Privacy Notice
1 Controller and Scope
1.1 Controller
The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) for the processing of personal data in connection with this website is:
A.Fasselt Engineering GmbH
Thüringerstraße 36
46286 Dorsten
Germany
Represented by: Managing Director Holger May
Telephone: +49 2369 9178-0
Fax: +49 2369 9178-88
Email: info@afasselt.de
1.2 Contact for Data Protection Matters
A.Fasselt Engineering GmbH has not appointed a data protection officer.
Questions concerning the processing of personal data and requests to exercise your data protection rights may be addressed using the contact details provided in Section 1.1.
The contact person for data protection matters is Managing Director Holger May.
1.3 Subject of This Privacy Notice
This privacy notice explains how personal data is processed when you visit our website and contact us. It describes the purposes and legal bases of processing, the service providers involved and your rights under the General Data Protection Regulation (GDPR).
Personal data is information that can be used to identify a natural person, either directly or in combination with other information. Examples include names, email addresses and IP addresses.
2 General Principles of Data Processing
2.1 Legal Bases
We process personal data on the legal bases explained below. The legal basis applicable to each processing activity is specified in the section covering the relevant function or means of contact.
Consent provides the legal basis under Article 6(1)(a) GDPR where you have voluntarily agreed to specific processing. You may withdraw your consent at any time with effect for the future; this does not affect the lawfulness of processing already carried out.
Article 6(1)(b) GDPR applies where processing is necessary for a contract with you or for steps prior to entering into a contract that you have requested.
Processing may be based on Article 6(1)(c) GDPR where it is necessary to comply with legal obligations.
Article 6(1)(f) GDPR permits processing necessary for the purposes of legitimate interests, provided that your interests and rights requiring protection do not override those interests. The interest pursued in each case is stated in this notice.
The requirements of Section 25 of the German Telecommunications and Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) also apply to the storage of information on users' terminal equipment or access to information already stored there.
2.2 Recipients of Personal Data
Within our company, only persons who need personal data to perform their duties are given access to it.
We use service providers to operate the website and handle enquiries. They receive data to the extent necessary to provide their services. Where they process data on our behalf, the requirements of Article 28 GDPR apply.
In particular, the following service providers are used on this website or in connection with communication facilitated through this website:
- ITM design GmbH for hosting and the technical provision of the website,
- Usercentrics GmbH for consent and preference management,
- Microsoft Ireland Operations Limited and/or companies within the Microsoft group for business email communication via Microsoft 365.
Other recipients receive personal data only where the transfer is legally permitted, for example to comply with a legal obligation, to perform a contract or with your consent.
2.3 Transfers to Third Countries
Transfers of data outside the European Union and the European Economic Area are subject to the additional requirements of Articles 44 to 49 GDPR.
Information on possible transfers to such third countries is provided in the section concerning the relevant service.
2.4 Retention Period
We retain personal data for as long as it is needed for the respective processing purpose. Once that purpose has been fulfilled, the data is deleted unless a legal obligation or another lawful basis requires further retention.
For enquiries, retention depends in particular on the completion of their handling and any subsequent contractual relationship. Retention based on your consent ends when you withdraw that consent, unless another legal basis exists for further retention.
Business and accounting records may be subject to statutory retention obligations. The establishment, exercise or defence of legal claims may also require further retention. Once these grounds no longer apply, the data is deleted. Additional information is provided in the sections on individual processing activities.
2.5 Security of Data Transmission
Our website uses HTTPS. The connection between your browser and our web server is encrypted using SSL or TLS.
This protects data against unauthorised access and modification during transmission.
Even with encrypted connections, the risks associated with communication over the internet cannot be completely eliminated.
2.6 Automated Decision-Making and Profiling
No decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place in connection with the use of this website.
3 Hosting and Technical Provision of the Website
3.1 External Hosting
The website is hosted externally by:
ITM design GmbH
Hauptstraße 43
48712 Gescher
Germany
The servers used for the website are located in Germany.
Hosting involves the processing of data necessary to retrieve, transmit, technically provide and securely operate the website. This may include, in particular:
- IP address of the device accessing the website,
- date and time of access,
- page or file accessed,
- volume of data transmitted,
- referrer URL,
- browser type and version,
- operating system used,
- hostname or technical information about the system accessing the website,
- status and error codes.
