Privacy

When you use our websites solely for information purposes, i.e. view the content without registering or otherwise providing us with information, we process only the following data that your browser transmits to our web hosting provider:

• Browser type/version,
• Operating system used,
• Browser software language and version,
• Date and time of access,
• IP address,
• Content of the request (specific webpage),
• Access status/HTTP status code,
• Referrer URL (the previously visited webpage),
• Notification as to whether the request was successful, and
• Amount of data transferred
• Time zone difference from GMT.

Temporary processing of this data is technically necessary to establish a connection and display the website content. Access data is not used to identify individual users and is not combined with data from other sources. Access data is also stored in log files to ensure the proper functioning of the website and the security of information technology systems. The legal basis for processing is Art. 6(1), first sentence, point (f) GDPR. Our legitimate interests lie in ensuring the functionality, stability and security of the websites. Storing access data in log files, in particular the IP address, for a longer period enables us to detect and prevent misuse. This includes, for example, preventing requests that overload the service or any use by bots. Access data is deleted as soon as it is no longer necessary to achieve the purpose for which it was processed. Where data is collected to provide the website, this is the case when you end your visit to the website. As a rule, log data is stored locally, accessible only to administrators, and deleted after no more than seven days. After that, it is available only indirectly through the restoration of backups and is permanently deleted after no more than four weeks.

We use Magnolia International Ltd, Oslo-Strasse 2, 4142 Münchenstein (Basel), Switzerland, as our web host and have concluded a contract with it pursuant to Art. 28 GDPR. The server is located in Germany.

Cookies and similar technologies are used on our websites to provide basic website functions, measure the reach of our services, the functionality of our website and the success of our advertising measures, personalise advertising measures and integrate external content.

For some of these functions, we use third-party providers that use cookies and similar technologies to store information on visitors' devices or access information stored there and process visitors' personal data.

 

2.1 Essential functions

Our websites include a user area with restricted access. To authenticate access to this area,

• a standard TYPO3 session cookie is placed in your browser when you log in. It stores a session ID. This enables us to recognise the logged-in user and grant access to protected areas. The storage period is one week.

The legal basis for accessing your device and subsequently processing your personal data is Section 25(2)(2) TDDDG and Art. 6(1), first sentence, point (f) GDPR. Our legitimate interests in this processing are to provide the basic functions described above and thereby make the website user-friendly and secure.

2.1.1 Consent management - Usercentrics Consent Management Platform

To inform you about the cookies and other technologies we use on our websites and to obtain and document your consent, we use the Usercentrics Consent Management Platform provided by Usercentrics GmbH ("Usercentrics") on www.ktr.com. We also use this service to store information about changes you make to your settings. We associate this information with each visit to our website so that, when you visit again, we can retrieve and apply the settings you have already selected. The following information is processed:

• Opt-in and opt-out data
• Referrer URL
• User agent
• User settings
• Consent ID
• Time of consent
• Type of consent
• Template version
• Banner language

User settings are stored using a cookie with a storage period of one year. Once this storage period has expired, you will be asked to provide your consent again. The user settings you select will then be stored again for this period.

The legal basis for this processing is Art. 6(1), first sentence, point (c) GDPR, to fulfil our legal obligation under Art. 7(1) GDPR.

2.1.2 Management of third-party tags – Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), on our website. Google Tag Manager is a solution that allows website tags and other third-party elements to be managed through a single interface. First, when the website is accessed using Google Tag Manager, an HTTP request is sent to Google. As a result, device information and personal data, such as your IP address and information about your browser settings, are transmitted to Google.

The relevant third-party tracking codes are implemented in Google Tag Manager, so we do not have to make extensive changes to the website source code ourselves. Instead, they are integrated using a container that inserts so-called placeholder code into the source code. Google Tag Manager also allows user data parameters to be exchanged in a specific order, in particular by arranging and systematising data packages.

