DATA PRIVACY POLICY

Section 1 General

Raffinerie Heide GmbH (“Raffinerie Heide”) appreciates your interest in our company and its products. We only ever process your personal data (e.g. form of address, name, address, email address, telephone number) in compliance with the provisions of German data protection law and European Union (EU) data protection law. You will be informed in the following of the purposes for which data are processed, the categories of processed data, recipients or categories of recipients, legal bases and storage periods as well as about your rights and the data controller. This Data Privacy Policy relates exclusively to our website. If links on our website take you to third-party websites, please find out how your data are used at such websites.

Section 2 Visits to our website and creation of log files

(1) Purpose of processing

Data are stored in log files in order to ensure the functionality of the website.

(2) Categories of data

Our system automatically retrieves data and information from your computer system every time you visit our website. The following data belonging to you may then be collected:

• Information about the type of browser you are using;
• Information about your operating system;
• Information about your internet service provider;
• Your IP address;
• Date and time of your visit to our website;
• Information about the website from which your system has reached our website;
• Information about the website which you access from our website.

The data which we collect on you are stored in our system’s log files. As a rule, these data are not stored with other personal data.

(3) Legal bases

The legal basis for the provisional storage of data and log files is Article 6(1) f) GDPR.

(4) Legitimate interest

We have a legitimate interest in collecting and temporarily storing the stated data as the system must temporarily store the IP address in order to provide the website to your computer. This information is also used to optimise our website and to guarantee the security of our information technology systems. Your log files are not assessed for marketing purposes.

(5) Categories of recipient

Raffinerie Heide, Host Europe

(6) Storage period

The data will be erased or altered in a way that prevents them being assigned to you as soon as they cease to be necessary for the purposes referred to here.

(7) RIGHT TO OBJECT

You have the right under Article 6(1) f) GDPR to object at any time to processing of personal data concerning you on grounds relating to your particular situation.

Section 3 Contact by email or by contact form

(1) Purpose of processing

We will process any personal data which you send to us by email, contact form, etc. to respond to and deal with your inquiries. You are not required to provide us with such personal data. However, we are only able to respond to inquiries by email if you provide us with your email address.

(2) Categories of data

• Your email address;
• Your name;
• Your company;
• Your industry;
• Your telephone number;
• Other data provided by you;
• Your IP address.

(3) Legal bases

a) Any explicit consent you have given us to the processing of your data is legally founded on Article 6(1) a) GDPR. Any declaration of consent may be revoked at any time with effect for the future.

b) The processing of your data for the purpose of implementing pre-contractual measures is legally founded on Article 6(1) b) GDPR.

c) In all other cases (including but not limited to the use of a contact form) the legal basis is Article 6(1) f) GDPR.

(4) Legitimate interest

Our legitimate interest in processing is in communicating with you as promptly as possible and in responding cost effectively to your inquiries.

(5) Categories of recipient

Raffinerie Heide, Host Europe

(6) Storage period

Your data will be erased as soon as it becomes apparent from the circumstances that your inquiry or the matter at hand has been conclusively clarified.

If a contract is made, however, we will store the data required by commercial and tax law for the periods of time stipulated by law, which are normally for ten years (see Section 257 of the German Commercial Code (HGB), section 147 of the German Tax Code (AO)).

(7) RIGHT TO OBJECT

You have the right to object at any time to the processing of data under Article 6(1) f) GDPR when such processing is not undertaken for direct marketing purposes on the grounds of your specific situation. In contrast, you may object to the processing of your data for direct marketing purposes without giving reasons.

Section 4 Registration and login

This website does not provide any registration or login options.

 

Section 5 Web analysis with Google Analytics

This website does neither use Google Analytics nor any other user tracking tools.

 

Section 6 Google Fonts

Our website uses Google Fonts to display content in a uniform way. Google can be reached at Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

However, we have stored the fonts locally on our server (future-heiderefinery.com), so no connection to Google is established when the user loads the page.

 

Section 7 Information about cookies

(1) Purpose of processing

Whenever you use our website, various types of cookies are used and stored on your computer in addition to the data referred to above. Cookies are small text files which are stored on your computer or mobile devices whenever you visit our website. These cookies send us various types of information.

We use the following types of cookie:

• Cookies are sometimes necessary for the proper functioning of our website. By setting cookies we can determine, for example, that you have visited our website, agreed to the cookie policy or which page-language you have chosen.
• Cookies also enable us to provide you user-friendly services which it would simply be impossible to offer without setting cookies.
• Cookies can also be used to analyse the way the website is used. It is then possible, for example, to determine how many users visit the website and what parts of the website could be improved. However, analyses of this kind do not establish any kind of connection between you and the statistics compiled on the basis of the data which are collected. We will inform you if cookies are used to analyse websites.

(2) Legal bases

The legal basis for the processing of these data is Article 6(1) f) GDPR.

(3) Categories of data

• IP address
• Browser data
• User behaviour
• etc.

(4) Legitimate interest

We have a legitimate interest in our website functioning correctly. The user data collected by technically essential cookies are not used to create user profiles. Your interest in data protection is safeguarded.

