Privacy Policy

Data protection is very important to us. With this privacy policy, we would like to inform you about your rights regarding personal data. We would also like to inform you about the type, scope, and purpose of the data we collect and process:

1.1 The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Company: Leidel & Kracht Schaumstoff-Technik GmbH

Managing Director: Dr. Kay Nowak / E. Nowak

Address: Cottbuser Str. 1, 51063 Cologne, Germany

Email:info@lk-thermo.de

Phone: +49 221 97726-0

Contact details of the data protection officer within the meaning of the GDPR:

Email dpo.leidel-kracht@fgnd-core.eu

Address: Kelvinstr. 14, 50996 Cologne, Germany

Website: www.fgnd-core.de

Phone: +49 (0) 2236 / 490 90 80

If you have any questions or suggestions regarding data protection, please contact our data protection officer directly at any time.

1.2 Rights as a data subject (summary)

You have the right to obtain information from us about what data we have stored about you. If the data we have stored is incorrect, you can request that it be corrected or, if necessary, deleted. You can also request that this data be blocked so that it can only be processed by us with your consent.

You also have the right to object to the further processing of your data at any time for reasons arising from your particular situation. Furthermore, if you wish, we will make the data you have provided us with available to you for further use. We will also forward it to a recipient designated by you upon request.

Furthermore, you have the right to revoke your consent to the processing of your personal data at any time. The legality of the processing carried out until the revocation remains unaffected.

You also have the right to lodge a complaint with a supervisory authority. The relevant addresses can be found on the website of the Federal Commissioner for Data Protection and Freedom of Information (BFDI): https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

1.3 Purpose of processing personal data, legal basis, and storage period

We only process personal data of our users to the extent necessary to provide a functional website and our content and services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law.

The legal basis is generally the consent of the user in accordance with Art. 6 para. 1 lit. a of the General Data Protection Regulation (GDPR), unless and to the extent that prior consent could not be obtained and the processing of the data is permitted by law.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary for the fulfillment of a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights, and freedoms of the data subject do not override the aforementioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for processing.

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

1.4 Website

When you visit our website, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's IP address
• Date and time of access

The data is also stored in our system's log files. This data is not stored together with other personal data of the user. The hosting services we use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, security services, and technical maintenance services that we use for the purpose of

In doing so, we or our hosting provider process inventory data, contact data, content data, usage data, and meta and communication data of visitors to this online offering on the basis of our legitimate interests in the efficient and secure provision of this online offering.

We also use the Ynfinite Consent Manager as a cookie banner with functions in accordance with the "Cookies" section, as well as video embedded privacy to ensure the so-called two-click solution and to prevent data transfers without consent and knowledge. For further information, please contact us.

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website – for this purpose, the server log files must be collected.

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

Storage in log files is done to ensure the functionality of the website. The data also helps us optimize the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 para. 1 lit. f GDPR.

The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or anonymized so that it is no longer possible to assign them to the requesting client.

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, there is no possibility for the user to object.

1.5 Use of cookies

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

We use cookies to make our website more user-friendly. Some elements of our website require that the browser can be identified even after a page change.

The following data is stored and transmitted in the cookies:

• Essential cookies

We use Ynfinite Consent Manager to manage cookies.

When a user first visits the website, this plugin creates a field in which the user can specify their cookie settings. This information is then stored as a permanent cookie with a duration of one year. Furthermore, the standard temporary PHP session cookie is stored on the server, but this expires as soon as the client browser is closed the next time.

Temporary cookies, also known as "session cookies" or "transient cookies," are cookies that are deleted after a user leaves an online offering and closes their browser. Such cookies can store, for example, the contents of a shopping cart in an online shop or Cookies that remain stored even after the browser is closed are referred to as "permanent" or "persistent" cookies. This allows, for example, the login status to be stored when users visit the site after several days.

We also use cookies on our website that enable us to analyze the surfing behavior of users after they have given their consent:

• Matomo

Purpose and function at a glance:

• Collection of user movement data on the website to improve the quality of the website.
• Evaluation to improve the findability of the website.

