Privacy Policy

Responsible Party

Boss Lubricants GmbH
Chemnitzer Str .15
72458 Albstadt/Germany

Authorized representative: Rainer Gunsch-Boss

Email address: SM_DE47_vertrieb@fuchs.com

Phone: +49 7431 – 701818 0

 

Overview of data processing activities

The following overview summarizes the types of data processed and the purposes of such processing, and identifies the data subjects.

Types of data processed

  • Master data.
  • Employee data.
  • Contact data.
  • Content data.
  • Usage data.
  • Meta, communication, and process data.
  • Log data.

 

Categories of data subjects

  • Beneficiaries and clients.
  • Employees.
  • Communication partners.
  • Users.
  • Third parties.
  • Whistleblowers.

 

Purposes of processing

  • Communication.
  • Security measures.
  • Audience measurement.
  • Organizational and administrative procedures.
  • Feedback.
  • Profiles containing user-related information.
  • Provision of our online services and user-friendliness.
  • IT infrastructure.
  • Whistleblower protection.

 

Relevant legal basis

Relevant legal bases under the GDPR: The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or where we are headquartered. Furthermore, should more specific legal bases apply in individual cases, we will inform you of these in the Privacy Policy.

  • Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.
  • Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request.
  • Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) – processing is necessary to safeguard the legitimate interests of the controller or a third party, provided that the interests, fundamental rights, and fundamental freedoms of the data subject that require the protection of personal data do not take precedence.

National Data Protection Regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (BDSG). The BDSG contains, in particular, special provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, data transfers, and automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.

 

Provision of the online service and web hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to deliver the content and features of our online services to the user’s browser or device.

  • Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Log data (e.g., log files regarding logins, data retrieval, or access times).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Providing our online services and ensuring user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Security measures.
  • Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

 

Further information on processing operations, procedures, and services:

  • Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity, and software that we rent or otherwise obtain from a corresponding server provider (also known as a “web host”); legal basis: legitimate interests (Art. 6(1)(f) GDPR).
  • Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. The server log files may include the address and name of the websites and files accessed, date and time of access, amounts of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used for security purposes, e.g.B. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks), and on the other hand to ensure the utilization of the servers and their stability; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further storage is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
  • ALL-INKL: Services related to the provision of information technology infrastructure and associated services (e.g., storage space and/or computing capacity); Service provider: ALL-INKL.COM – Neue Medien Münnich, Proprietor: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://all-inkl.com/; Privacy policy: https://all-inkl.com/datenschutzinformationen. Data processing agreement: Provided by the service provider.

 

Use of cookies

The term “cookies” refers to functions that store information on users’ devices and retrieve it from them. Cookies serve various purposes, such as ensuring the functionality, security, and usability of online services, as well as analyzing visitor traffic. We use cookies in accordance with legal requirements. Where necessary, we obtain prior user consent. If consent is not required, we rely on our legitimate interests. This applies when storing and retrieving information is essential to provide expressly requested content and functions—for example, saving settings or ensuring the functionality and security of our online services. Consent may be withdrawn at any time. We provide clear information regarding the scope of consent and the specific cookies used.

Notes on legal bases under data protection law: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. In the absence of consent, we rely on our legitimate interests, as explained earlier in this section and in the context of the respective services and procedures.

Storage duration: With regard to storage duration, a distinction is made between the following types of cookies:

  • Temporary cookies (also known as session cookies): Temporary cookies are deleted no later than when a user leaves an online service and closes their device (e.g., browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the device is closed. This allows, for example, login status to be saved and preferred content to be displayed directly when the user revisits a website. Likewise, user data collected via cookies can be used to measure reach. Unless we provide users with explicit information regarding the type and storage duration of cookies (e.g., when obtaining consent), they should assume that these cookies are permanent and that the storage duration may be up to two years.

 

General information on revocation and objection (opt-out): Users may revoke the consent they have given at any time and also object to the processing in accordance with legal requirements, including by using their browser’s privacy settings.

