Privacy

I. Name and address of the data controller
The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states of the EU as well as other data protection regulations is:

Damasko GmbH 
Unternehmenszweig Präzisionsteilefertigung
Unterheising 17c
93092 Barbing, Germany
Telephone: +49 9401 80481
Fax: +49 9401 80482
Email: info@damasko.de
 
II. General information on data processing
1. Scope to which personal data is processed
As a matter of principle, we only process personal data of our users insofar as this is necessary to provide a functional website as well as our content and services. Personal data of our users are as a rule processed only with the consent of the user. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by legal regulations.

2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 para. 1 lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary to perform a contract to which the data subject is a party, Article 6 para. 1 lit. b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to perform pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Article 6 para. 1 lit. c GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person make it necessary to process personal data, Article 6 para. 1 lit. d GDPR serves as the legal basis.
If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the aforementioned interest, Article 6 para. 1 lit. f GDPR serves as the legal basis for said processing.

3. Erasure of data and retention period
The personal data of the data subject will be deleted or blocked as soon as the purpose of storing it no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the data controller is subject. The data will also be blocked or erased if a retention period prescribed by the aforementioned regulations expires, unless there is a need to keep the data for the conclusion or performance of a contract.
 
III. Provision of the website and creation of log files
1. Description and scope of data processing
Our system automatically collects data and information about the respective computer each time our website is accessed.
The following data is collected:
•    Information about the browser type and version used
•    The user’s operating system
•    The user’s internet service provider
•    The user’s IP address
•    Date and time of access
•    Websites from which the user’s system accesses our website
•    Websites that are accessed by the user’s system via our website
 
The data is also stored in our system’s log files. This data is not stored together with other personal data of the user.

2. Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Article 6 para. 1 lit. f GDPR.

3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the website to be rendered on the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.
Data is stored in log files so as to ensure the functionality of the website. We also use the data to optimise the website and to safeguard the security of our information technology systems. The IP addresses are only stored in order to be able to effectively defend against server attacks by excluding IP addresses. Data is not evaluated for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing according to Article 6 para. 1 lit. f GDPR.

4. Retention period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. Where data has been collected to render the website, this is the case when the respective session has ended.
Where data has been stored in log files, this is the case after seven days at the latest. Data may be stored beyond this limits. In this case, the IP addresses of the users are erased or anonymised to prevent access being attributed to a specific client.

5. Possibility of objection and elimination
It is indispensable to collect data in order to render the website and to store data in log files in order to operate the website. This means that there is no possibility for the user to object.
 
IV. Use of cookies
1. Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.
We use cookies to make our website more user-friendly. Some elements of our website require that the browser accessing it can be identified even after moving to another site.
The following data is stored and transmitted in the cookies:
•    Language settings
•    Items in a shopping basket
•    Log-in information
 
We also use cookies on our website that enable the user’s surfing behaviour to be analysed. The following data can be transmitted in this way:
•    Regional origin of the user
•    Information about the browser type and version used
•    User’s operating system
•    User’s device
•    Date and time of access
•    Websites from which the user’s system accesses our website
•    User behaviour on our website
•    Information about user orders
 
The user data collected in this way is pseudonymised using technical protocols, preventing data from being attributed to the user accessing the website. The data is not stored together with other personal data of the users.
When accessing our website, users are informed by a pop-up notification about the use of cookies for analytical purposes and referred to this privacy statement. Information is also provided here about how to deactivate the storage of cookies in the browser settings.

2. Legal basis for data processing
The legal basis for the processing of personal data using cookies is Article 6 para. 1 lit. f GDPR.

3. Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some of our website functions cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised again even after moving away to different site.
We need cookies for the following applications:
•    Ensuring the authenticity of the transmitted user data
•    Adapting how the website is displayed on the user’s device
•    Assigning the contents of a shopping basket and customer data to a user
 
The user data collected through technically necessary cookies are not used to create user profiles.
The analytics cookies are used for the purpose of improving the quality of our website and its content. The analytics cookies enable us to learn how the website is used and thus to constantly optimise our offer. The analytics cookies serve the following purposes:
•    Improving our website from a technical point of view
•    Improving our website in terms of user experience
•    Optimising our product range
•    Market analysis
•    Optimising the security of our website
 
These purposes also constitute our legitimate interest in the processing of personal data according to Article 6 para. 1 lit. f GDPR.

