Your data.
Our responsibility.

Data protection is a high priority for our company. Our website can generally be used without providing personal data. If a person wishes to use particular services, processing personal data may be necessary. Where processing is necessary and no legal basis exists, we obtain the person's consent.

Personal data, such as names, addresses, email addresses and telephone numbers, are processed in accordance with the German Federal Data Protection Act (BDSG), the EU General Data Protection Regulation (GDPR) and other applicable law. This notice explains the nature, scope and purpose of processing and the rights of the people concerned.

We have implemented technical and organisational measures to protect personal data. However, internet-based data transmission can have security gaps, so absolute protection cannot be guaranteed.

1. Definitions

This privacy notice is based on the GDPR. The following terms are explained to make the notice clear and understandable.

1.1 Personal data

Personal data are information relating to an identified or identifiable natural person. A person may be identifiable directly or indirectly, for example by a name, identification number, location data, online identifier or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

1.2 Data subject

A data subject is an identified or identifiable natural person whose personal data are processed by the controller.

1.3 Processing

Processing is any operation performed on personal data, whether or not by automated means. It includes collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission or other means, alignment, combination, restriction, erasure and destruction.

1.4 Restriction of processing

Restriction of processing means marking stored personal data with the aim of limiting their future processing.

1.5 Profiling

Profiling is automated processing of personal data to evaluate personal aspects, particularly to analyse or predict work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

1.6 Pseudonymisation

Pseudonymisation means processing personal data so that they cannot be attributed to a specific person without additional information. That additional information is kept separately and is subject to technical and organisational measures preventing attribution to an identified or identifiable person.

1.7 Controller

The controller is the person, company, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data.

1.8 Processor

A processor is a person, company, public authority, agency or other body that processes personal data on behalf of the controller.

1.9 Recipient

A recipient is a person, company, public authority, agency or other body to which personal data are disclosed, whether or not it is a third party. Public authorities receiving data in the framework of a particular inquiry under Union or Member State law are not regarded as recipients for this purpose.

1.10 Third party

A third party is a person or body other than the data subject, controller, processor or persons authorised to process personal data under the direct authority of the controller or processor.

1.11 Consent

Consent is a freely given, specific, informed and unambiguous indication of a person's wishes, expressed by a statement or clear affirmative action, agreeing to the processing of their personal data.

2. Name and address of the controller

The controller for the purposes of the GDPR is:

Dr. Zapfe GmbH
Alustr. 1
D-83527 Kirchdorf
Germany
Phone +49 8072 9191-280
info@ing-zapfe.de
www.ing-zapfe.com

3. Contact details of our external data protection officer

Kefer IT-Beratung
Monika Kefer
Blumenstr. 9A
83569 Vogtareuth
Germany
Phone +49 (0) 8038 10 39
info@kefer-it.de
www.kefer-it.de

You may contact our data protection officer directly with questions or suggestions concerning data protection.

4. Cookies

This website does not use analytics or marketing cookies. Images and fonts are hosted locally. Navigation, language selection and project galleries do not set cookies.

5. Collection of general data and information

When the website is accessed, the hosting web server may process technical connection data. These may include the IP address, time of access, requested address, browser and operating system. The processing of server logs depends on the hosting service used.

6. Contacting us through the website

You can contact us by telephone or email. The enquiry form prepares an email in your own email application. The form does not transmit the entered data to a server or store them in your browser. Only when you send the prepared message from your email application are the details transmitted to us for handling your enquiry.

7. Routine erasure and blocking of personal data

The controller processes and stores personal data only for as long as necessary for the processing purpose, or as required by applicable law. When the purpose no longer applies or a statutory retention period expires, the data are routinely blocked or erased in accordance with the law.

8. Rights of the data subject

8.1 Right to confirmation

You may request confirmation of whether we process personal data concerning you. Contact our data protection officer or another member of our company to exercise this right.

8.2 Right of access

You may obtain, free of charge, information about the personal data stored about you and a copy of those data, together with information on:

• the purposes of processing;
• the categories of personal data concerned;
• recipients or categories of recipients, particularly in third countries or international organisations;
• the envisaged retention period, where possible, or the criteria used to determine it;
• rights to rectification, erasure, restriction of processing and objection;
• the right to complain to a supervisory authority;
• available information about the source of data not collected from you;
• automated decision-making, including profiling under Article 22(1) and (4) GDPR, and meaningful information about the logic involved and the significance and envisaged consequences of that processing.

