Privacy Policy

Our data protection at a glance

Privacy Policy

Section 1 contains general information that applies to all subsequent sections. The remaining sections are addressed to different groups of people or processing situations:

1. General Information

General Notes

The following notes provide a simple overview of what happens to your personal data. Personal data is all data with which you can be personally identified. We process personal data exclusively in compliance with the applicable data protection regulations. Processing only takes place to the extent necessary to provide our services or if a corresponding legal basis exists.

Notice Regarding the Responsible Party

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

IWG Ingenieurbüro Wagenbauer
Glasofenbau GmbH
Fürhaupten 35
94227 Zwiesel
Germany

Managing Director: Dipl.-Ing. Roland Wagenbauer
Register Court: District Court Deggendorf, HRB 1861

Phone: +49 (0)9922. 84 48 0
Fax: +49 (0)9922. 84 48 21
Email: info@iwg-online.com
Website: www.iwg-online.com

The responsible party (data controller) is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).

Data Protection Officer

We have appointed an external Data Protection Officer:

DataCo GmbH
Sandstr. 33
80335 Munich
Email: privacy@dataguard.com
Website: www.dataguard.com

General Retention Period

Unless a specific storage period is specified within this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies, provided that no statutory retention obligations prevent its deletion. If you assert a legitimate request for erasure or revoke consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it (e.g., tax or commercial law retention periods); in the latter case, deletion takes place once these reasons no longer apply.

Your Rights (Data Subject Rights)

You have the following rights at any time:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure / Right to be forgotten (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent at any time (Art. 7 Para. 3 GDPR)

You can contact us at any time regarding these rights and for further questions on the subject of data protection.

Right to Object to Data Collection in Special Cases and Direct Marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6 PARA. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 PARA. 1 GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21 PARA. 2 GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de
Website: www.lda.bayern.de

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser address line changes from "http://" to "https://" and by the lock symbol in your browser bar. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. Privacy Notice for Website Visitors

This section includes all processing activities that take place directly when visiting our website.

2.1 Hosting and Server Log Files

This website is hosted by an external service provider (host). When you visit our website, information transmitted by your browser is automatically processed. The processed data includes in particular:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

This data will not be merged with other data sources.

The processing is carried out to ensure technical operation, stability, and IT security. The legal basis is Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website.

Recipients: Reiner Media (technical support) and Timme Hosting GmbH & Co. KG (hosting) as data processors. Data is not transferred to third countries.

Retention period: Server log files are automatically deleted after 30 days.

We use the following host:

Timme Hosting GmbH & Co. KG
Ovelgönner Weg 43
21335 Lüneburg

Data Processing Agreement (DPA)

We have concluded a Data Processing Agreement (DPA) with the provider named above. This is a contract required by data protection law, which ensures that they process the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

Data Backup

To ensure data integrity and availability, daily backups (every 24 hours) of all data are created on our host's servers. These backups serve exclusively for recovery in the event of an error and are deleted in accordance with the host's defined retention periods.

Web Support and Technical Administration

Technical support, maintenance, and administration of this website are carried out by an external service provider:

Reiner Media
Stefan Reiner
Ferdinandshöhe 23
94227 Zwiesel

As part of this activity, the service provider may gain access to personal data processed on this website (e.g., server log files, contact inquiries, form data). Processing takes place exclusively on our instructions and on the basis of a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. The legal basis is Art. 6 Para. 1 lit. f GDPR (legitimate interest in the secure and efficient technical administration of our website).

2.2 Cookies and Terminal Device Access

We use technologies that store information on your end device or read information from your end device. Cookies are small text files and do not cause any damage to your end device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies).

Technically necessary technologies

  • These are required for the operation of the website.
  • The purposes include providing the website and saving your settings.
  • The legal basis is Section 25 Para. 2 TDDDG in conjunction with Art. 6 Para. 1 lit. f GDPR.

Recipients are the service providers whose tools are used. Detailed information on purpose, duration, and recipients can be found in the consent settings.

