Privacy policy

1.1. Objective and responsibility

• The purpose of this privacy policy is to inform you about the nature, scope and purpose of the processing of personal data on our website heraeus-comvance.com and the associated websites, functionalities and content (hereinafter collectively referred to as "website"). The privacy notice applies regardless of the systems, platforms and devices (e.g. desktop or mobile) on which the website is made available.
• The provider of the website and legally responsible for it under privacy law is heraeus-comvance.com (hereafter referred to as the “provider”, “we” or “us”). For further details as well as how to contact us, please see the legal information on our website.
• Our Data Protection Officer can be reached via the following email address dataprotection@heraeus.com or by post:
  
  Data Protection Officer 
  c/o Heraeusstr. 12-14
  63450 Hanau
• The term “user” includes all customers and their employees as well as visitors to our website.

1.2. Legal basis

Your personal data is collected and processed on the following legal basis:

• Consent in accordance with Art. 6 (1) (a) of the General Data Protection Regulation (GDPR). Consent is a statement of intent, freely given in a specific instance in an informed and unambiguous manner in the form of a declaration or another unequivocal affirmative act, where the data subjects make it clear that they consent to the processing of their personal data.
• Necessity for the performance of a contract or in order to take steps prior to entering into a contract in accordance with Art. 6 (1) (b) GDPR, i.e., the data is necessary for us to carry out our contractual obligations to users or we need the data in order to prepare a contract with users.
• Processing for compliance with a legal obligation in accordance with Art. 6 (1) (c) GDPR, i.e., the data processing is required on the basis of a law or some other requirement.
• Processing to safeguard legitimate interests in accordance with Art. 6 (1) (f) GDPR, i.e., the processing is necessary to safeguard our legitimate interests or those of a third party, provided the interests do not outweigh the fundamental rights and freedoms of users who require the protection of personal data.

1.3. Data subject rights

You can assert your rights as a data subject with regard to your processed personal data at any time using the contact details of the Data Protection Officer given above. As a data subject, you have the following rights.

• Right to revoke consent: If personal data is processed on the basis of consent, you have the right to revoke this consent at any time for the future in accordance with Art. 7 GDPR.
• Right to information: In accordance with Art. 15 GDPR, you can request confirmation of whether your data is being processed. If this is the case, you have the right to information regarding the information at no charge.
• Right to rectification: If personal data has been processed while incorrect, you have the right, to request that this data be corrected immediately in accordance with Art. 16 GDPR.
• Right to erasure: If you have revoked your consent, objected to the processing of your personal data (and there are no overriding legitimate reasons for the processing), your personal data is no longer necessary for the original purpose of the processing, there is a corresponding legal obligation or personal data has been processed unlawfully, you have the right to request the deletion of their personal data in accordance with Art. 17 GDPR.
• Right to restriction of processing: Under the provisions of Art. 18 GDPR, you have the right to demand that the processing of their personal data be restricted.
• Right to data portability: In accordance with Art. 20 GDPR, you have the right to receive the personal data you provided in a structured, commonly used and machine-readable format.
• Right to object: If processing the personal data is necessary to safeguard the legitimate interests of our company, you can object to the processing at any time in accordance with Art. 21 GDPR.
• Right to file a complaint: In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the responsible supervisory authorities.

1.4. Deletion of data

Your personal data is deleted as soon as the purpose for which it was collected has ceased to exist and there are no other legal or contractual obligations to retain it.

1.5. Security measures

State-of-the-art organizational and technical security measures are in place to ensure compliance with relevant legal provisions and to protect personal data against accidental or intentional manipulation, loss, destruction and unauthorized access.

1.6. Transfer of data to third parties and third-party providers

• We transfer data to third parties exclusively in accordance with legal provisions. We only transfer user data to third parties if necessary (for example, for accounting purposes) or for other purposes necessary to meet our contractual obligations to users or legal requirements.
• Where we use sub-contractors to provide our services, we will take appropriate legal precautions and technical and organizational measures to protect personal data in accordance with applicable legal provisions.
• If, within the scope of this privacy policy, we use content, tools or resources of other providers (hereinafter collectively referred to as “third-party-providers“) whose registered office is in a third country, it must be assumed that data are transferred to such third countries.
• Third countries are countries where the GDPR does not apply directly, i.e., in principle, all countries outside the EU or the European Economic Area. Data may only be transferred to third countries if an adequate level of data protection is ensured, if users have given their consent or if the transfer of such data is permitted by law.