4. Retention period, possibility of objection and elimination
Cookies are stored on the user’s computer and transmitted to our site by the user, which means you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing your internet browser settings. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.
 
V. Newsletter
1. Description and scope of data processing
You may subscribe to a free newsletter on our website. When registering for the newsletter, the user’s email address is transmitted.
Processing data for sending newsletters does not involve passing the e-mail address on to third parties. The e-mail address will only be used for sending the newsletter.

2. Legal basis for data processing
The legal basis for the processing of data when a user signs up for the newsletter is Article 6 para. 1 lit. a GDPR, if the user has given their consent.

3. Purpose of data processing
The user’s email address is collected and used to deliver the newsletter.

4. Retention period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. The user’s email address is therefore stored for as long as the subscription to the newsletter is active.
5. Possibility of objection and elimination
The newsletter subscription can be cancelled by the respective user at any time. There is a corresponding link for this purpose in every newsletter.
 
VI. Registration / Order
1. Description and scope of data processing
We offer users the opportunity to register on our website by providing personal data. If the user wishes to order without registering, personal data will still be collected. The data is entered in a form, whereupon it is transmitted to us and stored. Such data will not be passed on to third parties. The following data is collected as part of the process for registering and/or placing an order:
•    Private or corporate client
•    Salutation
•    First name
•    Last name
•    E-mail address
•    Your chosen password for future logins to our website (only if registering)
•    Telephone number
•    Your address
•    a different delivery address, if applicable
 
2. Legal basis for data processing
Since the purpose of collecting data is either to conclude a contract or to perform a contract to which the user is a party, or to carry out pre-contractual measures, the legal basis for the processing of the data is Article 6 para. 1 lit. b GDPR. Insofar as an order for goods is not placed once a user has voluntarily registered, the legal basis is also Article 6 para. 1 lit. f GDPR.

3. Purpose of data processing
User data is collected and stored to perform the contract of sale with the user or to carry out pre-contractual measures. Registration data inaccordance with VII.1. a. to i. above is (also) stored to make future orders or post-contractual enquiries more convenient for the user. Such data then does not have to be entered again by the user. The user can also visit our website without registering in order to obtain information about our range of goods.

4. Retention period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected.
This is the case for data collected during the ordering process to perform a contract or to carry out pre-contractual measures when the data is no longer required for executing the contract.
Even after the contract has been concluded, there may be a need to store personal data of the contractual partner in order to comply with contractual or legal obligations.
Registration data in accordance with VII.1. a. to i. above is (also) stored to make future orders or post-contractual enquiries more convenient for the user. This registration data is only erased when the user cancels the registration, cf. 5 below.

5. Possibility of objection and elimination
As a user, you have the option of cancelling your registration at any time. You can have the data stored about you changed at any time.
The data can be changed in the “My account” area. The corresponding buttons take the user to the forms for changing personal data, the payment method, the billing address and the delivery address.
It is not possible for the user to delete the account by themselves. The request for deletion must be sent either by post, e-mail or fax to the address indicated in I. above.
Insofar as the data is required for performing a contract or for carrying out pre-contractual measures, data may only be deleted prematurely insofar as there are no contractual or legal obligations to the contrary.
 
VII. Contact form and e-mail contact
1. Description and scope of data processing
A contact form is available on our website, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the online form will be transmitted to us and stored. This data comprises:
•    Salutation
•    First name
•    Last name
•    E-mail address
•    if voluntarily provided: Telephone number
•    Subject chosen by the user
•    Comment entered by the user
 
It is also possible to contact us via the e-mail address provided. In this case, the user’s personal data transmitted by e-mail will be stored.
Such data will not be passed on to third parties but used exclusively for processing the conversation.