Technologies requiring consent

These technologies are only used with your consent.

  • The purpose is the integration of external services.
  • The legal basis is Section 25 Para. 1 TDDDG in conjunction with Art. 6 Para. 1 lit. a GDPR.

Recipients are the service providers whose tools are used. Detailed information on purpose, duration, and recipients can be found in the consent settings. A transfer to third countries, in particular the USA, is possible.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser.

2.3 Consent Management (CCM19)

We use CCM19 to manage your consents to store certain cookies on your end device or to use certain technologies, and to document them in compliance with data protection laws. The CCM19 installation is operated by us on our own server. When using CCM19, a connection is established exclusively to our own server; no data is transmitted to third parties. CCM19 stores a cookie in your browser to be able to assign the consents granted or their revocation to you.

Purpose: Obtaining, documenting, and managing consent in accordance with legal requirements.

Legal basis: Art. 6 Para. 1 lit. c GDPR in conjunction with Section 25 Para. 2 TDDDG.

Retention period: Documentation of consents is stored on our server for at least 3 years in order to comply with the obligation to provide proof under the GDPR.

2.4 Google Maps

We use Google Maps to display maps. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. By using Google Maps, personal data (in particular the IP address and, if applicable, addresses entered as part of the route function) can be transmitted to Google and processed there. The map does not load automatically. Instead, a placeholder is displayed first. The map will only be loaded and data transmitted to Google once you actively consent (click on the placeholder or consent via our CCM19 consent management tool). As long as you do not grant consent, no connection to Google Maps will be established.

Purpose of processing: User-friendly presentation of our location and support with route planning.

Legal basis: Section 25 Para. 1 TDDDG and Art. 6 Para. 1 lit. a GDPR (consent). You can revoke your consent at any time with effect for the future via the consent management tool.

Recipients: Google Ireland Ltd. and Google LLC (USA).

Third-country transfer: Transmission to the USA may take place. Currently, this is based on the adequacy decision under the EU-US Data Privacy Framework.

Retention period: The retention period is determined by Google's guidelines.

Further information on data processing by Google can be found at: https://policies.google.com/privacy?gl=DE&hl=en

2.5 Google Web Fonts (Locally Hosted)

This site uses web fonts provided locally by us for the uniform representation of fonts. A connection to Google servers does not take place. Therefore, when accessing this page, no data (such as your IP address) is transferred to Google. The use of these web fonts is based on Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on its website.

2.6 Contacting Us

When you contact us (e.g., via email, contact form, or telephone), we process your data. This includes your name, contact details, and message.

Purpose: Processing your request.

Legal basis: Art. 6 Para. 1 lit. b GDPR (if your inquiry is related to the performance of a contract or necessary to carry out pre-contractual measures) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in the effective processing of inquiries addressed to us).

Recipients: Internal departments and IT service providers.

Retention period: After final processing, the data will be deleted unless:

  • statutory retention obligations exist (e.g., under commercial or tax law),
  • the data is required for the establishment, exercise, or defense of legal claims, or
  • a further contact or business relationship arises from the inquiry.

In these cases, storage takes place within the framework of the applicable statutory deadlines or until the processing purpose ceases to apply.

Spam Protection: In order to protect our contact form from automated and abusive entries, we use technical measures that are executed exclusively locally on our server (e.g., a check field invisible to you and a plausibility check of the entry). No personal data is transferred to third parties and no cookies are set.

2.7 Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, duration of visit, operating systems used, and origin of the user. This data may be summarized by Google in a profile assigned to the respective user or their end device. Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). In Google Analytics 4, IP addresses are no longer completely stored by default.

Legal basis: Section 25 Para. 1 TDDDG in conjunction with Art. 6 Para. 1 lit. a GDPR (consent via CCM19). Consent can be revoked at any time.

Third-country transfer: Data transmission to the USA is based on the standard contractual clauses of the EU Commission and Google's certification under the EU-US Data Privacy Framework.