Second, Google Tag Manager triggers tags from other third-party services, which then process your data. These services are described below in this Privacy Policy. Google Tag Manager itself does not analyse the device information and personal data of users collected by the tags. Instead, if you have given the relevant consent, your data is forwarded to the respective third-party service for the purposes stated in our Consent Management Platform. This means that consent to the respective third-party service also covers the use of Google Tag Manager.

Google also processes some of the data in the USA. The legal basis for transferring data to the USA is your consent under Art. 49(1), first sentence, point (a) GDPR. You can find information about the storage period for your data in the descriptions of the individual third-party services below. Further information about data protection at Google is available at:www.google.de/intl/de/policies/privacy 

 

2.2 Statistical analysis

To measure the reach of our services and the functionality of our website, we use the service providers described below, if and to the extent that you have consented via the banner displayed to you (see Section 2.1.1 for details).

Unless stated otherwise below, the legal basis for accessing your device and subsequently processing your personal data is your consent under Section 25(1) TDDDG and Art. 6(1), first sentence, point (a) GDPR.

You may withdraw your consent at any time by reopening our consent management tool via the "Cookie settings" link in the footer and moving the slider back for the relevant purpose or third-party provider. The lawfulness of processing carried out before the withdrawal remains unaffected.

2.2.1 Analysis of usage data - Google Analytics

To tailor our website as closely as possible to users' interests, we use Google Analytics, a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Using cookies, Google processes information generated about how your device uses our website - for example, that you visited a particular webpage - and, among other things, the data listed in the "Access data" section, in particular your IP address, browser information, the webpage previously visited, and the date and time of the server request, for the purpose of statistically analysing website usage. For this purpose, it may also be determined whether different devices belong to you or your household. This website uses Google Analytics with the "anonymizeIp()" extension. Accordingly, IP addresses are further processed in order to make it substantially difficult to identify any individuals. According to Google, your IP address is truncated beforehand within the Member States of the European Union. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. Google processes this information on our behalf to analyse your use of the website, compile reports on website activity for us and - where we specifically indicate this - provide us with other services related to website use. The IP address transmitted by your browser for these purposes is not combined with other data held by Google.

Google also processes some of the data in the USA. The legal basis for transferring data to the USA is your consent under Art. 49(1), first sentence, point (a) GDPR. Your data in connection with Google Analytics is deleted no later than fourteen months after collection. Further information about data protection at Google is available at:https://policies.google.com/privacy?hl=de&gl=de

2.2.2 Analysis of mouse movements and clicks - Microsoft Clarity

We use the Clarity service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). Clarity is a web analytics service that enables us to analyse how our website is used. The service records mouse movements and clicks so that we can identify potential improvements to the website. The data is processed in anonymised or pseudonymised form. Your full IP address is stored only in truncated form, which rules out direct identification. The information collected is transmitted to and stored by Microsoft Clarity. We have concluded a data processing agreement with Microsoft pursuant to Art. 28 GDPR.

When Clarity is used, information is also processed outside the EU, namely in the USA, which is a so-called third country. Where the European Commission has adopted an adequacy decision for a third country, no additional measures are required for data transfers. Where data is transferred to recipients based in the USA, the transfer is made on the basis of the Trans-Atlantic Data Privacy Framework (DPF) of 10 July 2023, provided that the recipients hold the relevant certification. Microsoft holds such certifications.

Your data in connection with Clarity is deleted no later than thirteen months after collection.

2.2.3 Analysis of usage data - Salesforce Marketing Cloud Account Engagement

To tailor our website as closely as possible to users' interests, we use Marketing Cloud Account Engagement, a web analytics service provided by Salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 Munich, Germany ("Salesforce"). Using cookies, Salesforce processes information generated about how your device uses our website - for example, that you visited a particular webpage - and, among other things, the data listed in the "Access data" section, in particular your IP address, browser information, the webpage previously visited, and the date and time of the server request, for the purpose of statistically analysing website usage. For this purpose, it may also be determined whether different devices belong to you or your household. Salesforce processes this information on our behalf to analyse your use of the website, compile reports on website activity for us and - where we specifically indicate this - provide us with other services related to website use. Salesforce processes your personal data on our behalf. For this purpose, we have concluded a data processing agreement with Salesforce pursuant to Art. 28 GDPR. Salesforce also processes some of the data in the USA. The legal basis for transferring data to the USA is your consent under Art. 49(1), first sentence, point (a) GDPR. 