1.7. Obligation to provide personal data

We do not make the conclusion of contracts between you and us dependent on you providing us with personal data beforehand. In principle, there is no legal or contractual obligation for you as a customer to provide us with your personal data; however, it may be that we can only provide certain offers to a limited extent or not at all if you do not provide the necessary data. Should this exceptionally be the case for the offers presented below, you will be informed separately. 

1.8. Automated decision-making process

We do not intend to use any personal information collected from you for any automated decision-making process (including profiling).
 

2.1. Hosting & CDN

We host our website externally and use a content delivery network (CDN) to provide our website quickly, reliably and securely.

• Amazon Web Services
  We use the services and infrastructure of Amazon Web Services to operate our website and its components. Provider is Amazon Web Services, EMEA SARL, 38 avenue John F. Kennedy, L-1855, Luxembourg (hereinafter referred to as “Amazon”).
  When you visit our website, Amazon records various logfiles, including your IP addresses. Amazon is used on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in a secure, fast and efficient provision of our website by a professional provider.
  We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
  The data transfer to the United States is based on the Standard Contract Clauses of the EU Commission. You can find the details here: https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/
• Fastly
  We use the Content Delivery Network (CDN) Fastly. Provider is Fastly, Inc., 475 Brannan St 300, San Francisco, United States (hereinafter referred to as “Fastly”).
  Fastly is a globally distributed content delivery network. For the technically necessary transactions, the information transfer between your browser and our website is routed via Fastly's content delivery network. Fastly is used on the basis of our legitimate interest in displaying our website as quickly, uninterrupted, error-free, and secure as possible (Art. 6 (1) (f) GDPR).
  We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
  The data transfer to the United States is based on the Standard Contract Clauses of the EU Commission. You can find the details here: https://www.fastly.com/de/data-processin
  The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail

2.2. Data processing on this website

• When accessing our website, information is automatically transmitted from your browser to us; this includes the name of the website and files that are accessed, the date and time they are accessed, the quantity of data transmitted, reports about successful access, the browser type and version, your operating system, the referrer URL (the page you visited prior to visiting our website), your IP address and the requesting provider.
• The processing of your above-mentioned personal data is technically necessary for offering our website as a service to you and is carried out based on our legitimate interests in accordance with Art. 6 (1) (f) GDPR regarding the operation of our website and, to ensure the safeguarding of the security of the processing (e.g., to prevent and identify cyber-attacks).
• The collection and storage of your personal data in log files is necessary for the provision of the website. For this reason, you may not request the deletion or correction of this data or object to its processing.

2.3. Contacting us

• When you contact us (via contact form, e-mail or telephone) the request including all resulting personal data (name, request, contact details) will be stored and processed by us for the purpose of processing your request.
• This data is processed based on Art. 6 (1) (b) GDPR if the request is related to the fulfillment of an order or is necessary to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR), if applicable.
• Your information may be stored in our customer relationship management systems (“CRM systems”). The legal basis for the further processing of your data is the preparation of a business transaction (in accordance with Art. 6 (1) (f) GDPR).

2.4. Consent Management for data processing and use of cookies

• We use a Consent Management Platform (CMP) called CookieFirst to obtain the legally required consent for the use of cookies and other technologies, e.g. objects in local and session storage, and to legitimize the subsequent data processing via consent, if required. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, The Netherlands. You can find more information here: https://cookiefirst.com
• We use the CMP to fulfill legal obligations. Data processing is based on Art. 6 (1) (c) GDPR.
• In Detail, we use CookieFirst to obtain your valid consent for the use and storage of information on the device you use to access our website as well as for a subsequent data processing via consent, if required, and to properly document this we use a consent management platform.
• When you access our website, a connection is established with CookieFirst’s server to give us the possibility to obtain valid consent from you to the use of certain cookies and information and for data processing on the basis of your consent. CookieFirst then stores a cookie in your browser in order to be able to activate only those cookies and information to which you have consented and to properly document this. The data processed is stored until the predefined storage period expires or you request to delete the data. Certain mandatory legal storage periods may apply notwithstanding the aforementioned.
• Our website and CookieFirst automatically collect and store information in so-called server log files, which your browser automatically transmits to us. The following data is collected:
  1. Your consent status or the withdrawal of consent
  2. Your IP address
  3. Information about your Browser
  4. Information about your Device
  5. The date and time you have visited our website
  6. The webpage URL where you saved or updated your consent preferences
  7. The approximate location of the user that saved their consent preference
  8. A universally unique identifier (UUID) of the website visitor that clicked the cookie banner
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.