Retention period: User- and event-level data stored by Google that is linked to cookies is automatically deleted after 14 months.

Data processing agreement: We have concluded a Data Processing Agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

3. Contact Information (Mandatory Information when Contacting Us)

When you contact us—especially during initial contact by email, telephone, fax, post, or within the framework of personal business contacts (e.g., at trade fairs)—we process the personal data you transmit. With the following information, we fulfill our information obligation pursuant to Art. 12 and 13 GDPR.

3.1 Controller

Responsible for processing is the entity named in Section 1 ("Notice Regarding the Responsible Party"). You can reach our appointed Data Protection Officer via the contact details provided there.

3.2 Processed Data

As part of contacting us and ongoing correspondence, we process in particular:

  • Salutation, first and last name
  • Contact details (email address, telephone/fax number, address)
  • Company and function details
  • Content of your message or correspondence
  • Other personal data that you voluntarily provide to us as part of the communication

3.3 Purposes of Processing

Processing takes place for the following purposes:

  • Processing and answering your inquiry or request
  • Communicating with you and handling correspondence
  • Initiating, establishing, and executing a business relationship
  • Fulfilling legal obligations

3.4 Legal Bases

Processing is based on:

  • Art. 6 Para. 1 lit. b GDPR, provided your contact serves the initiation or implementation of a contract,
  • Art. 6 Para. 1 lit. f GDPR based on our legitimate interest in effectively processing and responding to inquiries addressed to us and communicating with business partners,
  • Art. 6 Para. 1 lit. c GDPR, insofar as processing is necessary to fulfill a legal obligation,
  • where applicable, Art. 6 Para. 1 lit. a GDPR, provided you have given us your consent.

3.5 Recipients

Within our company, only those departments receive access to your data that require it to process your concern. In addition, recipients may be IT service providers who support us as data processors. Disclosure to other third parties takes place only if necessary to process your request or if required by law.

3.6 Transfer to Third Countries

A transfer of your data to a third country only takes place in individual cases and only in compliance with the requirements of Art. 44 et seq. GDPR (e.g., on the basis of appropriate safeguards such as the EU standard contractual clauses).

3.7 Retention Period

We store your data for as long as necessary to process your request and the associated correspondence. Subsequently, the data will be deleted unless statutory retention obligations (in particular under commercial and tax law) prevent this or the data is required for the establishment, exercise, or defense of legal claims. In these cases, deletion takes place after expiry of the respective periods or after the purpose ceases to apply.

3.8 Obligation to Provide Data

Providing your data is voluntary. However, without the information required for processing, we may not be able to process your request, or not process it completely.

3.9 Your Rights

You are entitled to the data subject rights mentioned in Section 1 ("Your Rights"), in particular the right to access, rectification, erasure, restriction of processing, data portability, and the right to object. You also have the right to lodge a complaint with the responsible supervisory authority described there.

4. Privacy Notice for Customers, Suppliers, and Prospective Clients

4.1 Processed Data

We process in particular contact details, company data, contract data, billing data, communication data as well as creditworthiness data and data from business contacts.

4.2 Purposes

Processing takes place for the following purposes:

  • Exchange of B2B contacts and management of prospective clients, suppliers, and customers
  • Contract initiation, contract execution, and post-contractual rights
  • Creation of offers and management of cost estimates
  • Customer and supplier care and related communication
  • Marketing measures such as direct marketing or follow-up measures after trade fairs
  • Credit check and risk assessment
  • Fulfillment of legal obligations, in particular accounting, financial accounting, and customs measures
  • Implementation of compliance measures, in particular sanction list screening to the required extent: To comply with legal and regulatory requirements, particularly in export control and sanctions law, personal data may be matched against relevant sanction lists. Such screening takes place exclusively for a specific purpose within the framework of initiating business or ongoing business relationships. Any hits are manually reviewed before a decision is made; purely automated decision-making does not take place.