Your data in connection with Salesforce is deleted no later than 3650 days after collection.

 

2.3 Marketing

To personalise advertising measures and measure their success, we use the service providers described below, if and to the extent that you have consented via the banner displayed to you (see Section 2.1.1 for details).

Unless stated otherwise below, the legal basis for accessing your device and subsequently processing your personal data is your consent under Section 25(1) TDDDG and Art. 6(1), first sentence, point (a) GDPR.

You may withdraw your consent at any time by reopening our consent management tool via the "Cookie settings" link in the footer and moving the slider back for the relevant purpose or third-party provider. The lawfulness of processing carried out before the withdrawal remains unaffected.

2.3.1 Measuring the success of advertising measures - Google Ads conversion tracking

We use Google Ads, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to draw attention to our attractive offers on external websites using advertising materials (formerly known as "Google AdWords"). By consulting the details gathered from advertising campaigns, we can draw conclusions as to how successful individual advertising measures have been. These advertising materials are delivered by Google via so-called ad servers. For this purpose, we use ad server cookies, which can be used to measure certain parameters for reach measurement, such as ad impressions or user clicks. If you reach our website via a Google advertisement, Google Ads stores a cookie on your device. Using cookies, Google processes information generated by your device about interactions with our advertising materials (visiting a particular website or clicking on an advertisement) and the data listed in the "Access data" section, in particular your IP address, browser information, the webpage previously visited, and the date and time of the server request, to analyse and visualise the reach of our advertisements. For this purpose, it may also be determined whether different devices belong to you or your household. The marketing tools we use cause your browser to establish a direct connection to Google's server automatically. If you are registered with a Google service, Google may associate the visit with your account. Even if you are not registered with Google or are not logged in, the provider may still obtain and process your IP address. We receive only statistical evaluations from Google to measure the success of our advertising materials. Google also processes some of the data in the USA. The legal basis for transferring data to the USA is your consent under Art. 49(1), first sentence, point (a) GDPR. Google's storage period is no longer than twenty-four months. Further information about data protection and Google's storage period is available at: https://policies.google.com/privacy

2.3.2 Personalised advertising measures - Google Ads Remarketing

We use the Google Ads tool with the Dynamic Remarketing function, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This is a process that enables us to address you again with advertising. The Dynamic Remarketing function allows us to recognise users of our website on other websites within the Google advertising network (in Google Search or on YouTube, as so-called Google Ads, or on other websites) and to display advertisements tailored to their interests. The advertisements may also relate to products and services that you have already viewed on our website. To do this, users' interactions with our website are analysed, for example which offers they were interested in, so that targeted advertising can be shown to them on other websites after they have visited our website. When you visit our website, Google Ads stores a cookie on your device. Using cookies, Google processes information generated by your device about your use of and interactions with our website, as well as the data listed in the "Access data" section, in particular your IP address, browser information, the webpage previously visited, and the date and time of the server request, for the purpose of displaying personalised advertisements. For this purpose, it may also be determined whether different devices belong to you or your household. Data collected through Google Ads is not combined with data from other Google products. Google also processes some of the data in the USA. The legal basis for transferring data to the USA is your consent under Art. 49(1), first sentence, point (a) GDPR. Google's storage period is no longer than twenty-four months. Further information about data protection and Google's storage period is available at policies.google.com/privacy.

 

2.4 External content

To integrate external content into our websites, we use the service providers described below, if and to the extent that you have consented via the banner displayed to you (see Section 2.1.1 for details).

Unless stated otherwise below, the legal basis for accessing your device and subsequently processing your personal data is your consent under Section 25(1) TDDDG and Art. 6(1), first sentence, point (a) GDPR.

You may withdraw your consent at any time by reopening our consent management tool via the "Cookie settings" link in the footer and moving the slider back for the relevant purpose or third-party provider. The lawfulness of processing carried out before the withdrawal remains unaffected.

