Privacy Policy
Below, we inform you about how we process personal data when you use our online shop and our digital services, as well as in connection with contact, customer accounts, orders, delivery, payment processing and customer service.
1. Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Helmut Zerrle Schweißtechnik-Großhandel GmbH
Meierweg 6
86154 Augsburg
Germany
Telephone: 0821 298299-0
Fax: 0821 298299-29
Email: zerrle@zerrle.com
Website: www.zerrle.com
Registered office: Augsburg
Registration court: Augsburg Local Court (Amtsgericht Augsburg)
HRB 7851
VAT ID: DE239120454
2. Data Protection Contact
For questions about the processing of your personal data, the exercise of your rights as a data subject, or this privacy policy, you can contact us at any time using the contact details listed above.
Please send data protection enquiries to us with the subject line "Datenschutz".
Where a data protection officer has been appointed, their contact details are published separately or provided on request.
3. Basic Terms
Personal data is any information relating to an identified or identifiable natural person. This includes in particular name, address, email address, telephone number, customer number, order data, payment data, IP address, login data and usage data.
Processing means any handling of personal data, in particular the collection, recording, storage, organisation, use, transmission, provision, alignment, restriction, erasure or destruction.
4. Legal Bases for Processing
We process personal data only where there is a legal basis for doing so. Depending on the operation, the following legal bases in particular may apply:
- Art. 6(1)(a) GDPR – consent, for example for cookies that are not technically necessary or for newsletter registration.
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures, for example for customer accounts, enquiries, quotations, orders, delivery and customer service.
- Art. 6(1)(c) GDPR – legal obligation, in particular commercial, tax and accounting obligations.
- Art. 6(1)(f) GDPR – legitimate interest, for example in IT security, the prevention of misuse, direct marketing towards existing customers, process optimisation and the economic management of the shop.
5. Accessing the Online Shop and Server Log Files
When you access our online shop, technical data that your browser or your device transmits to our systems or to integrated technical service providers is automatically processed. This may include in particular:
- the IP address of the requesting device,
- the date and time of access,
- the URL and file accessed,
- the access status / HTTP status code,
- the volume of data transferred,
- the referrer URL,
- the browser type and browser version,
- the operating system and device information.
The processing serves the technical provision of the online shop, ensuring its stability, security and functionality, and error analysis.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and economic operation of our online shop.
Server log files are, as a matter of principle, only stored for as long as is necessary for the stated purposes. Longer storage may take place where this is necessary to investigate security incidents, misuse or technical faults.
6. Cookies, Device Access and Consent
Our online shop uses cookies and comparable technologies. Cookies are small text files that are stored on your device. They may be necessary in order to provide central shop functions, such as the shopping cart, login status, language settings, customer session, security functions or technical load balancing.
Access to information on your device or the storage of information on your device is governed by Section 25 of the Telecommunications Digital Services Data Protection Act (§ 25 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).
Technically necessary cookies and comparable technologies may be used without consent, provided that they are strictly necessary for the provision of the digital service you have expressly requested.
We only use cookies that are not technically necessary, as well as analytics, marketing, retargeting, tracking or external media services, where you have given your prior consent to this.
In that case the legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
You can withdraw or amend consent you have given at any time with effect for the future.
You can additionally delete or block cookies via your browser settings. Please note that if technically necessary cookies are completely deactivated, certain shop functions, in particular the shopping cart, login and ordering process, may be restricted or unusable.
7. Customer Account, Registration and Login
If you create a customer account, or a customer account is activated for you, we process the data required for this purpose. This may include in particular:
- name and company,
- billing and delivery address,
- email address and telephone number,
- customer number, contact person and department,
- login data and password hash,
- VAT identification number, tax status and country allocation,
- customer-specific prices, terms, approvals and order history.
The processing serves the provision of the customer account, authentication, the display of customer-specific prices and terms, order processing and customer support.
The legal basis is Art. 6(1)(b) GDPR.
Where data is processed for the prevention of misuse, IT security or the economic management of the customer account, Art. 6(1)(f) GDPR additionally applies.
8. Orders, Quotations and Contract Processing
When you enquire about products, request quotations or place orders through our online shop, we process the data required to carry out the respective operation.
This may include in particular:
- master data such as name, company, customer number and contact person,
- contact and address data,
- order items, article numbers, quantities, prices, discounts and delivery dates,
- shopping cart and wish list data,
- payment, billing and delivery information,
- communication data in connection with an enquiry, quotation, order, complaint or service case,
- tax-relevant information, in particular the VAT identification number and country of delivery.