4.3 Legal Bases

Processing is based on Art. 6 Para. 1 lit. b GDPR (contract initiation and performance), lit. c GDPR (fulfillment of legal obligations, especially in tax and sanctions law), and lit. f GDPR (legitimate interest in business initiation, customer care, and compliance), as well as, if applicable, lit. a GDPR (consent, particularly for marketing measures).

4.4 Recipients

External recipients may include in particular:

  • IT service providers (data processors)
  • Tax advisors
  • Credit institutions, financial service providers
  • Public authorities
  • Business partners
  • Creditreform (credit rating)
  • DATEV (accounting)
  • Service providers for compliance checks

4.5 Third-Country Transfer

Transfer to third countries may take place in individual cases, particularly in connection with IT services. This is done using appropriate safeguards in accordance with Art. 44 et seq. GDPR (e.g., EU standard contractual clauses).

4.6 Retention Period

Personal data of customers and prospective clients is only stored for as long as necessary for the respective purposes. The storage period is determined in particular according to the following criteria:

  • the duration of the business relationship or contract initiation,
  • the necessity for the performance and execution of contracts,
  • the necessity for customer care and communication,
  • the safeguarding of legitimate interests (e.g., establishment, exercise, or defense of legal claims).

After termination of the business relationship, data is deleted if it is no longer required. Longer storage occurs if:

  • statutory retention obligations exist (e.g., retention obligations under commercial and tax law according to the German Commercial Code [HGB] and the Fiscal Code [AO] of up to 10 years),
  • the data is required for the settlement or enforcement of claims,
  • or further storage is permissible within the scope of legitimate interests.

Data processed exclusively for the purpose of contract initiation (e.g., price inquiries) will be deleted if no contractual relationship materializes and there are no other legitimate interests in retaining the data.

Trade fair contacts without a subsequent business relationship are deleted after an appropriate period (24 months).

Data from sanction list screenings is stored as part of documentation obligations, whereby the execution of the check (result) is documented.

4.7 Obligation to Provide Data

The provision of personal data is necessary for the conclusion and performance of a contract and for checking business relationships (including compliance requirements). Without this data, a business relationship may not be established or continued.

5. Privacy Notice for Job Applicants

5.1 Processed Data

We process contact details, application documents, salary expectations, availability, and the data transmitted in the application documents.

5.2 Purposes

Processing takes place to carry out the application process and to make a decision on establishing an employment relationship.

Insofar as necessary to comply with legal or internal compliance guidelines, personal data of applicants may be matched against relevant sanction lists. Such screening takes place exclusively for a specific purpose and generally only if there is specific relevance to the targeted activity (e.g., for functions in export control or sensitive business areas). Any hits are manually reviewed before a decision is made; purely automated decision-making does not take place.

If you are interested in being included in our applicant pool, this is done with your consent.

5.3 Legal Bases

  • Art. 6 Para. 1 lit. b and c GDPR, Section 26 BDSG (German Federal Data Protection Act), Art. 6 Para. 1 lit. f GDPR
  • where applicable, Art. 6 Para. 1 lit. a GDPR

5.4 Recipients

Recipients are the HR department, the respective specialist departments, and IT service providers. In individual cases, data may be passed on to external HR service providers or service providers for sanction list screening, insofar as this is necessary to carry out the application process or to fulfill legal obligations.

5.5 Retention Period

Data is stored as follows:

  • 6 months after completion of the process (in the event of a rejection)
  • in the case of consent to the applicant pool: until revocation of consent
  • in the case of hiring: transfer of applicant data to the personnel file and storage for the duration of the employment relationship and in accordance with statutory retention obligations
  • in the case of revocation of consent: immediate deletion, provided no statutory or legal reasons prevent storage
  • data from compliance and sanction list screenings within the scope of existing documentation obligations

5.6 Obligation to Provide Data

The provision of personal data is necessary to conduct the application process. Without this data, an application cannot be considered.

Do you have questions?

We are here for you!
Write an E-mailTel: 09922 - 8448 0