2.4.1 Video platform - YouTube

On our website, we use plugins from the video platform YouTube.de or YouTube.com, a service of YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA ("YouTube"), for which Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001) is the controller for data protection purposes. By embedding these plugins, we aim to make visual content ("videos") that we have published on YouTube.de or YouTube.com available on our website as well. When the streaming function is used, information stored on your device (e.g. your IP address) is also processed. The videos are embedded in "extended privacy mode", meaning that no data about you as a user is transmitted to YouTube unless you play the videos. While videos are being played on our website, YouTube receives information that you have accessed the relevant subpage of our website. In addition, some of the data listed in the "Access data" section is transmitted to Google. This occurs regardless of whether YouTube provides a user account that you are logged into or whether you have no user account. If you are logged into Google, your data is directly associated with your account. If you do not want your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data in user profiles and processes it, regardless of whether you have a Google account, for advertising, market research and/or the needs-based design of its website. Google also processes some of the data in the USA. The legal basis for transferring data to the USA is your consent under Art. 49(1), first sentence, point (a) GDPR. Further information about the purpose and scope of processing by YouTube and YouTube's storage period is available in the Privacy Policy at: https://policies.google.com/privacy

2.4.2 Videos - Vimeo

To embed videos on our website, we use the Vimeo service provided by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA ("Vimeo"). We have enabled Vimeo's "Do Not Track"/consent blocker function, so a connection to Vimeo's servers is not established until and to the extent that you have given your consent via the banner displayed to you or start a Vimeo video on this website. While videos are being played on our website, Vimeo receives information that you have accessed the relevant subpage of our website. In addition, some of the data listed in the "Access data" section (including your IP address, date and time) is transmitted to Vimeo. This occurs regardless of whether Vimeo provides a user account that you are logged into or whether you have no user account. If you are logged into your Vimeo account, Vimeo can associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your Vimeo account. We have concluded a data processing agreement with Vimeo pursuant to Art. 28 GDPR. Vimeo also processes some of the data in the USA. The legal basis for transferring data to the USA is your consent under Art. 49(1), first sentence, point (a) GDPR. Your data in connection with Vimeo is deleted no later than twenty-four months after collection.

When you contact our company, e.g. by email or via the contact form on our website, we process the personal data you provide in order to respond to your enquiry. To process enquiries submitted via the contact form on our website, you are required to provide only a valid email address and your message. When you send us your message, your IP address and the date and time it was sent are also processed. The legal basis for processing is Art. 6(1), first sentence, point (f) GDPR or Art. 6(1), first sentence, point (b) GDPR if you contact us with a view to concluding a contract. The personal data entered in the form is processed solely to handle your contact request, which also constitutes our necessary legitimate interest in processing the data. The other data processed during transmission is used to prevent misuse of the contact form and ensure the security of our information technology systems. In this context, the data is not disclosed to third parties. We delete the data collected in this context once processing is no longer necessary, or, where applicable, restrict its processing to comply with existing statutory retention obligations.

You may object to the processing. You may object on grounds relating to your particular situation. You may send your objection to us using the contact details provided in the section "Controller".

We use Salesforce's Marketing Cloud Account Engagement service to respond to your contact enquiries. The provider is Salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 Munich, Germany. Salesforce processes your personal data on our behalf. For this purpose, we have concluded a data processing agreement with Salesforce pursuant to Art. 28 GDPR.

We use a live chat on our website provided by Userlike UG (limited liability), Probsteigasse 44-46, 50670 Cologne, Germany. You can use this function to contact us. When you start a chat, the following personal data is processed:

• Date and time of access,
• Browser type/version,
• IP address,
• Operating system used,
• URL of the previously visited webpage,
• Amount of data sent.