  • Types of data processed: Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

 

Further information on processing operations, procedures, and services:

  • Complianz: Storage and management of consents (agreement to cookies and data processing), logging of user choices, display of notices regarding data protection and cookies, enabling users to withdraw or adjust consents; Service provider: Execution on servers and/or computers under the provider’s own data protection responsibility; Website: https://complianz.io/; Privacy policy: https://complianz.io/legal/. Further information: An individual user ID, language, types of consents, and the time they were given are stored on the server side and in a cookie on the user’s device.

 

Contact and inquiry management

When you contact us (e.g., by mail, contact form, email, telephone, or via social media) or within the scope of existing user and business relationships, the information provided by the inquiring persons is processed to the extent necessary to respond to inquiries and any requested measures.

  • Types of data processed: Contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts, as well as information relating to them, such as details regarding authorship or time of creation); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
  • Affected persons: Communication partners.
  • Purposes of processing and legitimate interests: communication; organizational and administrative procedures; feedback (e.g., collecting feedback via an online form). Provision of our online services and user-friendliness.
  • Storage and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR). Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR).

 

Further information on processing operations, procedures, and services:

  • Contact form: When you contact us via our contact form, by email, or through other communication channels, we process the personal data transmitted to us in order to respond to and handle your specific inquiry. This generally includes details such as your name, contact information, and any other information you provide that is necessary for properly processing the request. We use this data exclusively for the stated purpose of contact and communication; legal bases: performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

 

Web analytics, monitoring, and optimization

Web analytics (also referred to as “reach measurement”) are used to analyze visitor traffic to our online services and may include data regarding visitor behavior, interests, or demographics—such as age or gender—in the form of pseudonymous values. Reach analysis allows us, for example, to identify when our online services—or specific functions and content—are used most frequently or to determine what encourages repeat visits. It also enables us to identify areas that require optimization.

In addition to web analytics, we can also employ testing methods—for instance, to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles—i.e., data aggregated regarding a specific usage event—may be created for these purposes, and information may be stored in a browser or on a device and subsequently retrieved. The data collected includes, in particular, websites visited and elements used on them, as well as technical information such as the browser and computer system used and details regarding usage times. Provided that users have consented to the collection of their location data—either by us or by the providers of the services we employ—the processing of location data is also possible.

In addition, users’ IP addresses are stored. However, we employ an IP masking process (i.e., pseudonymization by truncating the IP address) to protect users. Generally, no personally identifiable user data (such as email addresses or names) is stored in the context of web analytics, A/B testing, and optimization; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the users’ actual identities, but only the information stored in their profiles for the purposes of the respective processes.

Information on legal bases: Where we ask users for their consent to the use of third-party providers, consent constitutes the legal basis for data processing. Otherwise, user data is processed on the basis of our legitimate interests (i.e., an interest in efficient, economical, and recipient-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this privacy policy.

  • Types of data processed: Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Reach measurement (e.g., access statistics, recognition of returning visitors); profiles containing user-related information (creation of user profiles). Provision of our online services and user-friendliness.
  • Storage and Deletion: Deletion in accordance with the details in the section “General Information on Data Storage and Deletion.” Cookie storage of up to 2 years (unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: Consent (Art. 6(1) sentence 1(a) GDPR). Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

 

Further information on processing operations, procedures, and services:

  • Google Analytics: We use Google Analytics to measure and analyze the use of our online services based on a pseudonymous user identification number. This identification number does not contain unique data such as names or email addresses. It serves to associate analytical information with a specific device in order to identify which content users have accessed—whether during a single session or across multiple sessions—as well as the search terms used, content revisited, and interactions with our online services. Additionally, the time and duration of usage are recorded, along with the sources referring users to our online services and technical details regarding their devices and browsers.
    In this process, pseudonymous user profiles are created using information derived from the use of various devices, potentially involving the use of cookies. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides approximate geographic location data by deriving the following metadata from IP addresses: city (and the city’s derived latitude and longitude), continent, country, region, and sub-continent (along with their ID-based counterparts). For EU traffic, IP address data is used exclusively to derive this geolocation information before being immediately deleted; the data is not logged, remains inaccessible, and is not used for any other purpose. When Google Analytics collects measurement data, all IP requests are processed on EU-based servers before the traffic is forwarded to Analytics servers for further processing;
    Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms); Option to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and processed data).