LOBA GmbH & Co. KG Privacy Statement
The provisions of the EU General Data Protection Regulation (hereinafter referred to as ‘GDPR’) apply throughout Europe. We would like to inform you about how our company processes personal data in accordance with this regulation (see Articles 13 and 14 GDPR). If you have questions or comments about this Privacy Statement, you can send them at any time to the e-mail address provided in Section 1.2 or 1.3.
Table of contents:
1. Overview
1.1 Scope
1.2 Data controller
1.3 Data protection officer
2. Data processing in detail
2.1 General information about data processing
2.2 Viewing our website
2.3 Tracking to analyse and optimise our services and their use
2.4 Applications
2.5 Customer support
2.6 Means of contact
2.7 Competitions
2.8 Reference projects
2.9 Online surveys
2.10. Social media presence
3. Data subject rights
3.1 Right to object
3.2 Right of access
3.3 Right to rectification
3.4 Right to erasure (‘right to be forgotten’)
3.5 Right to restriction of processing
3.6 Right to data portability
3.7 Right to withdraw consent
3.8 Right to appeal
1. Overview
This section of the Privacy Statement contains information about the scope, the data controller, and the data protection officer.
1.1 Scope
This page provides information about the type, scope, and purpose of the personal data collected by our company, which is processed both when you visit this website and in the context of other processing for which we are responsible and which is not related to this website.
1.2 Data controller
The data controller, i.e. the person who determines the purpose of the personal data and the means of processing it within the framework of its processing.
LOBA GmbH & Co. KG
Leonbergerstr. 56–62
71254 Ditzingen, Germany
Tel. +49 (0) 7156-357 0
Fax +49 (0) 7156-357 211
service@loba.de
General partner: LOBA-Beteiligungsges.mbH, 71254 Ditzingen, Germany, District Court HRB 203642
Managing Partners: Alfred Melka, Mario Probst
Court: Registry Court Stuttgart HRA 201336
VAT ID: DE146020279
1.3 Data protection officer
Our data protection officer can be reached as follows:
Contact form:
https://www.dsextern.de/anfragen
DS EXTERN GmbH
Dipl.-Kfm. Marc Althaus
Frapanweg 22
22589 Hamburg, Germany
2. Data processing in detail
This section of the Privacy Statement provides detailed information about the processing of personal data. For better clarity, we have structured this information according to specific functions.
2.1 General information about data processing
Unless otherwise stated, the following applies to all processing described below:
2.1.1 No obligation to provide data
There is neither a contractual nor a legal obligation to provide personal data. You are not obliged to provide data.
2.1.2 Consequences of the non-provision of data
In the case of required data (data that is marked as mandatory), failure to provide this data means that the service in question cannot be provided. Otherwise, failure to provide the data may mean that our services cannot be provided in the same form and quality.
2.1.3 Transfer to government authorities
We transfer personal data to government authorities (including law enforcement agencies) only if this is necessary to fulfil a legal obligation to which we are subject (legal basis: Art. 6 para. 1 c) GDPR) or if it is necessary for the assertion, exercise, or defence against legal claims (legal basis: Art. 6 para. 1 f) GDPR).
2.1.4 Storage period
We do not store your data any longer than needed for our specific processing purposes. When the data are no longer needed, they are deleted regularly, unless their temporary retention is still necessary. Reasons for this may be, for example, the following:
- The fulfilment of retention obligations under commercial and tax law.
- The preservation of evidence for legal disputes within the framework of statutory limitation provisions.
2.1.5 Categories of recipients
In addition to the categories of recipients explicitly listed below, personal data are also transferred to the following categories of recipients: shipping service providers, telephone and fax providers.
2.1.6 Data categories
- Personal master data: title, form of address/gender, first name, last name, date of birth.
- Address data: street, house number and, if necessary, supplements to the address, postal code, city, country.
- Contact data: telephone number(s), fax number(s), e-mail address(es).
- Traffic data: date and time of the website visit; traffic sources; pages viewed during use; data for session identification (session ID); in addition, the following information of the accessing computer system: Internet Protocol address used (IP address), browser type and version, device type, operating system, and similar technical information.
- Application data: resume, references, supporting documents, work samples, certificates, pictures.
- Company personal data: company name, e.g. for sole proprietors or one-person limited liability companies, if the company name is identical to the name of the natural person standing behind it.
- Survey data: personal opinions, preferences, ratings.
2.2 Viewing our website
This section describes how we process your personal data when you view our website.
Data category: traffic data.
Purpose: to establish a connection, display the contents of the service, detect attacks on our site based on unusual activity, and to troubleshoot.
Legal basis: to preserve legitimate interests (Art. 6 para. 1f GDPR).
Legitimate interest, if applicable: proper functioning of the services, security of data and business processes, prevention of misuse, prevention of damage due to tampering with information systems.