Processing takes place using a cookie (uslk_umm) with a storage period of one year. In addition, personal data that you enter during the chat is processed. The legal basis for accessing your device and subsequently processing your personal data is Section 25(2)(2) TDDDG and Art. 6(1), first sentence, point (f) GDPR, or Art. 6(1), first sentence, point (b) GDPR if you contact us with a view to concluding a contract. The personal data entered in the form is processed solely to handle your contact request, which also constitutes our necessary legitimate interest in processing the data. The other data processed during transmission is used to prevent misuse of the chat function and ensure the security of our information technology systems. We delete the data collected in this context once processing is no longer necessary, or, where applicable, restrict its processing to comply with existing statutory retention obligations.

You can subscribe to our email newsletters on our website. They provide regular updates on the following topics:

• Product information
• Invitations to events, trade fairs or webinars
• General information about KTR

A valid email address is required to receive the newsletter. If you can subscribe to other newsletters on one of our websites (e.g. to receive job vacancies), you will be provided with further information about the newsletter content at the relevant point. You sign up for our email newsletter using a double opt-in procedure. After you enter the data marked as mandatory, we will send an email to the address you provided asking you to expressly confirm your newsletter subscription by clicking on a confirmation link. This ensures that you actually wish to receive our email newsletter. If you do not confirm within 24 hours, we will block the information transmitted to us and automatically delete it after no more than one month. After you confirm, we process the email address and any other information voluntarily provided by the recipient for the purpose of sending our email newsletter. The legal basis for processing is Art. 6(1), first sentence, point (a) GDPR. We delete this data when you end your newsletter subscription.

You may withdraw your consent to the processing of your email address for receipt of the newsletter at any time, either by sending us a message (see the contact details in the section "Controller") or by clicking directly on the unsubscribe link included in the newsletter. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before the withdrawal.

When you subscribe, we also process your IP address, the time you subscribe to the newsletter and the time you confirm your subscription, in order to document your subscription and prevent misuse of your personal data.

The legal basis for processing is Art. 6(1), first sentence, point (f) GDPR. Our legitimate interest in this processing is fraud prevention. We delete this data no later than when your newsletter subscription ends.

We also analyse the open and click-through rates of our newsletters when they are sent. For this analysis, the emails we send contain so-called web beacons or tracking pixels, which are one-pixel image files and are also embedded on our website. The data is processed to analyse how our newsletters are read. In doing so, we record when you read our newsletters and which links you click, and use this information to infer our customers' interests. The legal basis for processing is Art. 6(1), first sentence, point (f) GDPR. Our legitimate interests in this processing are to measure the reach of our newsletters, compile statistical analyses and optimise our email advertising. The information is processed for as long as you remain subscribed to the newsletter. After you unsubscribe, the data is processed solely for statistical purposes and in anonymised form.

Please note that you may object at any time to receiving direct marketing and to the processing of your data for direct marketing purposes, without incurring any costs other than the transmission costs at the basic rates. You have a general right to object without stating reasons (Art. 21(2) GDPR). To do so, click the unsubscribe link in the relevant email or send your objection to us using the contact details provided in the section "Controller".

We use Salesforce's Marketing Cloud Account Engagement service to send our newsletter. The provider is Salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 Munich, Germany. Salesforce processes your personal data on our behalf to send you the newsletter. For further information, see Section 3 above. 3.

To display a digital flip catalogue on our website, we use hosting services provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). For this purpose, all access data listed in Section I.1 is processed. The legal basis for processing is Art. 6(1), first sentence, point (f) GDPR. By using external hosting services, we pursue the efficient and secure provision of our online services.

We process personal data of our customers and suppliers and their employees (e.g. the name and contact details of a contact person) if and to the extent necessary to initiate, establish, perform and/or terminate a legal transaction with our company. The legal basis for this is Art. 6(1), first sentence, point (b) GDPR. Providing your data is necessary to conclude the contract, and you are contractually obliged to provide it. If you do not provide your data, it will not be possible to conclude and/or perform the contract. Once the purpose has been achieved (e.g. the contract has been performed), the personal data is blocked from further processing or deleted, unless we are authorised to continue processing it on the basis of your consent (e.g. consent to process your email address to send our newsletter), a contractual agreement, a statutory authorisation (e.g. authorisation to send marketing to existing customers) or our legitimate interests (e.g. retention for the enforcement of claims). We disclose your personal data to third parties where this is