2. Legal basis for data processing
The legal basis for the processing of data transmitted when using the contact form or sending an e-mail is Article 6 para. 1 lit. f GDPR. If the purpose of the contact is to conclude a contract, the additional legal basis for the processing is Article 6 para. 1 lit. b GDPR.

3. Purpose of data processing
The processing of personal data from the online form or an e-mail serves solely as a way for us to process the contact. This also constitutes the necessary legitimate interest in processing the data.

4. Retention period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data entered into the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified.

5. Possibility of objection and elimination
The user is able to revoke their consent to the processing of personal data at any time. If the user contacts us by e-mail, they can object to their personal data being stored at any time. In such a case, the conversation cannot be continued.
Please send your revocation or your objection by post, e-mail, or fax to the address stated above under I.
Any personal data stored in the course of contact with us will be deleted in this case.
 
VIII. Forwarding of data to third parties

1. Scope of the forwarding of personal data
We forward the address data of a registered user who has placed an order to the delivery service commissioned by us, usually DHL or DPD, for the purpose of delivering the ordered goods (salutation, first name, surname, street, address suffix if applicable, postcode and city) and, if the user has given their consent, for the purpose of providing progress updates for the delivery (info@damasko.de). As part of the ordering process, the user’s consent is obtained for their e-mail address to be forwarded for the purpose of tracking the delivery. The name of the user who has placed an order and the bank details and/or credit card details may also be passed on to our bank for the purpose of processing payment, e.g. after an order has been cancelled for the purpose of refunding the purchase price.

2. Legal basis for the forwarding of personal data
The legal basis for the processing of the data is Article 6 para. 1 lit. a GDPR if the user has given their consent. Insofar as transferring personal data to third parties is necessary to perform a contract to which the data subject is a party, Article 6 para. 1 lit. b GDPR serves as the legal basis.

3. Purpose of forwarding of personal data
The purpose of forwarding personal data to third parties is to perform the contract concluded with the user or to increase the quality of the delivery process.

4. Retention period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. This is the case when the contract with the user has been performed. Data that the user has transmitted to us in the course of registration remains stored with us, cf. above. VI.

5. Possibility of objection and elimination
As a user, you have the option of cancelling your registration at any time. You can have the data stored about you changed at any time.
Insofar as the data is required for performing a contract or for carrying out pre-contractual measures, data may only be deleted prematurely insofar as there are no contractual or legal obligations to the contrary.
Please send your revocation or your objection by post, e-mail, or fax to the address stated above under I.
 
IX. Web analysis using Google Analytics
We use Google Analytics, a web analytics service provided by Google, Inc (“Google”). Google Analytics uses cookies, which are text files placed on your computer, to help the website analyse how you use the site. The information generated by the cookie about the use of this website by visitors to the site is generally transmitted to a Google server in the United States and stored there.
However, in the event that IP anonymisation is activated on this website, your IP address will be truncated beforehand by Google before leaving Member States of the European Union or other signatories to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. IP anonymisation is active on this website. Such anonymisation means that the data here is not personal data (anymore).
Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage for us.
The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You may reject the use cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.
You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available under the following link:
https://tools.google.com/dlpage/gaoptout?hl=en
As an alternative to the browser plugin or for browsers on mobile devices, you can click on the following link to set an opt-out cookie that will prevent Google Analytics from collecting data on this website in the future (this opt-out cookie only works in this browser and only for this domain. If you delete the cookies in your browser, you must click this link again): Deactivate Google Analytics
 
X. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the data controller:
 
1. Right to information
You may request confirmation from the data controller as to whether personal data relating to you is being processed by us.
If this is the case, you may request information from the data controller about the following:
(1) the purposes for which the personal data is processed;
(2) the categories of personal data which is processed;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
(4) the planned retention period of the personal data relating to you or, if specific information on this is not possible, criteria for determining the retention period; 
(5) the existence of a right to rectify or erase personal data concerning you, a right to have processing by the data controller restricted or a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) any available information on the origin of the data if the personal data is not collected from the data subject;
(8) the existence of any automated decision-making process, including profiling, pursuant to Article 22 para. 1 and para. 4 GDPR and, at least in these cases, meaningful information about the algorithms involved and the scope and intended effects of such processing for the data subject. 
You have the right to request information on whether personal data concerning you is transmitted to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with any such transmission.