Storage period: 7 days.
Recipients:
a. IT security service providers, hosting service providers, consent tool providers.
b. Providers of embedded content, YouTube, Google Maps and Google Fonts.
Relevant data: all of the above data.
Transfer to third countries:
a. No
b. Yes
Recipient in third country: Google LLC (USA)
Guarantee according to Art. 44 ff. GDPR: standard contractual clauses.
2.3 Tracking to analyse and optimise our services and their use
The following describes how your personal data are processed using tracking technologies to analyse and optimise our services and for advertising purposes.
The description of the tracking methods also includes information about how you can prevent or object to the processing of your data. Please note that what is known as ‘opt-out’, i.e. the refusal of processing, is usually stored via cookies. If you use our services on a new terminal device or in a different browser, or if you have deleted the cookies set by your browser, you will have to declare the opt-out again.
Purposes of processing
The analysis of user behaviour by means of tracking helps us to verify the effectiveness of our services, to optimise them, and adapt them to the needs of users, as well as to troubleshoot.
Tracking to measure the success of advertising campaigns is used to optimise our future ads.
Legal basis for data processing
Consent according to Art. 6 para. 1 lit. a) GDPR.
Information on the tracking methods used can be found in the consent tool.
2.4 Applications
If an application process is ongoing, we process your personal data in the following ways:
Data category:
a. Personal master data.
b. Address data, contact data.
c. Application data.
Purpose:
a. Identification, means of contact, age verification. b. Identification, means of contact, communication of contract initiation.
c. Applicant selection.
Legal basis:
a. + b. + c. Section 26 German Federal Data Protection Act (BDSG) (new) in conjunction with Art. 88 GDPR.
Legitimate interest, if applicable: -
Storage period: 6 months after the end of the application process.
Recipients: if applicable, other departments within our company, hosting service providers (applicant management software).
Relevant data: all of the above data.
Transfer to third countries: no.
2.5 Technical service
Information about how we process your personal data when you contact our technical service can be found here:
Data category:
a. Personal master data, contact data.
b. Content of requests.
Purpose:
a. + b.Processing of requests.
Legal basis:
a. Contract (Art. 6 para. 1b GDPR).
b. Preservation of legitimate interests (Art. 6 para. 1f GDPR).
Legitimate interest, if applicable:
a. –
b. Customer loyalty, service improvements.
Storage period: processing the request.
Recipients: if applicable, other departments within our company, hosting service providers for e-mail.
Relevant data: all of the above data.
Transfer to third countries: no.
2.6 Means of contact
Information about how we process your personal data when you contact us by phone, in writing, or by e-mail:
Data category: personal master data, contact data, content of requests.
Purpose: processing of requests.
Legal basis: to preserve legitimate interests (Art. 6 para. 1f GDPR).
Legitimate interest, if applicable: communication, processing of requests.
Storage period: processing the request.
Recipients: if applicable, other departments within our company, hosting service providers for e-mail.
Relevant data: all of the above data.
Transfer to third countries: no.
2.7 Competitions
We hold competitions from time to time. Information about how we process your personal data when you participate in our competitions can be found here. The relevant terms of participation apply.
Data category: personal master data, address data.
Purpose: execution of the competition, notification of successful participants, sending of the prizes.
Legal basis: contract (Art. 6 para. 1 1b GDPR).
Legitimate interest, if applicable: -
Storage period: max. 6 months after the end of the competition.
Recipients: personal data are only passed on internally.
Relevant data: all of the above data.
Transfer to third countries: no.
2.8 Reference projects
Our website gives you the opportunity to provide us with photos and videos depicting reference projects for publication. In doing so, we process personal data from you as described below. Please note: photos and videos in which persons are depicted will not be published.
Data category
a. Personal master data, address data.
b. Company personal data.
Purpose:
a. Personalization of consent granted via the web form to prove that consent was given.
b. Publication of the processor data.
Legal basis:
a. Contract (Art. 6 para. 1f GDPR)
b. Consent (Art. 6 para. 1a GDPR).
Legitimate interest, if applicable:
a. See Purpose
b. -
Storage period:
a. Unlimited to meet accountability requirements.
b. Until consent is withdrawn.
Recipients: hosting service providers, advertising agencies.
Relevant data: all of the above data.
Transfer to third countries: no.
2.9 Online surveys
We conduct online surveys from time to time. In these surveys, the data are usually pseudonymised, i.e. the identity of an individual person cannot be directly inferred from the survey data. However, in connection with a competition (see Section 2.7 above), a direct reference to a person may arise. In this case, disclosure of the personal data described therein as part of the online survey is the trade-off for participation in the competition.
Data category: traffic data, survey data.
Purpose: to conduct the online surveys to gather customer information that is meaningful to the company.