Hosting enables access to our website and supports its reliable and secure operation.
We base this processing on Article 6(1)(f) GDPR. Our legitimate interest is to provide a functioning website, identify technical errors and prevent attacks or abusive access.
A data processing agreement under Article 28 GDPR is in place with ITM design GmbH.
3.2 Server Log Files
Technical log data is generated when pages and files are accessed. The hosting provider processes this data in server log files.
The information processed may include, in particular:
- IP address,
- date and time of the request,
- resource accessed,
- browser type and version,
- operating system used,
- referrer URL,
- hostname or technical information about the device accessing the website,
- HTTP status code.
These logs are used for technical operation, investigating errors and protecting the website against unauthorised access.
The legal basis is Article 6(1)(f) GDPR. We have a legitimate interest in a website that operates without disruption and is protected against misuse.
The log data is not combined with other datasets to create profiles of your usage behaviour.
Retention period:
Server log data is retained according to what is necessary for secure website operation and the investigation of technical faults. Once this need no longer exists, the data is deleted unless another legal basis requires further retention.
In the event of a specific security incident, the log data required for that incident may be retained for investigation and legal action. Subsequent deletion is governed by the general criteria set out in Section 2.4.
4 Storage of Information on Devices and Consent Management
4.1 Legal Bases for Cookies and Similar Storage Technologies
This website uses only cookies or similar storage technologies that are necessary for the technical functions provided or whose use is based on valid consent.
Under Section 25(1) TDDDG, storing information on a device or accessing information already stored there generally requires consent.
Under Section 25(2) TDDDG, consent is not required, in particular, where storage or access is strictly necessary to provide a digital service expressly requested by the user.
Any processing of personal data following such storage or access is also subject to the provisions of the GDPR.
4.2 Usercentrics Consent Management Platform
The Consent Management Platform provided by
Usercentrics GmbH
Sendlinger Straße 7
80331 München
Germany
is used to manage and document privacy choices.
Usercentrics allows you to make and subsequently change your privacy choices. The service provides information about the integrated services, records your selection and ensures that it can be taken into account on subsequent page visits.
The data processed may include, in particular:
- decisions to grant or refuse consent,
- consent ID or controller ID,
- date and time of the decision,
- version of the consent configuration,
- version of the service templates used,
- language of the consent banner,
- referrer URL,
- browser or user agent information,
- IP address.
Information is stored in the local storage of the browser used to retain the privacy choice you have made.
The stored privacy choice remains available in the browser after a session ends, unless it is deleted or replaced by the browser, the application or you. You can remove the local entries through your browser settings. This does not automatically delete the records stored by the provider.
Consent data is processed to fulfil data protection obligations to provide evidence and maintain documentation. The legal basis is Article 6(1)(c) GDPR in conjunction with the accountability requirement under Article 5(2) GDPR and, where consent is documented, Article 7(1) GDPR.
Where storing the privacy choice on the device is strictly necessary to retain and implement the user's selection, storage is based on Section 25(2), point 2 TDDDG.
According to Usercentrics, consent data stored by the provider is automatically deleted after twelve months. The data is stored within the European Union. The retention period for these records is separate from the storage of settings in your browser's local storage.
A data processing agreement under Article 28 GDPR is in place with Usercentrics.
You can reopen and adjust your selection through the data protection or privacy settings on our website.
4.3 Technically Necessary TYPO3 Session
The website uses the TYPO3 content management system.
TYPO3 may set the technically necessary session cookie
fe_typo_user
in particular when the contact form is accessed or used.
The cookie is used for technical session management and the proper provision of the relevant website functions.
The cookie is configured as a session cookie. It is not intended to create usage profiles or for behavioural advertising.
Storage is necessary to provide the website function accessed by the user and is based on Section 25(2), point 2 TDDDG.
Where personal data is processed in connection with the session, this is based on Article 6(1)(f) GDPR. The legitimate interest is to provide the website and contact form securely and in a technically proper manner.
5 Contact Form
5.1 Processing When Using the Contact Form
The website provides a contact form based on the TYPO3 extension Powermail.
When you use the contact form, the information you enter is processed.
This includes, in particular:
- salutation, if provided,
- first name,
- last name,
- email address,
- message content,
- date and time of submission,
- technical information necessary to process the form,
- information confirming your acknowledgement of the privacy notice,
- technical data necessary for the CAPTCHA check.