This allows the following data to be transmitted:

(1) Frequency of page views

(2) Use of website functions

When visiting our website, users are informed about the use of cookies for analysis and marketing purposes and their consent to the processing of personal data used in this context is obtained. In this context, reference is also made to this privacy policy.

Further cookies are processed by the providers in the event of a login via social networks after your express consent by registering with the respective services, e.g. for Microsoft, see https://docs.microsoft.com/en-us/azure/active-directory-b2c/cookie-definitions and for Google, see https://developers.google.com/analytics/devguides/collection/gajs/cookie-usage.

We have no influence or access to this, as these services process the data for their own purposes.

1.5.1 Legal basis

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR.

The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 para. 1 lit. a GDPR, provided that the user has given their consent.

1.5.2 Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

We use cookies for the following applications:

1. Consent management
2. Analysis

The user data collected by technically necessary cookies is not used to create user profiles.

Analytics cookies are used to improve the quality of our website and its content. Analytics cookies tell us how the website is used through so-called page views, enabling us to continuously optimize our offering.

These purposes also constitute our legitimate interest in the processing of personal data in accordance with Art. 6 (1) lit. f GDPR in conjunction with the consent of the users in accordance with Art. 6 (1) lit. a GDPR.

1.5.3 Duration of storage, objection and removal options

Cookies are stored on the user's computer and transmitted to our site. As a user, you therefore have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may not be possible to use all functions of the website to their full extent.

Data protection regulations & cookie guidelines of the individual providers at a glance:

1.6 YouTube videos

We use YouTube on our website. This is a video portal operated by YouTube LLC, 901 Cherry Ave., 94066 San Bruno, CA, USA ("YouTube").

YouTube is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

We use YouTube in conjunction with the "Extended Data Protection Mode" function to display videos to you. The legal basis for this is Art. 6 (1) lit. f) GDPR. Our legitimate interest lies in improving the quality of our website. According to YouTube, the "Extended Data Protection Mode" function ensures that the data described in more detail below is only transmitted to YouTube's server when you actually start a video.

Without this "extended data protection," a connection to the YouTube server in the USA is established as soon as you visit one of our Internet pages on which a YouTube video is embedded.

This connection is necessary to display the respective video on our website via your Internet browser. In the course of this, YouTube will collect and process at least your IP address, the date and time, and the website you visited. In some cases, a connection to Google's "DoubleClick" advertising network is established.

If you are logged in to YouTube at the same time, YouTube will assign the connection information to your YouTube account. If you wish to prevent this, you must either log out of YouTube before visiting our website or adjust the settings in your YouTube user account accordingly.

For the purposes of functionality and to analyze usage behavior, YouTube permanently stores cookies on your device via your Internet browser. If you do not agree to this processing, you can prevent the storage of cookies by adjusting the settings in your Internet browser. Further information on this can be found above under "Cookies."

Further information on the collection and use of data, as well as your rights in this regard and options for protection, can be found in Google's privacy policy at

https://policies.google.com/privacy.

Opt-out: https://adssettings.google.com/authenticated.

1.7 Google Maps and social media buttons

We use Google Maps on our website. These are services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

We only use Google Maps with your prior consent, which you can give when you access the website. The legal basis is Art. 6 para. 1 lit. a) GDPR. You can also revoke your consent at any time via the settings in the cookie banner or under "Cookie settings."

1.8 Third-party content from other websites

It may happen that content or services from third-party providers are integrated into our online offering. The integration of third-party content always requires that the third-party providers use an IP address, as they cannot send the content to the browser without the IP address. Third-party content providers may therefore set their own cookies and process the data for their own purposes.

In any case, direct access is prevented on our side by the software used to manage cookies and third-party content providers. If you notice that third-party providers are attempting to access your computer, please contact us and we will look into the matter immediately.