The processing serves the initiation, performance and execution of contracts, and the creation of quotations, order confirmations, delivery notes, invoices, credit notes, complaint procedures and services.
The legal basis is Art. 6(1)(b) GDPR.
For commercial and tax obligations, we process data on the basis of Art. 6(1)(c) GDPR.
9. B2B Functions, Customer-Specific Prices and SAP Business One
Our online shop is geared towards B2B and B2C e-commerce processes and may display customer-specific prices, availabilities, order histories, terms, approvals and delivery information.
For this purpose, shop data is synchronised with our ERP system SAP Business One.
This concerns in particular customer data, article and price data, order data, availability information, quotation and order data, and tax-relevant information.
The processing takes place so that we can display the information applicable to your customer account, process orders correctly and handle internal business processes efficiently.
The legal basis is Art. 6(1)(b) GDPR, insofar as the processing serves the performance of a contract.
Insofar as the processing serves process reliability, commercial management, the prevention of misuse or technical stability, it takes place on the basis of Art. 6(1)(f) GDPR.
10. FocusPoint as Shop and Integration Platform
The online shop is operated technically via the e-commerce platform FocusPoint, or by means of technical services connected to FocusPoint.
FocusPoint serves in particular the provision of the online shop, the user and customer account functions, product presentation, the shopping cart, ordering processes, and the technical integration with SAP Business One.
As part of shop operations, personal data may be transmitted to FocusPoint or to technical service providers connected to FocusPoint, or processed by them.
This concerns in particular technical access data, customer account data, shopping cart and order data, communication and metadata, and data required for the display of prices, availabilities and ordering processes.
FocusPoint and other technical service providers are, where required under data protection law, engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Insofar as personal data is thereby processed outside the European Union or the European Economic Area, this only takes place where the statutory requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, appropriate safeguards or EU standard contractual clauses.
11. Contact by Email, Telephone or Form
If you contact us by email, telephone, contact form or via other means of communication, we process the data you transmit in order to handle your enquiry.
This may include in particular name, company, customer number, email address, telephone number, subject, message content and technical metadata.
The legal basis is Art. 6(1)(b) GDPR, insofar as your enquiry is connected with a contract or pre-contractual measures.
In all other cases, the processing takes place on the basis of Art. 6(1)(f) GDPR.
Our legitimate interest lies in the proper handling of enquiries and in communication with customers, prospects, suppliers and business partners.
12. Payment Processing
In order to process payments, we process payment data and, where necessary, pass it on to credit institutions, payment service providers, accounting service providers or other bodies involved in payment processing.
The specific payment methods available are shown during the ordering process.
In particular, name, billing address, order number, invoice amount, payment method, payment status, account data, transaction data and accounting-relevant information may be processed.
The legal basis is Art. 6(1)(b) GDPR for the performance of a contract and Art. 6(1)(c) GDPR for statutory retention and documentation obligations.
13. Shipping, Delivery and Logistics
In order to deliver goods, we pass on the data required for this purpose to shipping service providers, freight forwarders, suppliers or other logistics partners.
This may include in particular name, company, delivery address, telephone number, email address, order number, delivery information and, where applicable, notification-relevant details.
The processing serves the performance of the contract and the delivery of the ordered goods.
The legal basis is Art. 6(1)(b) GDPR.
Insofar as we process data for shipment tracking, delivery optimisation or the resolution of delivery problems, this additionally takes place on the basis of Art. 6(1)(f) GDPR.
14. Complaints, Service and Technical Advice
In the case of complaints, service cases, technical queries, welding trials, consultation enquiries or warranty cases, we process the personal data required for handling them.
This may include customer data, contact data, purchase and order data, product data, photos, fault descriptions, communication content and processing notes.
The legal basis is Art. 6(1)(b) GDPR, insofar as the processing serves the performance of the contract, warranty or provision of services.
Insofar as we document processes for the pursuit of legal claims, quality assurance or internal process improvement, this takes place on the basis of Art. 6(1)(f) GDPR.
15. Newsletter and Promotional Communication
Insofar as we offer a newsletter or comparable promotional communication, we process your email address and, where applicable, further voluntary information only where there is a corresponding legal basis.