You may also request information about transfers to third countries or international organisations and the appropriate safeguards used. Contact our data protection officer to exercise your right of access.

8.3 Right to rectification

You may request that inaccurate personal data be corrected without undue delay. Taking account of the purposes of processing, you may also request completion of incomplete data, including by providing a supplementary statement. Contact our data protection officer to exercise this right.

8.4 Right to erasure (right to be forgotten)

You may request erasure of your personal data without undue delay, insofar as processing is not necessary and one of the following grounds applies:

• the data are no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw consent under Article 6(1)(a) or Article 9(2)(a) GDPR and no other legal basis applies;
• you object under Article 21(1) GDPR and there are no overriding legitimate grounds, or you object under Article 21(2);
• the data have been unlawfully processed;
• erasure is required to comply with a legal obligation under Union or Member State law;
• the data were collected in relation to information society services under Article 8(1) GDPR.

Contact our data protection officer if these conditions apply and you wish to request erasure. If we have made the data public and are obliged to erase them under Article 17(1) GDPR, we take reasonable steps, taking account of available technology and implementation costs, to inform other controllers of your request to erase links, copies or replications where processing is not necessary.

8.5 Right to restriction of processing

You may request restriction of processing where:

• you contest the accuracy of the data, for a period enabling us to verify them;
• processing is unlawful and you oppose erasure but request restriction instead;
• we no longer need the data for processing, but you need them to establish, exercise or defend legal claims;
• you have objected under Article 21(1) GDPR and verification of whether our legitimate grounds override yours is pending.

Contact our data protection officer to request restriction.

8.6 Right to data portability

You may receive personal data you have provided in a structured, commonly used, machine-readable format, and transmit them to another controller without hindrance, where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or on a contract under Article 6(1)(b), and is carried out by automated means. This does not apply where processing is necessary for a task in the public interest or the exercise of official authority.

Under Article 20(1) GDPR, you may also request direct transmission between controllers where technically feasible and where this does not adversely affect the rights and freedoms of others. Contact our data protection officer to exercise this right.

8.7 Right to object

You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. We will no longer process the data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is needed to establish, exercise or defend legal claims.

Where data are processed for direct marketing, you may object at any time to that processing, including related profiling. We will then stop processing the data for those purposes. You may also object, on grounds relating to your particular situation, to processing for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless processing is necessary for a task in the public interest. Contact our data protection officer to object.

8.8 Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on you, unless the decision is necessary for entering into or performing a contract, is authorised by applicable Union or Member State law with suitable safeguards, or is based on your explicit consent.

Where a decision is necessary for a contract or based on explicit consent, we implement appropriate safeguards, including at least the right to human intervention, to express your point of view and to contest the decision. Contact our data protection officer to exercise rights concerning automated decisions.

8.9 Right to withdraw consent

You may withdraw consent to the processing of your personal data at any time. Contact our data protection officer if you wish to do so.

9. Data protection in applications and recruitment

The controller collects and processes applicant data for recruitment purposes, including electronically where application documents are submitted by email or another electronic method. If an employment contract is concluded, the data are stored to administer the employment relationship in accordance with applicable law. If no contract is concluded, application documents are automatically deleted six months after notification of rejection, unless other legitimate interests prevent deletion, such as evidential requirements in proceedings under the German General Equal Treatment Act (AGG).

10. Tracking tools and external services

This website does not embed tracking tools, analytics services, social media plugins or external videos. Links to other websites, maps and documents are opened only when you choose to follow them. The privacy information of the respective provider applies to those external services.

11. Competent data protection supervisory authority

Bayerisches Landesamt für Datenschutzaufsicht
Promenade 27 (Schloss)
D-91522 Ansbach
Germany
Phone +49 (0) 981 53 1300
Fax +49 (0) 981 53 98 1300
poststelle@lda.bayern.de

12. Changes to this privacy notice

We reserve the right to amend our security and data protection provisions where technical developments require this. In that case, we will update this privacy notice accordingly. Please refer to the current version of our privacy notice.