2.5. Use of cookies

• We only use non-essential cookies, if you have given your express consent (opt-in) in accordance with Section Art. 5 (3) Directive 2002/58/EC (also known as “ePrivacy Directive” hereinafter referred to as “ePD“) and the respective national law that has implemented Art. 5 (3) ePD, e.g., Section 25 German Telecommunications-Telemedia Data Protection Act (TTDSG). In addition, if you do not want to have cookies or other information stored on your computer you can deactivate the corresponding option in your system settings on their browser. Stored cookies can also be deleted in the browser’s system settings. Disabling cookies or similar technologies may limit the functionalities of this website.
• If you have consented to the storage of cookies and information on your device or to the access to information stored on your device, both activities are carried out on the basis of Section Art. 5 (3) ePD.
• We obtain user-consent to use cookies on all websites within the domain heraeus-comvance.com
• You can change your cookie settings here: https://www.heraeus-comvance.com/en/services/cookie-information/

2.6 Google Tag Manager

• We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”).
• The Google Tag Manager is a tool that we can use either directly in your browser (client-side tagging) or indirectly cloud-based (server-side tagging) to integrate tracking or statistical tools and other technologies on our website. No user profiles are created by the Google Tag Manager itself, no cookies are set or stored and no independent analyzes are carried out. The Google Tag Manager only serves to manage and display the tools integrated via it. When using the Google Tag Manager, however, your IP address is recorded, which can also be transmitted to Google's parent company in the United States.
• With regard to the processing of users' personal data, reference is made to the following information on Google services. You can find usage guidelines here: https://www.google.com/intl/de/tagmanager/use-policy.html
• The Google Tag Manager is used based on your consent under Art. 6 (1) (a) GDPR and Section Art. 5 (3) ePD. The consent can be revoked at any time for the future.

2.7. Google Analytics

• This website uses functions of the web analysis service Google Analytics either directly in your browser (client-side tracking) or indirectly on our webserver (server-side tracking). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”).
  Google Analytics enables the website operator to analyze the behavior of website visitors.
• The website operator receives various usage data, such as page views, length of stay, operating systems used and origin of the user. This data may be summarized by Google in a profile that is assigned to the respective user or their device.
• The aim of using Google Analytics is to enable the user to be recognized for the purpose of analyzing user behavior through the use of various technologies (e.g., cookies or device fingerprinting). We use demographic characteristics for our analyses. The information collected by Google about the use of our website is usually transmitted to a Google server in the USA and stored there.
• The use of Google Analytics is based on your consent according to Art. 6 (1) (a) GDPR and Section Art. 5 (3) ePD. The consent can be revoked at any time for the future.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/. You can object to the collection and storage of data at any time with effect for the future. You can object to the future collection and storage of your data by Google Analytics by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout.
• Data stored by Google at the user and event level that is linked to cookies, user identifiers (e.g., User ID) or advertising IDs (e.g., DoubleClick cookies, Android advertising ID) are anonymized after 26 months or deleted. You can find details on this under the following link: https://support.google.com/analytics/answer/7667196
• You can find more information about the use of data by Google as well as settings and opt-out options on Google’s websites: https://www.google.com/intl/de/policies/privacy/partners (“Use of data by Google when using the websites or apps of our partners”), https://www.google.com/policies/technologies/ads (“Use of data for advertising purposes), https://www.google.de/settings/ads (“Managing information that Google uses to show you advertising”).

2.8 Google Target Audience

• We use Google Analytics (for details please see above) to form target groups, provided you have given your consent to the use of Google Analytics, in order to show the ads that are displayed within the advertising services of Google and its affiliates only to those users who have either shown an interest in our website or who have certain characteristics (e.g., interests in certain topics or products determined from websites visited) and that we have sent to Google (so-called “remarketing” or “Google Analytics Audiences”).
• We use Remarketing Audiences to ensure that our ads correspond to the potential interests of users.
• The data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• You can find more information about the use of data by Google as well as settings and opt-out options on Google’s websites: https://policies.google.com/technologies/partner-sites (“Use of data by Google when using the websites or apps of our partners”), https://www.google.com/policies/technologies/ads (“Use of data for advertising purposes), https://www.google.de/settings/ads (“Managing information that Google uses to show you advertising”).