(5) Categories of recipient

Raffinerie Heide, Host Europe

(6) Storage period

These cookies are required for technical reasons and are usually erased when the browser is closed. Persistent cookies expire after different lengths of time, ranging from a few minutes to several years. We use the data collected by cookies for as long as required for the purpose for which they have been collected.

(7) RIGHT TO OBJECT

Cookies will be stored on your computer. You can decide whether you want to erase the cookies from your computer at any time. You can change the settings in your browser to determine yourself whether the transmission of cookies from your computer to us should be disabled, restricted or whether the cookies should be completely erased. If you disable all the cookies from our website, you may no longer be able to use all the website functions in full.

Here you can change the previously taken cookie decision: change cookie settings

The following list provides further information about disabling cookies or managing your cookie settings in the browser which you are using:

•        Safari: http://help.apple.com/safari/mac/8.0/#/sfri11471

•        Google Chrome: https://support.google.com/chrome/answer/95647?hl=en

•        Internet Explorer / Edge: http://windows.microsoft.com/en-GB/windows-vista/Block-or-allow-cookies

•        Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

 

Section 8 YouTube

(1) Purpose of processing

We use YouTube plugins to integrate videos in the website. YouTube is provided by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”), represented by Google Inc. which has its registered office in 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Your browser establishes a direct connection with YouTube servers whenever you play a video on a page on our website which contains a YouTube plugin. The content of the plug-in is transmitted by YouTube directly to your browser and integrated in the website. When the content is integrated, YouTube receives the information that your browser has visited the relevant page of our website. This information (including your IP address) is transmitted by your browser directly to a YouTube server in the USA where it is stored. If you are also logged in as a YouTube member, YouTube will associate this information with your personal YouTube account. When you use the plug-in (e.g. by clicking the Start button of a video), this information is likewise assigned to your user account.

Wherever possible we will make use of the youtube-nocookie-domain wich allows the integration of Videos without the need of setting YouTube-cookies.

(2) Legal bases

The legal basis for using YouTube is Article 6(1) f) GDPR.

(3) Categories of data

• IP address
• Browser information
• Contents played

(4) Legitimate interest

We use YouTube to be able to show you video contents. Raffinerie Heide has a legitimate interest in showing videos on its website.

(5) Categories of recipient

YouTube

(6) Transfer to third countries

YouTube also processes your personal data in the USA and is subject to the EU-US Privacy Shield for this purpose: www.privacyshield.gov/EU-US-Framework.

(7) Storage periods

We will only process your data for as long as is necessary to fulfil the purpose for which they have been collected.

(8) RIGHT TO OBJECT

You can prevent assignment by logging out of YouTube and other YouTube LLC and Google Inc. offers and deleting these companies’ cookies from your browser before using our website. You also have the right to object at any time to the processing of data under Article 6(1) f) GDPR when such processing is not undertaken for direct marketing purposes on the grounds of your specific situation. In contrast, you may object to the processing of your data for direct marketing purposes without giving reasons.

Further information about data processing by YouTube (Google) is available at www.google.de/intl/en/policies/privacy/

 

Section 9 Newsletter 

This website does not provide any Newsletter-options.

 

Section 10 Disclosure to third parties

1.     General information

As a rule, we will only pass on your personal data in compliance with the applicable data protection laws to service providers, business partners and other third parties. We may disclose personal data to service providers working on our behalf and require them to perform services in our name (order processing). In this context we comply with stringent national and European data protection regulations. We may also disclose personal data to a third party if we are required to do so by law or in legal proceedings or in order to supply and manage our products and services. We may also be required to provide information to law enforcement agencies or other public authorities. We are also authorised to release data if the disclosure of information is necessary for the purposes of collaboration and thus for providing Raffinerie Heide’s services to you or if you declare your consent to such disclosure.

2.     Host Europe

(1) Purpose of processing

Our website and therefore also your data are hosted by Host Europe GmbH, Hansestrasse 111, 51149 Cologne, Germany (referred to in the following as “Host Europe”). Host Europe may only use the data in accordance with our instructions (order processing). Host Europe also adopts stringent technical measures to protect your personal data. Host Europe does not pass on your personal data to third parties unless this is necessary in order to perform the agreed services or if Host Europe is required to do so by law or to comply with a valid and mandatory instruction issued by a government or regulatory authority. The data provided for this purpose are kept to a minimum.

The purpose of processing data is that Host Europe enables us to use Host Europe servers.

(2) Categories of data

All categories processed by us.

(3) Legal bases

The legal basis for the processing of your data is Article 28 GDPR and Article 6(1) f GDPR.

(4) Legitimate interest

We have a legitimate interest in using the services of Host Europe in order to run our business properly.

(5) Categories of recipient

Raffinerie Heide, Host Europe, other recipients named in this declaration.

(6) Storage period

We only store the data for as long as is necessary to achieve this purpose and until any statutory retention periods have expired.

(7) RIGHT TO OBJECT

You have the right to object at any time to the processing of data under Article 6(1) f) GDPR at any time when such processing is not undertaken for direct marketing purposes on the grounds of your specific situation. Please note that in such cases you may no longer be able to use our website. In contrast, you may object to the processing of your data for direct marketing purposes without giving reasons.