Your first name, last name, email address, message and CAPTCHA entry are required to submit the form.
5.2 Purposes and Legal Bases
We use the information you provide in the form to handle your enquiry, reply to you and clarify any necessary follow-up questions.
Where the enquiry concerns a contract with you or steps prior to entering into a contract that you have requested, the legal basis is Article 6(1)(b) GDPR.
We handle other enquiries on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to respond appropriately to the matters raised with us.
Acknowledgement of this privacy notice must be distinguished from consent. No additional consent is required to handle an enquiry on either of the legal bases stated above.
5.3 Storage in TYPO3/Powermail and Forwarding by Email
The information submitted through the form is stored in the TYPO3/Powermail installation on the web server.
In addition, the contact enquiry is forwarded to
info@afasselt.de
by email.
Handling therefore includes:
- storage of the enquiry in the TYPO3/Powermail system,
- transmission and further handling of the enquiry in the company's email system.
The employees responsible and persons authorised to operate the systems may access enquiries to the extent necessary to perform their duties.
As the hosting service provider, ITM design GmbH may have technical access to the data stored there as part of its processing on our behalf.
5.4 Local CAPTCHA
A locally operated CAPTCHA protects the contact form against automated messages and abusive entries.
The resources required for this are provided by our website or the TYPO3/Powermail installation.
External CAPTCHA services, such as Google reCAPTCHA, hCaptcha or Cloudflare Turnstile, are not used for this purpose.
The CAPTCHA check therefore does not result in an additional transfer to an external CAPTCHA provider.
The check serves to prevent spam and automated access to the form.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect the form and the associated systems against misuse.
5.5 Retention Period for Contact Form Data
We retain information submitted through the form for as long as it is needed to handle and respond to the enquiry. After the enquiry has been handled, further retention depends on whether the information is still required for a contractual relationship, to comply with legal obligations or to safeguard legal claims.
Where the content of an enquiry forms part of a quotation, a contract or business correspondence subject to retention obligations, the relevant retention requirements apply. Once no lawful grounds for retention remain, the data is deleted.
The same general criteria for retention and deletion set out in Section 2.4 apply to the information stored in the form system and the forwarded email.
5.6 Requirement to Provide Data
There is generally no legal obligation to use the contact form or provide the data requested in it.
Without the information marked as mandatory, the enquiry cannot technically be submitted through the contact form or answered appropriately.
Alternatively, you may use the means of communication listed in Section 1.1 to make an enquiry.
6 Communication by Email, Telephone and Fax
6.1 General Processing of Communication Data
When you contact us by email, telephone or fax, the personal data provided in the course of that communication is processed.
This may include, in particular:
- name,
- company and role,
- email address,
- telephone or fax number,
- date and time of communication,
- communication content,
- any files or documents provided,
- other information provided voluntarily.
We process this information to understand and respond to your enquiry and clarify any necessary follow-up questions.
Where the matter concerns a contract with you or steps prior to entering into a contract that you have requested, processing is based on Article 6(1)(b) GDPR.
For other enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to handle our incoming communications appropriately.
6.2 Microsoft 365 for Email Communication
Microsoft 365 is used for business email communication.
The contracting party or provider for customers in the European Economic Area is, in particular:
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland
In the context of email communication, Microsoft systems may process the following data in particular:
- sender and recipient data,
- names and email addresses,
- subject lines and message content,
- communication metadata,
- date and time,
- technical delivery information,
- any attachments provided.
Processing serves to provide and secure the company's email communication.
The legal basis for the underlying communication is determined in accordance with Section 6.1.
Where Microsoft processes personal data on behalf of A.Fasselt Engineering GmbH, the contractual data protection provisions for Microsoft products and services apply, including the requirements for processing on behalf of a controller under Article 28 GDPR.
For Microsoft 365 services provided in the European Union or the European Economic Area, Microsoft makes extensive commitments to store and process data within the EU Data Boundary. Certain processing outside this boundary may nevertheless take place in connection with operations, security, support or other expressly specified exceptions.
Where personal data is transferred to countries outside the European Union or the European Economic Area, this is done in compliance with Article 44 et seq. GDPR.