• necessary to establish, perform or terminate legal transactions with our company (e.g. sharing data with a payment service provider or shipping company to perform a contract with you) (Art. 6(1), first sentence, point (b) GDPR), or
• where a subcontractor or agent engaged by us exclusively to provide the offers or services you have requested needs the data (unless you are expressly informed otherwise, such assistants may process the data only to the extent necessary to provide the offer or service), or
• where an enforceable order issued by a public authority exists (Art. 6(1), first sentence, point (c) GDPR), or
• where an enforceable court order exists (Art. 6(1), first sentence, point (c) GDPR), or
• where we are legally obliged to do so (Art. 6(1), first sentence, point (c) GDPR), or
• where processing is necessary to protect the vital interests of the data subject or another natural person (Art. 6(1), first sentence, point (d) GDPR), or
• where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority,
• or where we can rely on our overriding legitimate interests or those of a third party for the disclosure (Art. 6(1), first sentence, point (e) or (f) GDPR).

We do not otherwise disclose your personal data to other persons, companies or bodies unless you have validly consented to such disclosure. In that case, the legal basis for processing is Art. 6(1), first sentence, point (a) GDPR. As part of this privacy information, we identify the relevant recipients for each processing activity.

Supplier risk management: To meet our auditing and reporting obligations relating to sustainability and compliance regulations, we use the supplier risk management platform provided by IntegrityNext GmbH, Schillerstraße 23A, 80336 Munich, Germany ("IntegrityNext"). This enables us to efficiently conduct general and specific risk analyses of our suppliers, implement preventive and corrective measures where necessary, and fulfil our documentation and reporting obligations. If one of our suppliers is not yet registered on the IntegrityNext platform, or if the information on the platform is insufficient, we provide IntegrityNext with the name, email address and company of our supplier contacts, and IntegrityNext sends an invitation email on our behalf. We base this processing on Art. 6(1), first sentence, point (f) GDPR: our legitimate interest in inviting our suppliers to participate in such a risk management platform outweighs the interests of the suppliers' contact persons. In principle, data subjects may object to this processing, as explained in more detail at the beginning of this Privacy Policy under "Right to object to processing" in the chapter "Your rights".

For all data processing in connection with and following a supplier's registration, IntegrityNext is itself the controller for data protection purposes. We have no influence over this processing. For further information about data processing by IntegrityNext, please read its Privacy Policy at: https://www.integritynext.com/data-privacy.

We provide our customers with an online shop at shop.ktr.com. To use it, you must have a customer account created. You can apply for one using the relevant form on our website. The following information is required to process your request:

• Company
• First and last name,
• Postal address, and
• Email address

The legal basis for processing is Art. 6(1), first sentence, point (b) GDPR. Providing your data is necessary and mandatory for concluding and/or performing the contract. If you do not provide your data, you cannot register, meaning that it will not be possible to conclude and/or perform a contract through our online shop. The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was processed, or its processing is restricted where statutory retention obligations apply.

Once your request has been successfully processed, we will send your login details (username and password) to you by post or email, as you prefer. The following functions are available in the login area:

• Ordering from the KTR catalogue
• Ordering from KTR configuration programmes
• Overview of your invoices
• Viewing delivery notes
• Shipment tracking via Track & Trace
• Quick order entry form
• Entry using your own material number
• Changing your password

We process your data to handle your orders. The legal basis for processing is Art. 6(1), first sentence, point (b) GDPR. Providing your data is necessary and mandatory for concluding and/or performing the contract. If you do not provide your data, it will not be possible to conclude and/or perform the contract. To prevent unauthorised third parties from accessing your personal data, the ordering process on the website is encrypted using SSL technology. We delete the data collected in this context once storage is no longer necessary, or restrict its processing where statutory retention obligations apply. Due to mandatory commercial and tax law requirements, we are obliged to retain your address, payment and order data for up to ten years.