Further information about data protection by Host Europe is available at: https://www.hosteurope.de/AGB/Datenschutzerklaerung/

 

Section 11 Rights of data subjects

If your personal data are processed, you are the data subject within the meaning of the GDPR and you have the following rights vis-à-vis the data controller (Raffinerie Heide):

1. Right of access (see Article 15 GDPR)

You can ask the controller to confirm whether or not we process your personal data.

If we do process your personal data, you have the right to be provided with the following information by the controller:

(1) The purposes for which personal data are processed

(2) The categories of personal data which are processed

(3) The recipients and/or the categories of previous or current recipients of your personal data

(4) The period for which it is planned that your personal data will be stored or, if no specific data are available in this respect, criteria for the stipulation of such period

(5) The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing

(6) The right to lodge a complaint with a supervisory authority

(7) All available information about the origin of data if the personal data is not collected from the data subject

(8) The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to ask for information about whether the relevant personal data are transferred to an international organisation or third country. In this connection you have the right to demand information about suitable guarantees in accordance with Article 46 GDPR in connection with such transfer.

2. Right to rectification (Article 16 GDPR)

You have a right to require that the controller rectify and/or complete any of your personal data which are incorrect or incomplete. The controller must rectify incorrect data immediately.

3. Right to restriction of processing (Article 18 GDPR)

You have the right to demand that the processing of your personal data is restricted in the following circumstances:

(1) if you dispute the accuracy of the personal data relating to you for long enough for the controller to verify whether or not the personal data is correct;

(2) the processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of the use of the personal data;

(3) the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or

(4) you have objected to processing pursuant to Article 21(1) GDPR pending verification of whether the legitimate grounds cited by the controller override the grounds cited by you.

If the processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

You will be informed that processing has been restricted in compliance with the above requirements before such restriction is lifted.

4. Right to data erasure (Article 17 GDPR)

a) Obligation to erase data

You have the right to obtain from the controller the immediate erasure of your personal data and the controller is then obliged to erase this personal data immediately where one of the following grounds applies:

(1) Your personal data are no longer required for the purposes for which they were collected or otherwise processed.

(2) You withdraw the consent on which the processing is based in accordance with Article 6(1) a) or Article 9(2) a) GDPR and there are no other legal grounds for the processing.

(3) You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.

(4) Your personal data have been unlawfully processed.

(5) Your personal data have to be erased in compliance with a legal obligation in Union or Member State law to which the controller is subject.

(6) Your personal data have been collected in relation to the offer of information society services in accordance with Article 8(1) GDPR.

b) Notification of third parties

Where the controller has made your personal data public and is obliged in accordance with Article 17(1) GDPR to erase the personal data, the controller must take reasonable steps, taking account of available technology and the cost of implementation, including technical measures to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of such personal data.

c) Exceptions

There is no right to erasure if the processing is necessary

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health in accordance with Article 9(2) h) and i) as well as Article 9(3) GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR insofar as the right referred to in a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(5) for the establishment, exercise or defence of legal claims.

5. Right to notification (Article 19 GDPR)

If you have asserted your right to rectification, erasure or restriction of processing to the controller, the controller must communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

6. Right to data portability (Article 20 GDPR)

You have the right to receive the personal data concerning you which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, provided that

(1) the processing is based on consent in accordance with Article 6(1) a) GDPR or Article 9(2) a) GDPR or a contract in accordance with Article 6(1) b) GDPR and

(2) the processing is carried out by automated means.

In exercising this right you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This right must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to the processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. RIGHT TO OBJECT (Article 21 GDPR)

You have the right, based on grounds relating to your particular situation, to object at any time to the processing of your personal data in accordance with Article 6(1) e) or f) GDPR; this also applies to any profiling based on these provisions. The controller may then no longer process the personal data relating to you unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or demonstrates that the data must be processed for the establishment, exercise or defence of legal claims. If your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing purposes; this also includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

 

8.  Right to revoke declaration of consent under data protection law (Article 7 GDPR)

You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawal of consent does not prejudice the lawfulness of processing based on previous consent given prior to its revocation.

9.  Automated decision in specific cases, including profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for entering into or performing a contract between you and the controller;

(2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

(3) has been made with your explicit consent.

However, such decisions must not be based on special categories of personal data referred to in Article 9(1) GDPR unless Article 9(2) a) or g) GDPR applies and suitable measures to safeguard your rights and freedoms and your legitimate interests are in place.

In the cases referred to in (1) and (3), the controller must implement suitable measures to safeguard your rights and freedoms and your legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged must inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.

 

The controller responsible for data processing is:

Raffinerie Heide GmbH

Meldorfer Straße 43

25770 Hemmingstedt

Telephone: +494816930

info@heiderefinery.com

 

How to contact our data protection officer:

Raffinerie Heide GmbH

Data Protection Officer

Meldorfer Straße 43

25770 Hemmingstedt

Datenschutzbeauftragter@heiderefinery.com

 

This Data Privacy Statement has been drawn up and is continuously updated by Raffinerie Heide GmbH.