2.9. Google Display & Video 360

• This website uses functions of Google Display and Video 360 The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”).
• We use the Google online marketing service “Display & Video 360” to place ads in the Google advertising network (e.g., in search results, in videos, on websites, etc.). Display & Video 360 differs from other services in that it shows real time advertisements based on your presumed interests. This allows us to show ads for and within our website in a more targeted manner so that we only show you those ads that potentially correspond to their interests. When you are shown an ad for products that you have been viewing on other websites, this is referred to as “remarketing”. For these purposes, upon accessing our websites and other websites on which the Google Advertising Network is active, Google will immediately run a code and so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") will be incorporated into the website. With their help, an individual cookie, i.e., a small file, will be saved on the user’s device (comparable technologies may also be used instead of cookies). This file keeps a record of which websites you have visited, what content you are interested in and what offers you have clicked on, as well as technical information about the browser and operating system, websites that have referred you, access duration, and other information regarding the use of our website.
• The above information may also be linked with such information from other sources by Google. If you subsequently visit other websites, you may be shown advertisements tailored to your presumed interests on the basis of your user profile.
• Your data is processed pseudonymously within the Google Advertising Network. This means that Google does not store and process, for example, your name or email address but instead processes the relevant data using cookies within the pseudonymous user profile. In other words, from the perspective of Google, the ads are not managed and displayed for a person who is concretely identifiable, but rather for the person with the cookie, irrespective of who this person is. This does not apply if you have expressly permitted Google to process the data without pseudonymization. The information about you collected by Google Marketing Services is transmitted to Google and stored on Google servers in the U.S.
• The use of Google Remarketing is based on your consent according to Art. 6 (1) (a) GDPR and Section Art. 5 (3) ePD. The consent can be revoked at any time for the future.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• You can find more information about the use of data by Google as well as setting and opt-out options in Google’s privacy policy (https://policies.google.com/technologies/ads) as well as the settings for showing ads by Google (https://adssettings.google.com/authenticated).

2.10. Google (re)marketing services

• This website uses functions of Google Analytics Remarketing. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”).
• Google Remarketing analyzes your user behavior while visiting our website in order to classify you into certain advertising target groups in order to show you suitable web messages when you visit other online offers (remarketing or retargeting).
• Furthermore, the advertising target groups created with Google Remarketing can be linked to Google's cross-device functions. In this way, interest-related, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one end device (e.g. mobile phone) can also be displayed on another of your end devices (e.g. tablet or PC).
• If you have a Google account, you can object to personalized advertising using the following link: https://www.google.com/settings/ads/onweb/
• The use of Google Remarketing is based on your consent according to Art. 6 (1) (a) GDPR and Section Art. 5 (3) ePD. The consent can be revoked at any time for the future.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• Further information and the data protection regulations can be found in Google's data protection declaration at: https://policies.google.com/technologies/ads

2.11. Friendly Captcha

• We use the service "Friendly Captcha" (www.friendlycaptcha.com) on our website. The provider is Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany.
• Friendly Captcha is a protective solution designed to make the use of our website by automated programs and scripts (known as "bots") more difficult.
• Friendly Captcha does not set or read any cookies on the visitor's end device. For more information on data protection when using Friendly Captcha, please refer to https://friendlycaptcha.com/legal/privacy-end-users/.
• The legal basis for processing is our legitimate interests in protecting our website from abusive access by bots, including spam protection and defense against attacks (e.g., mass requests), based on Article 6 (1) (f) GDPR.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.

2.12. LinkedIn Lead Gen Form 

• We use the service Lead Gen Forms, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
  Lead Gen Forms are ad placements that allow contact forms to be integrated into sponsored content directly on the platform. We use the data you provide there to process your request for information. This data is transmitted to us by LinkedIn.
• The processing of the data is based exclusively on your consent according to Art. 6 (1) (a) GDPR. You can revoke this consent for the future at any time. For this purpose, a communication by email to heraeus-comvance@heraeus.com is sufficient. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.
• The data you entered will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g., after we have completed processing your request). Mandatory legal provisions - in particular retention periods - remain unaffected.
• The specific purpose of the data processing of the respective Lead Gen Forms is explicitly listed in the context of the advertisement (e.g., sending product information or contacting you for the purpose of answering your inquiry).