If you activate third-party content, such content will also be loaded from the third-party providers' web servers when you visit the website and technically necessary data will be transmitted. If the third-party content contains cookies, these will also be activated. We try to implement third-party content in a way that minimizes data collection.

Otherwise, you can leave our website and open a new page from an external content provider. In this case, we refer you to the respective privacy policies of the respective sites and ask you to observe the relevant information.

1.9 Contact form and email contact

1.9.1 Description and scope of data processing

Our website contains a contact form that can be used to contact us electronically. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.

This data includes:

• Email
• Name
• Date and time of access

When the message is sent, the following data is also stored:

(1) The user's IP address (see log files)

(2) Date and time of registration (see log files)

Your consent is obtained for the processing of the data during the sending process and reference is made to this privacy policy. Alternatively, you can contact us via the email address provided. In this case, the personal data of the user transmitted with the email will be stored.

In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation.

1.9.2 Legal basis for data processing

The legal basis for the processing of data is Art. 6 para. 1 lit. a GDPR if the user has given their consent.

The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 para. 1 lit. f GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

1.9.3 Purpose of data processing

The processing of personal data from the input mask is used solely for the purpose of processing the contact request. In the event of contact by email, this also constitutes the necessary legitimate interest in the processing of the data.

The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

1.9.4 Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data from the input mask of the contact form and data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

The personal data collected additionally during the sending process will be deleted after a period of seven days at the latest. We review the necessity of this every two years. Furthermore, the statutory retention obligations apply.

1.9.5 Right to object and right to erasure

The user has the right to withdraw their consent to the processing of their personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of establishing contact will be deleted in this case.

2.1 Rights of the data subject

Data subjects are entitled to the following rights under the GDPR. If you, as a data subject, wish to exercise one or more of these rights, you can contact our data protection officer or another employee of the controller at any time.

2.1.1 Right to withdraw consent to data processing

As a data subject, you have the right to withdraw your consent to the processing of personal data at any time with effect for the future. To do so, simply send us an email or other written statement. You can send your revocation to, for example: info@lk-thermo.de or info@lk-verpackung.de

2.1.2 Right to information

As a data subject, you have the right to obtain, free of charge, information from the controller about the personal data stored about you and a copy of the personal data. The right to information concerns the following information:

• the purposes of the processing
• the categories of personal data being processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
• if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
• the existence of a right to rectify or erase personal data concerning them or to restrict processing by the controller or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• if the personal data is not collected from the data subject: all available information on the origin of the data
• the existence of automated decision-making, including profiling, pursuant to Art. 22 I and IV GDPR and — at least in these cases — meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Furthermore, data subjects have the right to obtain information on whether personal data has been transferred to a third country or to an international organization. If this is the case, you also have the right to obtain information about the appropriate safeguards in connection with the transfer.

2.1.3 Right to rectification

As a data subject, you have the right to request the immediate rectification of inaccurate personal data concerning you. You also have the right to request the completion of incomplete personal data, taking into account the purposes of the processing, including by means of a supplementary statement.

2.1.4 Right to erasure ("right to be forgotten")

As a data subject, you have the right to request that your personal data be deleted immediately if one of the following reasons applies and if the processing is not necessary:

• The personal data has been collected or otherwise processed for purposes for which it is no longer necessary (i.e., the data is no longer needed).
• The data subject withdraws consent on which the processing is based in accordance with Art. 6 I a GDPR or Art. 9 II a GDPR, and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Art. 21 I GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 II GDPR.
• The personal data has been processed unlawfully.
• The erasure of the personal data is necessary for compliance with a legal obligation to which the controller is subject under Union law or the law of the Member States.
• The personal data was collected in relation to information society services offered in accordance with Article 8 I GDPR.

If the personal data has been made public by Leidel & Kracht and our company is obliged to delete the personal data in accordance with Art. 17 I GDPR, we will take appropriate measures, taking into account the available technology and implementation costs, to inform other controllers who process the published personal data, in particular for the purpose of deletion to inform other data controllers who process the published personal data, in particular to delete all links to this personal data or copies or replicas of this personal data, unless processing is necessary. The data protection officer of Leidel & Kracht or another employee will take the necessary steps in individual cases.