We reserve the right, in accordance with statutory provisions, to use the email address provided by our customers during the business relationship to send you the following content by email during or after an order, unless you have already objected to the processing of your email address for this purpose:

• Product information
• Invitations to events, trade fairs or webinars
• General information about KTR

If sending electronic information is necessary for the performance of the contract (e.g. an informational email), processing is based on Art. 6(1), first sentence, point (b) GDPR. You are contractually obliged to provide your data. If you do not provide your data, it will not be possible to send electronic information by email as part of performing the contract. If sending electronic information is not necessary for the performance of the contract (e.g. an informational email), processing is based on Art. 6(1), first sentence, point (f) GDPR. Our legitimate interests in this processing are to expand and improve our services, send direct marketing and ensure customer satisfaction. We delete your data when you end your use of our services, but no later than three years after termination of the contract. Please note that you may object at any time to receiving direct marketing and to the processing of your data for direct marketing purposes, without incurring any costs other than the transmission costs at the basic rates. You have a general right to object without stating reasons (Art. 21(2) GDPR). To do so, click the unsubscribe link in the relevant email or send your objection to us using the contact details provided in the section "Controller".

The Facebook platform is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04X2K5, Ireland. We use a business account through which Meta processes data about visitors to our profile to create so-called Page Insights. This data includes information about the types of content visitors view, how they interact with our profile (e.g. whether they follow us), information about the devices they use (e.g. IP addresses, operating system, browser type and language settings) and information from the profiles of registered users. For Page Insights, the data is processed into numerical statistics and displayed to us in anonymised form in our user account. We and Meta are jointly responsible for processing visitors' data to create Page Insights (but not for other data processing carried out by Meta). The Facebook Terms of Service apply, and, since Instagram is a Meta service, the Meta Privacy Policy and the "Page Insights Controller Addendum" also apply. 

The Instagram platform is also operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04X2K5, Ireland. We use a business account through which Meta processes data about visitors to our profile to create so-called Page Insights. This data includes information about the types of content visitors view, how they interact with our profile (e.g. whether they follow us), information about the devices they use (e.g. IP addresses, operating system, browser type and language settings) and information from the profiles of registered users. For Page Insights, the data is processed into numerical statistics and displayed to us in anonymised form in our user account. We and Meta are jointly responsible for processing visitors' data to create Page Insights (but not for other data processing carried out by Meta). The Instagram Terms of Service apply and, since Instagram is a Meta service, the Meta Privacy Policy and the "Page Insights Controller Addendum" also apply. The addendum sets out, in particular, the security measures Meta must observe and Meta's commitment to fulfil data subjects' rights (i.e. users may, for example, send requests for access or erasure directly to Meta). You may also contact us.

The LinkedIn platform is operated by LinkedIn Ireland Unlimited Company (LinkedIn Ireland), Wilton Place, Dublin 2, Ireland. LinkedIn processes data about visitors to our profile to create so-called Page Insights. This data includes information about the types of content visitors view, how they interact with our profile (e.g. whether they follow us), information about the devices they use (e.g. IP addresses, operating system, browser type and language settings) and information from users' profiles, such as job function, country, industry, length of service, company size and employment status. For Page Insights, the data is processed into numerical statistics and displayed to us in anonymised form in our user account. We and LinkedIn are jointly responsible for processing visitors' data to create Page Insights. We have concluded a specific agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum"), available at https://legal.linkedin.com/pages-joint-controller-addendum). It sets out, in particular, the security measures LinkedIn must observe and LinkedIn's commitment to fulfil data subjects' rights. You may also contact us.

We operate our own channel on the YouTube platform, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google"). When you visit our YouTube channel, Google processes personal data. Please note that we have no influence over the type and scope of data processed by Google, how it is processed or whether it is disclosed to third parties. Further information about data processing by Google is available at: https://policies.google.com/privacy?hl=de The data you enter on YouTube (e.g. comments, likes and messages) is published by YouTube and used by us only as part of our public communication with you.

To conduct the application process, we require certain personal data, such as

• Name
• Email address
• your name, email address and application documents (documents uploaded by you, e.g. certificates, attestations, CV and cover letter, as well as any other personal data visible in them, such as your home address and date of birth).