Legal basis:
a. For pseudonymous surveys (no direct identification of participants): preservation of legitimate interests (Art. 6 para. 1f GDPR)
b. In connection with competitions and direct identification of participants: contract (Art. 6 para. 1b GDPR).
Legitimate interest, if applicable
a. To conduct the online surveys to gather customer information that is meaningful to the company while preserving the pseudonymity of the participants
b. -
Storage period: after evaluating the responses and compiling the survey results.
Recipients: hosting service providers for survey application.
Relevant data: all of the above data.
Transfer to third countries: no.
2.10. Social media presence
2.10.1 Facebook
We manage a fan page at https://www.facebook.com/www.loba.de on the social media network Facebook, which is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5 Ireland (‘Meta’). Facebook’s privacy policy can be found here: https://www.facebook.com/about/privacy.
Every time you view or interact with our Facebook page, your personal data are processed, regardless of whether you have a Facebook account or not. If you view our Facebook fan page whilst you are logged into your Facebook account, Meta and/or its associated companies may connect the information relating to your website visit with your account information and may, in some cases, use it to build profiles. If you do not want such a profile to be built, please log out of your Facebook account before viewing our Facebook fan page.
Meta provides us with statistical data about how our fan page is used via its Facebook Insights feature. This information consists of data such as gender, age range, location, page views, interactions and information on paid activities, reach, accounts reached, impressions and impressions per day. It is important to note that we cannot attribute this data to specific individuals who visit our Facebook page. The legal basis for our use of data generated by Facebook Insights is Art. 6 para. 1 f) GDPR, whereby our legitimate interests are to make our Facebook presence more attractive and to provide it with targeted content.
As we are jointly responsible with Meta for the processing of your data on our Facebook page, we have concluded an agreement with Meta which can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum. As the data subject, you are entitled to the rights set out in Section 3 of this Privacy Statement. You are free to exercise these rights either against us (cf. Section 1.3 above) or against Meta directly at https://www.facebook.com/help/contact/540977946302970. If you decide to exercise your rights against us, we will forward your requests there as per our agreement with Meta.
2.10.2 Instagram
We manage an account at https://www.instagram.com/loba_on_top/ on the social media platform Instagram.com, which is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5 Ireland (“Meta“). Instagram’s privacy policy can be found here: https://help.instagram.com/519522125107875/.
Every time you view or interact with our Instagram page, your personal data are processed, regardless of whether you have an Instagram or Facebook account or not. If you view our Instagram page whilst you are logged into your Facebook account, Meta, as the operator of Instagram, and/or its associated companies, may connect the information relating to your website visit with your account information and may, in some cases, use it to build profiles. If you do not want such a profile to be built, please log out of your account before viewing our Instagram page.
Meta provides us with statistical data about how our page is used via its Instagram Insights feature. This information consists of data such as gender, age range, location, page views, interactions and information on paid activities, reach, accounts reached, impressions and impressions per day. It is important to note that we cannot attribute this data to specific individuals who visit our Instagram page. The legal basis for our use of data generated by Instagram Insights is Art. 6 para. 1 f) GDPR, whereby our legitimate interests are to make our Instagram presence more attractive and to provide it with targeted content.
As we are jointly responsible with Meta for the processing of your data on our Instagram page, we have concluded an agreement with Meta which can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum.
As the data subject, you are entitled to the rights set out in Section 3 of this Privacy Statement. You are free to exercise these rights either against us (cf. Section 1.3 above) or against Meta directly at https://help.instagram.com/contact/186020218683230. If you decide to exercise your rights against us, we will forward your requests there as per our agreement with Meta.
2.3.3 XING
We manage a profile on the social media network XING, which can be found here: https://www.xing.com/pages/lobagmbh-co-kg/. XING is operated by New Work SE, Am Strandkai 1, 20547 Hamburg, Germany. Information about the type of personal data that are processed by XING when you visit our profile and for what purposes can be found at https://privacy.xing.com/de/datenschutzerklaerung. Our company does not collect any of your personal data when you visit our XING profile.
2.3.4 LinkedIn
We manage a page on the social media network LinkedIn, which can be found here: https://www.linkedin.com/company/loba-on-top/. LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Information about the type of personal data that are processed by LinkedIn when you visit our page and for what purposes can be found at https://www.linkedin.com/legal/privacy-policy.
Every time you view or interact with our LinkedIn page, your personal data are processed, regardless of whether you have a LinkedIn account or not. If you view our LinkedIn page whilst you are logged into your LinkedIn account, the operator LinkedIn may connect the information relating to your website visit with your account information and may, in some cases, use it to build profiles. If you do not want such a profile to be built, please log out of your account before viewing our LinkedIn page.