According to its own documentation, Microsoft relies in particular on the European Commission's standard contractual clauses under Article 46(2)(c) GDPR for transfers of personal data from the European Economic Area to third countries in connection with its Enterprise Online Services. Microsoft is also certified under the EU-US Data Privacy Framework.
Further information on Microsoft's data processing, the contractual data protection provisions and possible transfers to third countries is available through the following links:
">Microsoft documentation on transfers outside the EU Data Boundary
The standard contractual clauses used to safeguard transfers to third countries are available through the data protection terms linked above. You may also request a copy of the transfer safeguards applicable to our processing using the contact details provided in Section 1.1.
6.3 Retention Period for Communication Data
Communication data is retained to handle your enquiry and any subsequent contractual relationship. Once this purpose no longer applies, further retention depends on statutory retention obligations or any need to use the data to safeguard legal claims.
The data is deleted once the respective grounds for retention no longer apply. The general criteria set out in Section 2.4 also apply.
7 Locally Provided Fonts and Icons
7.1 Google Fonts
The website uses fonts from Google Fonts.
The font files used are provided locally on the infrastructure used for this website.
When you access the website, no connection to Google servers is therefore established to display the fonts, and no personal data is transferred to Google as a result of their use.
The technical delivery of locally stored font files is subject to the processing described in Section 3 in connection with website operation and server logging.
7.2 Font Awesome
Font Awesome is used to display icons and graphical elements.
The files required for this are provided locally through the website.
When you access the website, no connection to servers operated by Fonticons, Inc. is established to display these elements, and no personal data is transferred to Fonticons, Inc. as a result of using Font Awesome.
The technical delivery of locally stored files is subject to the processing described in Section 3 in connection with website operation and server logging.
8 Rights of Data Subjects
8.1 Right of Access
Under Article 15 GDPR, you may obtain confirmation of whether we process personal data concerning you.
If we do, your right of access includes, in particular, the data, the purposes of processing, the recipients and the envisaged retention period or the criteria used to determine it. Further details are set out in Article 15 GDPR.
8.2 Right to Rectification
Under Article 16 GDPR, inaccurate personal data must be rectified without undue delay at your request.
You may have incomplete information completed where necessary in view of the purpose of processing.
8.3 Right to Erasure
Article 17 GDPR gives you a right to have your personal data erased under the conditions specified in that Article.
This may apply, in particular, where the data is no longer needed for its original purpose or has been processed without a legal basis.
Statutory exceptions may prevent erasure. These include, in particular, compliance with legal retention obligations and processing necessary for the establishment, exercise or defence of legal claims (Article 17(3) GDPR).
8.4 Right to Restriction of Processing
You may request restriction of processing in the circumstances set out in Article 18 GDPR.
This may be relevant, for example, while the accuracy of disputed data is being checked, where processing is unlawful, where data continues to be needed for legal claims or while an objection is being assessed.
8.5 Right to Data Portability
Under certain conditions, Article 20 GDPR allows you to receive the data you have provided in a structured, machine-readable format. This applies to automated processing based on your consent or a contract.
You may also request direct transmission to another controller where technically feasible.
8.6 Withdrawal of Consent
Under Article 7(3) GDPR, you may withdraw your consent at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing based on that consent before it was withdrawn.
8.7 Right to Object
Where processing is based on Article 6(1)(e) or (f) GDPR, you may object under Article 21(1) GDPR on grounds relating to your particular situation. This also includes profiling based on those provisions.
We will then cease the processing concerned unless compelling legitimate grounds that override your interests or the establishment, exercise or defence of legal claims justify its continuation.
Where data is processed for direct marketing, you may object at any time without giving specific reasons (Article 21(2) GDPR). The data may then no longer be used for that purpose. This also applies to profiling to the extent that it is related to direct marketing.
8.8 Right to Lodge a Complaint with a Data Protection Supervisory Authority
If you consider that the processing of your data infringes data protection law, you may lodge a complaint with a data protection supervisory authority under Article 77 GDPR. Other remedies remain available to you.
In particular, you may contact the authority at your habitual residence, your place of work or the place of the alleged infringement.
The data protection supervisory authority responsible for A.Fasselt Engineering GmbH is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Postal address:
Postfach 20 04 44
40102 Düsseldorf
Telephone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
9 Updates to This Privacy Notice
We update this privacy notice when website functions, the service providers used, data processing or legal requirements change.
The current version is available on this website.