2. Right to rectification
You have a right of rectification and/or completion vis-à-vis the controller insofar as the personal data processed concerning you is inaccurate or incomplete. The data controller must carry out such rectification withoutdelay.

3. Right to restriction of processing
You may request the restriction of the processing of personal data concerning you under the following conditions:
(1) if you contest the accuracy of the personal data concerning you for a period enabling the data controller to verify the accuracy of the personal data;
(2) if the processing is unlawful and you oppose theerasure of the personal data and request the restriction of its use instead;
(3) the data controller no longer needs the personal data for the purposes of processing, but you need them for the establishment, exercise, or defence of legal claims; or 
(4) if you have objected to the processing pursuant to Article 21 para. 1 GDPR pending the verification whether the legitimate grounds of the data controller override those of you.
Where processing of your personal data has been restricted, such personal data may, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the data controller before the restriction is lifted. 

4. Right to erasure
a) Obligation to erase
You may request the data controller to erase the personal data concerning you without delay and the controller is obliged to erase such data without delay where one of the following grounds applies: 
(1) The personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
(2) You withdraw your consent on which the processing was based according to Article 6 para. 1 lit. a or Article 9 para. 2 lit. a GDPR and where there is no other legal basis for the processing.
(3) You object to the processing according to Article 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21 para 2 GDPR.
(4) The personal data concerning you has been unlawfully processed.
(5) The personal data concerning you has to be erased for compliance with a legal obligation under European Union or Member State law to which the data controller is subject.
(6) The personal data concerning you has been collected in relation to the offer of information society services referred to in Article 8 para. 1 GDPR. 
b) Information to third parties
Where the data controller has made public the personal data concerning you and is obliged pursuant to Article 17 para. 1 GDPR to erase this personal data, the data controller, taking account of available technology and the cost of implementation, must take reasonable steps, including technical measures, to inform data controllers which are processing the personal data that you as a data subject have requested the erasure by such data controllers of any links to, or copy or replication of, this personal data. 
c) Exceptions
The right to erasure does not exist insofar as processing is necessary 
(1) to exercise the right to freedom of expression and information;
(2) for compliance with a legal obligation which requires processing under European Union or Member State law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Article 9 para. 2 lit. h and i as well as Article 9 para. 3 GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 para. 1 GDPR insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise, or defence of legal claims.

5. Right to be informed
If you have asserted the right to rectification, erasure, or restriction of processing against the data controller, the data controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed of these recipients by the data controller.

6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the data controller to whom the personal data was provided, where:
(1) the processing is based on consent pursuant to Article 6 para. 1 lit. a GDPR or Article 9 para. 2 lit. a GDPR or on a contract pursuant to Article 6 para. 1 lit. b GDPR; and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one data controller to another, where technically feasible. The right referred to above must not adversely affect the rights and freedoms of others.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. 

7. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6 para. 1 lit. e or f GDPR, including profiling based on these provisions.
The data controller will no longer process the personal data concerning you unless the data controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims.
Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. Any such revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:
(1) is necessary for entering into, or performance of, a contract between you and the data controller;
(2) is authorised by European Union or Member State law to which the data controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) is based on your explicit consent.
However, these decisions must not be based on special categories of personal data referred to in Art. 9 para. 1 GDPR, unless Article 9 para. 2 lit. a or g GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
In the cases referred to in (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, comprising at least the right to obtain human intervention on the part of the data controller, to express your point of view, and to contest the decision. 

10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

 

Last updated: 10 March 2023