, referring websites, visiting times and other information about use of our online offer and may be linked to information from other sources.

14.2. An overview of third-party providers and their contents as well as links to their privacy policies that include further information about data processing and, as partially stated herein, objection (so-called opt-out) options is provided hereafter:

 

Privacy Notice for Customers and Other Data Subjects

This Privacy Notice will provide you with an overview of how we process your personal data and your rights under data protection law. Which data is processed specifically and how it is used depends on the requested or agreed services. Therefore, not all of this information will apply to you.

 

1. Who is responsible for data processing and who can I contact?

The data processing controller is:

 

Philipp C. A. Klais

Johannes Klais Orgelbau GmbH & Co.KG

Kölnstraße 148

53111 Bonn
Germany

 

You may contact our data protection offer at:

 

Johannes Klais Orgelbau GmbH & Co.KG

Data Protection Officer

Kölnstraße 148

53111 Bonn
Germany

datenschutz@klais.de

 

2. What sources and data do we use?

We process personal data that we receive through our business relationships with our customers or from other data subjects. If required for performing our services, we also process personal data we obtain legitimately from publicly available sources (e.g., the press or Internet) or that is transmitted to us legitimately by other third parties.

Relevant personal data includes: Personal information (name, address and other contact details, such as one's telephone number and email address).

This may also include order data, e.g., bank details, contract data, data obtained through the fulfillment of our contractual obligations (e.g., payment transaction revenue data) and other data from comparable categories.

 

3. Why (for what purpose) and on what legal basis do we process data?

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act [Bundesdatenschutzgesetz, BDSG].

 

3.1 With your consent (Art. 6(1) Letter a of the General Data Protection Regulation)

If you provide your consent for the processing of personal data for specific purposes (e.g., [PLEASE COMPLETE, e.g.,: Photographs for events or our newsletter]), the legitimacy of this processing will be based on your consent. Consent once granted may be revoked at any time. This also applies to revocations of declarations of consent issued to us before the General Data Protection Regulation came into effect on 25 May 2018.

Please note that revocations only have future effect and will not affect processing performed before the revocation is issued.

3.2 To fulfill contractual obligations (Art. 6(1) Letter b of the General Data Protection Regulation in connection with Section 26(1) of the German Federal Data Protection Act; Art. 88(1) of the General Data Protection Regulation in connection with Section 26(4) of the German Federal Data Protection Act

Data will be processed to perform and convey services for the execution of our contracts with our clients or for requested pre-contractual measures. The purposes of data processing are primarily based on the product (building, restoration and maintenance of pipe organs) and may include requested additional services, e.g., providing images and texts. Please see our respective contract documents and Terms and Conditions for more information about data processing purposes.

3.3 Due to legal requirements (Art. 6(1) Letter c of the General Data Protection Regulation in connection with Section 26 of the General Data Protection Regulation)

In addition, we will process your data to fulfill legal requirements (e.g., supervisory requirements, storage and proof obligations under commercial or tax law).

3.4 To weigh interests (Art. 6(1) Letter f of the General Data Protection Regulation)

If required, we will process your data after the fulfillment of the contract to safeguard our and third parties' legitimate interests.

Examples:

  • To document legally or operationally required legal or financial audits (e.g., by auditors, internal audits or our internal control system);
  • To assert legal claims and for defense in case of legal disputes,
  • To assure orderly data processing in accordance with technical IT security and legal data protection requirements (e.g., protocol files);
  • To analyze and correct technical errors;
  • To prevent and investigate criminal offenses,
  • For video monitoring to safeguard domiciliary rights,
  • For the building and system security measures (e.g., access controls),
  • For measures to safeguard domiciliary rights,
  • To identify contact persons (e.g., names, telephone numbers, email addresses, functions and department/team affiliations) and for internal and external company communication

 

4. Who will receive my data?

Within the JOHANNES KLAIS ORGELBAU GmbH & Co.KG, access to your data will be provided to the parties who need it to full our contractual and legal obligations. In addition, we also use various service providers to fulfill our contractual and legal obligations. These are companies of categories that include: IT services, logistics, print services, telecommunications, debt collection and consultation.