2.13. LinkedIn Insight Tag

• We use the service LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter referred to as “LinkedIn”), to measure conversions.This tool creates a cookie on your web browser. We set the cookie exclusively with your consent in accordance with Section Art. 5 (3) ePD. The processing of the data is based exclusively on your consent (Art. 6 (1) (a) GDPR).
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• The cookie enables the collection of data regarding LinkedIn member’s visits on our website including the URL, referrer, IP address, device, and browser characteristics (User Agent), and timestamp. The IP addresses are truncated or hashed (when used for reaching LinkedIn members across devices), and LinkedIn members’ direct identifiers are removed within seven days in order to make the data pseudonymous. This remaining pseudonymized data is then deleted within 180 days.
• LinkedIn does not share any personal data with us but offers anonymous reports on website audience and display performance.
• LinkedIn members can control the use of their personal data for advertising purposes through their account settings: https://www.linkedin.com/psettings/advertising/actions-that-showed-interest
• You u can object to the analysis of user behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
• Further information on data protection at LinkedIn can be found in LinkedIn's data protection information: https://www.linkedin.com/legal/privacy-policy

2.14. LinkedIn Retargeting

• We use the LinkedIn remarketing provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter referred to as “LinkedIn”), to display our advertising to a dedicated target group.
• We use LinkedIn to show the advertisements displayed within LinkedIn advertising services and its affiliates only to those users who have also shown an interest in our website or who have certain characteristics (e.g., interests in specific themes or products that are determined from the websites visited), which we submit to LinkedIn (so-called "remarketing"). We use LinkedIn to ensure that our ads correspond to the potential interests of users.
• In addition, LinkedIn offers the possibility of retargeting via the Insight Tag. We can use this data to display targeted advertising outside of our website without identifying you as a website visitor.
• The processing of the data is based exclusively on your consent (Art. 6 (1) (a) GDPR). You can revoke this consent for the future at any time by changing the cookie settings: https://www.heraeus-comvance.com/en/services/cookie-information/
• LinkedIn members can control the use of their personal data for advertising purposes through their account settings: https://www.linkedin.com/psettings/advertising/actions-that-showed-interest
• Further information on data protection at LinkedIn can be found in LinkedIn's data protection information: https://www.linkedin.com/legal/privacy-policy

2.15. Microsoft Dynamics 365 Cloud for Marketing

• We use the Microsoft Dynamics 365 Cloud for Marketing automation system provided by Microsoft Deutschland GmbH, Walter-Gropius-Straße 5, 80807 Munich, Germany (hereinafter referred to as “Microsoft”) to carry out marketing campaigns, for analysis purposes and for target group-specific contact with customers and potential customers. The data is processed within the European Union.
• In particular, we use the system to send email communications (e.g., in connection with the provision of downloads), for event management (e.g., to manage event participants) and to provide landing pages and contact forms.
• The use of Microsoft and the system, the collection and analysis of statistics and the logging of the registration procedure for communication by email are carried out based on your consent to receive email communication via Microsoft Dynamics 365 Cloud for Marketing according to Art. 6 (1) (a) GDPR, according to Art. 6 (1) (f) GDPR regarding the download of Whitepapers and according to Section Art. 5 (3) ePD regarding the use of cookies. The consent can be revoked at any time for the future. We are interested in a user-friendly and secure system that both serves our business interests and also meets the expectations of users.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
  System components integrated in our website (e.g., forms) use so-called “cookies” that are stored on the user’s computer and enable us to analyze the use of the website.
• In particular, the following information is collected: client ID, geographical location, browser type, duration of the visit and pages accessed.
• Pseudonymized email tracking: The statistical information collected also includes whether the newsletter was opened, when it was opened, and which links you clicked on. While this information can technically be attributed to individual newsletter recipients, the analysis of personal data has been deactivated and information about newsletter recipients is only analyzed pseudonymously and cannot be decrypted and attributed to individual users.
• Double opt-in and recording of data: Subscribing to our newsletter is subject to a so-called double opt-in process. This means that after subscribing for our newsletter you receive an email in which you are asked to confirm your subscription. Such confirmation is necessary to ensure that people do not subscribe using someone else’s email address. The newsletter subscription is logged so the subscription process can be verified in accordance with legal requirements. This includes recording the date and time of the subscription and the confirmation as well as the IP address. The changes to your data saved by the email marketing service provider are also logged.
• Unsubscribe: You can unsubscribe from the newsletter at any time, i.e., you can revoke your consent to receive it. There is an unsubscribe link at the end of each newsletter. Your personal data that has been processed in connection with the mailing of the newsletter will be deleted after you unsubscribe.
• Further data privacy information can be found in the Microsoft privacy policy at https://privacy.microsoft.com/en-US/privacystatement
• Further information about the use of cookies in connection with the system can be found at https://docs.microsoft.com/en-US/dynamics365/marketing/cookies