LinkedIn provides us with statistical data about how our page is used via its Page Insights feature. This information consists of data such as gender, age range, location, page views, interactions and information on paid activities, reach, accounts reached, impressions and impressions per day. It is important to note that we cannot attribute this data to specific individuals who visit our LinkedIn page. The legal basis for our use of data generated by Page Insights is Art. 6 para. 1 f) GDPR, whereby our legitimate interests are to make our LinkedIn presence more attractive and to provide it with targeted content.
As we are jointly responsible with LinkedIn for the processing of your data on our LinkedIn page, we have concluded an agreement with LinkedIn which can be viewed here:
https://legal.linkedin.com/pages-joint-controller-addendum.
As the data subject, you are entitled to the rights set out in Section 3 of this Privacy Statement. You are free to exercise these rights against us (cf. Section 1.3 above). If you decide to exercise your rights against us, we will forward your requests to LinkedIn as per our agreement with them.
2.10.5 YouTube
We manage a channel on the social media network YouTube, which can be found here: https://www.youtube.com/@LOBAOnTop1922. YouTube is operated by Google Ireland Limited with headquarters in Gordon House, Barrow Street, Dublin 4, D04E5W5, Ireland. Information about the type of personal data that are processed by YouTube when you visit our channel and for what purposes can be found at https://policies.google.com/privacy?hl=de.
Google provides us with statistical data about how our channel is used via its YouTube Analytics feature. This information consists of data such as reach (e.g. unique and cumulative impressions, page views, click rates and behaviour, origins of clicks, traffic sources inside and outside YouTube (e.g. internet searches, YouTube playlists)), interactions with our content (e.g. traffic, viewing time for specific content and average viewing time, the most viewed and most effective content, the most important comments on our content, and time of viewing) and statistical base data about our audience (e.g. accounts reached, gender, age range, location, use of and interaction with push notifications (YouTube’s bell symbol), and other viewed or subscribed channels and videos).
It is important to note that we cannot attribute this data to specific individuals who visit our YouTube channel. The legal basis for our use of data generated by YouTube Analytics is Art. 6 para. 1 f) GDPR, whereby our legitimate interests are to make our YouTube presence more attractive, to provide it with targeted content and to advertise our YouTube content to specific target groups.
You can find detailed information on the type of YouTube Analytics features we use from the service provider at https://support.google.com/youtube/answer/9002587?hl=en#zippy=%2Creach%20%2Coverview%2Cengagement%2Caudience%2Crevenue.
Every time you view or interact with our YouTube channel, your personal data are processed, regardless of whether you have a YouTube account or not. If you view our YouTube channel whilst you are logged into your YouTube account, the operator Google may connect the information relating to your website visit with your account information and may, in some cases, use it to build profiles. If you do not want such a profile to be built, please log out of your account before viewing our YouTube channel.
2.10 E-mail newsletter
This section sets out how we process your personal data if we send our newsletter to you by e-mail. You can unsubscribe from the newsletter at any time, for example by sending an e-mail to service@loba.de.
Data category:
a. Contact data (e-mail address)
. b. Personal master data.
Purpose:
a. Sending out the newsletter.
b. Personalisation of the newsletter.
Legal basis:
a. + b. Preservation of legitimate interests (Art. 6 para. 1f GDPR).
Legitimate interest:
Informing our regular customers about products from and additions to our range while observing the requirements of Section 7 para. 3 of the German Act Against Unfair Competition (UWG).
Storage period: until the customer unsubscribes from our newsletter.
Recipients: if applicable, other departments within our company, hosting service providers for e-mail.
Relevant data: all of the above data.
Transfer to third countries: no.
3. Data subject rights
3.1 Right to object
You have the right to object at any time with future effect to the processing of personal data relating to you that is carried out pursuant to Article 6 para. 1 e) or f) GDPR on grounds that arise from your particular situation.
You can exercise the right to object free of charge.
3.2 Right of access
You have the right to be informed as to whether personal data concerning you are being processed by us, which personal data these are, if any, and to receive further information in accordance with Art. 15 GDPR.
3.3 Right to rectification
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you (Art. 16 GDPR). Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
3.4 Right to erasure (‘right to be forgotten’)
You have the right to obtain from us the erasure of personal data concerning you without undue delay, where one of the grounds named in Article 17 para. 1 GDPR applies and the processing is not necessary for one of the purposes regulated in Article 17 para. 3 GDPR.
3.5 Right to restriction of processing
You are entitled to obtain a restriction in the processing of your personal data where one of the conditions regulated in Art. 18 para. 1 a) to d) GDPR applies.
3.6 Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. Furthermore, you have the right to transmit those data to another controller without hindrance from us or to have the data transmitted directly by us, if this is technically feasible. This shall always apply if the basis for the data processing is consent or a contract and the data are processed automatically. Accordingly, this does not apply to data available only in paper form.
3.7 Right to withdraw consent
Where processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
3.8 Right to appeal
You have the right to lodge a complaint with a supervisory authority.
Last revised: 16/01/2024