Legal basis: The legal basis for processing your personal data is Art. 6(1), first sentence, point (b) GDPR. The data processing is necessary to decide whether to enter into a contractual relationship. Providing your email address is necessary for us to communicate with you during the application process (e.g. receipt confirmations, follow-up questions and invitations). Where special categories of personal data are processed (e.g. health data), we process them for reasons relating to employment law, social security law or social protection law pursuant to Art. 6(1), first sentence, point (b), in conjunction with Art. 9(2), point (b) GDPR.

 

Voluntary information - legitimate interest

As part of your application, you may voluntarily provide additional information, e.g. Your telephone number or a form of address (e.g. Mr, Ms, diverse). This information is not required to conduct the application process and is therefore provided voluntarily.
We also ask you (optionally) how you heard about our job advertisement. Providing this information is voluntary and has no impact on the selection process. 
If you provide this information, we process it on the basis of Art. 6(1), point (f) GDPR. Our legitimate interest lies in particular in addressing you personally, being able to contact you by telephone if we have follow-up questions, and better assessing and optimising our recruitment measures.

Failure to provide this information has no impact on the application process.

 

Other processing

If you claim travel expenses in connection with a job interview, we process the personal data required for this purpose (e.g. bank details and receipts) to reimburse those expenses. The legal basis for processing is Art. 6(1), point (c) GDPR, as in this case we fulfil a legal obligation to reimburse expenses.

After the application process has ended, further data processing may take place on the basis of your consent or, where necessary, for the establishment, exercise or defence of legal claims. In the latter case, the legal basis is Art. 6(1), first sentence, point (f) GDPR, our legitimate interest in asserting or defending claims.

If you contact us electronically, for example by sending us an email, using the contact form on our website or calling us, we process your email address, name and other contact details, as well as the information you provide in your enquiry. To respond to your written enquiry, we require at least your email address. Processing your email address is therefore essential.

Legal basis: We process your data on the basis of Art. 6(1), first sentence, point (f) GDPR, namely our legitimate interest in responding to your general enquiry. If you contact us because you wish to initiate another contract with us, the legal basis is Art. 6(1), first sentence, point (b) GDPR. If we are legally obliged to retain your data, the legal basis is Art. 6(1), first sentence, point (c) GDPR in conjunction with the relevant legal provision.

Storage period: Your data is processed only to respond to your enquiry and is deleted without undue delay once the enquiry has been resolved, unless a contract has been concluded (see Section 3), statutory retention obligations apply or we have legitimate interests in retaining it further.

Storage period: The data we collect is stored until the purposes described above no longer apply and is then deleted, unless we are required to retain it for longer under Art. 6(1), first sentence, point (c) GDPR due to statutory retention and documentation obligations (e.g. under commercial, criminal or tax law).

If your application is unsuccessful, the data is generally deleted six months after the process has ended, unless longer retention obligations apply in individual cases (e.g. for receipts relating to travel expense reimbursement) or retention is necessary to defend against legal claims.

If you have consented to further storage, we will add your data to our applicant pool. The data will be deleted from the applicant pool after two years.

 

Recipients of your data:

During the application process, only those departments that need your personal data to conduct and process the application will have access to it. These include, in particular:

Internal:

• the Human Resources (HR) department,
• the relevant line managers for the position advertised,
• and the works council, to the extent necessary for it to exercise its participation rights.

External:

• IT service providers engaged by us, in particular the provider of our applicant management system, Coveto Recruiting Tool, coveto ATS GmbH, Alois-Thums-Straße 11, 63667 Nidda, Germany (acting as a processor pursuant to Art. 28 GDPR);
• the tax office or a tax adviser, e.g. in connection with reimbursement of application expenses; and banks,
• courts, law enforcement authorities or lawyers where this is necessary in connection with legal disputes (e.g. to establish, exercise or defend legal claims).
• Data may also be disclosed in connection with our business operations (e.g. to auditors or supervisory authorities).