2.16. YouTube

• We embed videos from the YouTube website. The operator of the YouTube is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
• When you visit a page of our website in which a YouTube video is embedded, YouTube is technically informed which of our pages you have visited.
• YouTube also uses technologies that make it possible to obtain information about visitors to this website. This information is used, among other things, to compile video statistics in order to improve the user-friendliness of the website and prevent attempted fraud.
• If you are logged into your YouTube account while visiting our site, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.
• We use YouTube based on our legitimate interest in an appealing presentation of our website in accordance with Art. 6(1)(f) GDPR. If a corresponding consent has been given, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section Art. 5 (3) ePD, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g., device fingerprinting) within the meaning of the TTDSG. This consent can be revoked at any time with effect for the future.
  Further information on data processing by YouTube can be found in YouTube's data protection regulations: https://policies.google.com/privacy?hl=en

2.17 Wistia

• We embed videos from the Wistia website. The operator of Wistia is Wistia, Inc. 120 Brookline St Cambridge, MA, 02139-4503 United States.
• When you visit a page of our website in which a Wistia video is embedded, Wistia automatically receives and records information on their server logs including data related to media viewing, listening to, or accessing (including when you stop and start media, how many and which media of a particular Wistia customer you watched, and how many times you watched, listened to, or accessed particular media), data related to use of Wistia services, IP address, device, “cookie” information, and the page you requested.
• We use Wistia based on our legitimate interest in an appealing presentation of our website in accordance with Art. 6 (1) (f) GDPR. If a corresponding consent has been given, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and Section Art. 5 (3) ePD, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g., device fingerprinting) within the meaning of the TTDSG. This consent can be revoked at any time with effect for the future.
• Further information on data processing by Wistia can be found in Wistia’s data protection regulations: https://wistia.com/privacy
• The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail

• We use the Microsoft Dynamics 365 CRM system from Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, United States (hereinafter referred to as “Microsoft”) as a cloud service, i.e., the data is processed at Microsoft data centers.
• We use your data solely for the technical processing of requests and we do not disclose the data to third parties.
• In particular, we use the system to manage customers and prospective customers (leads) and to process user requests faster and more efficiently. The use of the system is based on our legitimate interest in accordance with Art. 6 (1) (f) GDPR.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail 
• Further data privacy information can be found in the Microsoft privacy policy at https://privacy.microsoft.com/en-US/privacystatement
   

• We maintain several presences in social networks and platforms in order to be able to communicate with active customers, interested parties and users who are active there and to provide information to users there about our services.
• Please note that user data may be processed outside of the European Union and Switzerland. This may imply risks for users because, for example, it could be more difficult to enforce user rights.
• In addition, user data is generally processed for market research and advertising purposes. For example, user behavior and the resulting information about the user’s interests can be used to create user profiles. The user profiles can, in turn, be used to place advertisements, for example, within and outside of platforms that are supposedly in line with user interests. For these purposes, cookies that record the user’s behavior and interests are generally stored on the user’s computer. In addition, data can also be stored in the user profiles separately from the users' devices (in particular if the users are members of the relevant platforms and are logged in to them).
• The personal data of users is processed on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR in providing effecting information to users and communicating with users. If the users are asked to consent to data processing by the respective providers (i.e., give their consent, for example, by clicking a check box or pressing a button), the legal basis of the processing is consent according to Art. 6 (1) (a) GDPR.
• For a detailed overview of the processing and opt-out options discussed in this paragraph, see the information from the provider in the following links:
  
  Facebook / Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland)
  Privacy policy: https://www.facebook.com/privacy/policy
  Opt-out: https://www.facebook.com/privacy/center
  
  Google / YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
  Privacy policy: https://policies.google.com/privacy  
  Opt-out: https://adssettings.google.com/authenticated
  
  X (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, United States)
  Privacy policy: https://twitter.com/de/privacy
  Opt-out: https://twitter.com/personalization
  
  LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland)
  Privacy policy: https://www.linkedin.com/legal/privacy-policy
  Opt-out: https://www.linkedin.com/psettings/guest-controls
  
  XING (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany)
  Privacy policy/opt-out: https://privacy.xing.com/
   
• Please note that if you are looking for information or asserting your rights, it is best to contact the respective provider directly. Only the providers have access to your data and can take appropriate measures and provide information. You can contact us if you still need assistance.