2.1.5 Right to restriction of processing

As a data subject, you have the right to request the restriction of processing if one of the following conditions is met:

• You contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, you refuse to have the personal data erased and instead request the restriction of the use of the personal data.
• The controller no longer needs the personal data for the purposes of processing, but you require it for the assertion, exercise, or defense of legal claims.
• You have objected to the processing pursuant to Art. 21 I GDPR and it is not yet clear whether the legitimate reasons of the controller outweigh yours.

2.1.6 Right to data portability

As a data subject, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to have this data transferred to another controller without hindrance from the controller, provided that the processing is based on consent pursuant to Art. 6 I a GDPR or Art. 9 II a GDPR or on a contract pursuant to Art. 6 I b GDPR and the processing is carried out using automated procedures or if the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising your right to data portability in accordance with Art. 20 I GDPR, you have the right to have the personal data transmitted directly from us to another controller, provided that this is technically feasible and does not affect the rights and freedoms of other persons.

2.1.7 Right to object

As a data subject, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out for the purposes of the legitimate interests pursued by the controller.

This also applies to profiling based on these provisions, whereby Leidel & Kracht points out that it does not carry out profiling.

Leidel & Kracht will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.if Leidel & Kracht processes personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data for such purposes.

If Leidel & Kracht processes personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If you object to Leidel & Kracht processing your data for direct marketing purposes, we will no longer process your personal data for these purposes.

2.1.8 Automated individual decision-making, including profiling

As a data subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision

• is not necessary for the conclusion or performance of a contract between you and the controller, or
• is authorized by Union or Member State law to which the controller is subject and that law provides for appropriate measures to safeguard your rights and freedoms and legitimate interests, or
• with your express consent.

Leidel & Kracht does not use purely automated decision-making systems that have legal effects on you or significantly affect you in a similar way with regard to the processing of personal data.

2.1.9 Right to lodge a complaint with a supervisory authority

As a data subject, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes data protection regulations. The relevant addresses can be found on the website of the Federal Commissioner for Data Protection and Freedom of Information (BFDI): https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

2.2 Definitions

With the development of data protection law, terms have become established that are not always self-explanatory. The explanations in Art. 4 GDPR are quoted in excerpts below:

„personal data“ means any information relating to an identified or identifiable natural person (hereinafter referred to as „data subject“); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an individual number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of such natural person, can be identified;

"Processing" means any operation or set of operations which is performed on personal data or on sets thereof, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction;

"Restriction of processing" means the marking of stored personal data with the aim of restricting their future processing;

"Profiling" means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. „Pseudonymization“ means processing of personal data by which the personal data can no longer be attributed to a specific natural person without the use of additional information; this additional information must be kept separate from the personal data

"Pseudonymization" means processing personal data in such a manner that the personal data can no longer be attributed to a specific data subject without using additional information, provided that this additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.separately and subject to technical and organizational measures that ensure that the personal data will not be associated with an identified or identifiable natural person; […]

"Controller" means the natural or legal person, public authority, agency, or other body that alone or jointly with others determines the purposes and means of the processing of personal data; if the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for his or her designation may be provided for by Union law or the law of the Member States;

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

"recipient" means a natural or legal person, public authority, agency or other body which receives personal data, whether or not those data are disclosed to it. However, public authorities that may receive personal data in the course of a specific investigation under Union or Member State law are not considered recipients; the processing of such data by those authorities is carried out in accordance with the applicable data protection rules in accordance with the purposes of the processing;

"Third party" means a natural or legal person, public authority, agency, or other body, other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor, are authorized to process personal data.

"Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by such clear affirmative action, signifies agreement to the processing of personal data relating to him or her by which the data subject indicates his or her agreement to the processing of personal data relating to him or her;

"Breach of personal data protection" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to personal datathat has been transmitted, stored or otherwise processed.