For data transfers to recipients outside of the JOHANNES KLAIS ORGELBAU GmbH & Co.KG, please note that we may only provide information on our customers if permitted by law or with the customer's consent. Under these conditions, recipients of personal data may include:

  • Domestic or foreign customs or visa offices (including in third countries outside of the EEA)
  • Law enforcement authorities, in case of legal or official obligations
  • Service providers commissioned by us for contracted processing

 

5. Will data be transmitted to a third country or to an international organization?

Data will only be transmitted to a third country (states outside of the European Economic Area – EEA) in justified exceptions.

If required, your personal data may be transferred to customs or visa offices under adherence to European levels of protection for personal data

 

6. How long will my data be saved?

We will process and save your personal data for as long as necessary for completing our contractual and legal obligations. Once your data is no longer needed to fulfill contractual or legal obligations, it will be deleted, unless its—temporary—processing is required for the following purposes:

  •  Fulfillment of storage obligations under commercial or tax law, e.g., as required by the German Commercial Code [Handelsgesetzbuch, HGB] or the German Fiscal Code [Abgabenordnung, AO] whose storage and documentation periods are usually between two and ten years.
  • Preservation of evidence in accordance with legal limitation periods. Under Section 195 et seq. of the German Civil Code [Bürgerliches Gesetzbuch, BGB], these limitation periods may last up to 30 years, though limitation periods usually last for 3 years.

 

7. What data protection rights do I have?

Every data subject has the right to information under Art. 15 of the General Data Protection Regulation, the right to correction under Art. 16 of the General Data Protection Regulation, the right to erasure under Art. 17 of the General Data Protection Regulation, the right to restriction of processing under Art. 18 of the General Data Protection Regulation and the right to data portability under Art. 20 of the General Data Protection Regulation. Sections 34 and 35 of the German Federal Data Protection Act also apply to the right to information and the right to erasure. In addition, you have the right to submit complaints to competent data protection supervisory authorities (Art. 77 of the General Data Protection Regulation in connection with Section 19 of the German Federal Data Protection Act).

Consent once granted to the processing of personal data may be revoked at any time. This also applies to revocations of declarations of consent issued to us before the General Data Protection Regulation came into effect on 25 May 2018. Please note that revocations only have future effect and will not affect processing performed before the revocation is issued.

 

8. Am I required to provide data?

For our business relationship, you only have to provide the personal data required for the establishment, execution and completion of the business relationship and the fulfillment of any related obligations or personal data which we must collect by law. Without this data, we normally will not be able to conclude, execute and fulfill contracts with you.

 

9. To what extent is automated individual decision-making (including profiling) used?

We do not use automated individual decision-making under Art. 22 of the General Data Protection Regulation to establish or execute business relationships. Should we use these processes in individual cases, we will notify you and inform you separately about your respective rights if required by law.

 

Right to Object Under Art. 21 of the General Data Protection Regulation

Right to Object in Individual Cases

You have the right to object at any time to the processing of your personal data performed under Art. 6(1) Letter e of the General Data Protection Regulation (processing in the public interest) or Art. 6(1) Letter f of the General Data Protection Regulation (processing for the purposes of legitimate interests) on grounds relating to your personal circumstances; this also applies to any profiling in the sense of Art. 4(4) of the General Data Protection Regulation based on these regulations.

If you object, we will no longer process your personal data, unless we can demonstrate legitimate reasons to continue its processing that outweigh your interests, rights and freedoms or if the processing of your personal data serves the establishment, exercise or defense of legal claims.

 

Objection to Data Processing for Direct Marketing Purposes

In individual cases, we may process your personal data for direct marketing purposes. You have the right to object to the processing of your personal data for such marketing purposes at any time; this also applies to profiling if related to such direct marketing purposes.

If you object, we will no longer process your personal data for such purposes.

Objection Recipient

Objections may be submitted by stating your name, address and date of birth with the subject line "Objection" to:

 

Johannes Klais Orgelbau GmbH & Co.KG
Lohnbuchhaltung
Kölnstraße 148
53111 Bonn
Germany