• We collect feedback from our customers at regular intervals and on various occasions. We use your data to contact you to ask you to take part in the survey. Participation in customer surveys is always voluntary.
• We use the following survey tools (data processors) to conduct customer surveys:
  Survey Monkey software of the provider SurveyMonkey Europe UC (Shelbourne Road, Dublin, Ireland). Please note their privacy policy and find more information about it at the following link: https://en.surveymonkey.com/mp/legal/privacy/  
• The legal basis for data processing is out legitimate interest in accordance with Art. 6 (1) (f) GDPR.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• For the purpose of conducting the survey, in most cases we create an ID for your questionnaire, through which we can assign your answers to a specific process and thus usually also to your person. In doing so, we do not transmit your personal data to the provider of the survey tool. If the invitation to the survey already takes place via the provider's software, we transmit your business contact data to the provider in advance: First name, last name, company name, e-mail address.
• Personal data, e.g., your interest in products, your assessment of your experience with Heraeus or your telephone number for queries, may also be collected in the course of the survey. We will use your answers to continuously improve our offer - if necessary, also in cooperation with you. In the course of this, we will contact you - if there is a reason to do so, for example because you have expressed a wish, a suggestion or an expectation. If, as part of the survey, you take part in a raffle offered by us, we may also use your data to contact you as part of the raffle in order to inform you of any prize that may have been won and to coordinate the further procedure in this regard with you.
• If you would like your answers to be deleted after the survey has started or even after you have sent them, you can inform us of this at any time - for example, in response to your invitation to the survey. We will then immediately delete your answers from the survey tool and - provided they have been forwarded and there are no legal requirements to the contrary - from our systems. Irrespective of this, your data will be deleted at the latest in accordance with the statutory deletion periods stored in our systems.

• We collect feedback from our customers at regular intervals and on various occasions. We use your data to contact you to ask you to take part in the survey. Participation in customer surveys is always voluntary.
• We use the following survey tools (data processors) to conduct customer surveys:
  Dynamics Customer Voice" of the provider Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA) - hereinafter "Microsoft" - as a cloud service.
  Users can find further information on data protection in Microsoft's privacy policy at https://privacy.microsoft.com/en-gb/privacystatement
• The legal basis for data processing is out legitimate interest in accordance with Art. 6 (1) (f) GDPR.
• We have entered into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for the use of the aforementioned service.
• For the purpose of conducting the survey, in most cases we create an ID for your questionnaire, through which we can assign your answers to a specific process and thus usually also to your person. In doing so, we do not transmit your personal data to the provider of the survey tool. If the invitation to the survey already takes place via the provider's software, we transmit your business contact data to the provider in advance: First name, last name, company name, e-mail address.
• Personal data, e.g., your interest in products, your assessment of your experience with Heraeus or your telephone number for queries, may also be collected in the course of the survey. We will use your answers to continuously improve our offer - if necessary, also in cooperation with you. In the course of this, we will contact you - if there is a reason to do so, for example because you have expressed a wish, a suggestion or an expectation. If, as part of the survey, you take part in a raffle offered by us, we may also use your data to contact you as part of the raffle in order to inform you of any prize that may have been won and to coordinate the further procedure in this regard with you.
• If you would like your answers to be deleted after the survey has started or even after you have sent them, you can inform us of this at any time - for example, in response to your invitation to the survey. We will then immediately delete your answers from the survey tool and - provided they have been forwarded and there are no legal requirements to the contrary - from our systems. Irrespective of this, your data will be deleted at the latest in accordance with the statutory deletion periods stored in our systems.

• We reserve the right to change the privacy policy in order to adapt to changes in the legal situation or to changes in our services and data processing. However, this only applies to policies regarding data processing.
• If the consent of the user is required or if elements of the privacy policy contain components of the contract agreed the user, the changes will only be made with the user's consent.
• Users are requested to familiarize themselves regularly with the content of the privacy policy.
  
  Last updated: November 2023
  Version:Heraeus-Comvance-web-1.0