When you register for a newsletter, the processing takes place, as a matter of principle, on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw consent at any time with effect for the future, for example via an unsubscribe link in the newsletter or by sending us a message.
Insofar as we use email marketing to existing customers within the framework of the statutory requirements, this takes place on the basis of our legitimate interest in direct marketing pursuant to Art. 6(1)(f) GDPR.
16. Recipients of Personal Data
We only pass on personal data insofar as this is legally permissible and necessary for the respective purposes.
Recipients may in particular be:
- IT, hosting, shop and maintenance service providers,
- FocusPoint, or technical service providers connected to FocusPoint,
- SAP and ERP service providers,
- payment service providers and credit institutions,
- shipping service providers, freight forwarders and suppliers,
- tax advisers, auditors, legal advisers and authorities,
- debt collection or legal service providers, insofar as this is necessary to enforce legitimate claims.
Insofar as service providers process personal data on our behalf, they are contractually bound in accordance with Art. 28 GDPR and may only process the data in accordance with our instructions.
17. Data Transfers to Third Countries
Processing of personal data outside the European Union or the European Economic Area only takes place where the statutory requirements for this are met.
This may be relevant in particular in the case of internationally operating IT, software, support or platform service providers.
Insofar as personal data is transferred to third countries, this only takes place on the basis of an adequacy decision by the European Commission, appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular EU standard contractual clauses, or another statutory permission.
18. Storage Period and Erasure
We store personal data only for as long as is necessary for the respective purposes or as long as statutory retention obligations exist.
Thereafter, the data is erased or blocked, insofar as there is no further legal basis for the processing.
Documents relevant under commercial and tax law, in particular invoices, accounting vouchers, business letters and contract-relevant communication, are regularly retained for six or ten years in accordance with the statutory requirements.
Data in connection with customer accounts is, as a matter of principle, stored for as long as the customer account exists or as long as contractual, documentation and retention obligations exist.
We erase data from contact enquiries as soon as the enquiry has been conclusively processed and there are no statutory retention obligations or legitimate interests in further storage.
19. Obligation to Provide Personal Data
The provision of certain personal data is necessary so that we can provide you with the online shop, customer account functions, quotations, orders, deliveries, invoices and services.
Without this data, we cannot provide the respective services in whole or in part.
Depending on the operation, the following in particular are mandatory: name, company, billing and delivery address, email address, payment and order data, and, where applicable, customer number, VAT identification number and telephone number for queries or delivery notifications.
All other information is voluntary, insofar as it is not required for the respective operation.
20. Automated Decision-Making and Profiling
Solely automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you does not take place.
Insofar as customer-specific prices, terms, availabilities or ranges are displayed in the online shop, this is based on existing customer, article, price and contract data from our systems and serves the performance of the contract and the correct display of your customer terms.
21. Data Security
We take appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure or unauthorised access.
These include in particular access restrictions, authorisation concepts, encryption, backup measures, logging, service provider control and measures to ensure confidentiality, integrity and availability.
Our online shop uses encrypted transmission via SSL/TLS.
You can recognise an encrypted connection in particular by "https://" in the address bar of your browser and by the padlock symbol.
22. Your Rights
Subject to the statutory requirements, you have the following rights vis-à-vis us:
- right of access pursuant to Art. 15 GDPR,
- right to rectification pursuant to Art. 16 GDPR,
- right to erasure pursuant to Art. 17 GDPR,
- right to restriction of processing pursuant to Art. 18 GDPR,
- right to data portability pursuant to Art. 20 GDPR,
- right to object pursuant to Art. 21 GDPR,
- right to withdraw consent given pursuant to Art. 7(3) GDPR,
- right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.
To exercise your rights, a message to the contact details listed above is sufficient.
23. Right to Object under Art. 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you, insofar as the processing is based on Art. 6(1)(e) or Art. 6(1)(f) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing.
In the event of an objection, your personal data will no longer be processed for direct marketing purposes.
24. Withdrawal of Consent
You can withdraw consent you have given at any time with effect for the future.
The lawfulness of the processing carried out on the basis of the consent until withdrawal remains unaffected.
You can declare the withdrawal via the functions provided for this purpose, for example cookie settings or newsletter unsubscription, or by sending us a message.
25. Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Telephone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Website: www.lda.bayern.de
26. Changes to this Privacy Policy
We reserve the right to adapt this privacy policy if legal, technical or organisational changes arise.
The current version published in the online shop applies in each case.