Data protection information from Boll & Kirch Filterbau GmbH
With this privacy statement, Boll & Kirch Filterbau GmbH (hereinafter: “We”) informs the user (hereinafter: “You”) about the personal data that is collected on our websites and webapps and how we use this data. We also inform you about your rights as a data subject.
This data protection information applies to the following website and webapp:
www.bollfilter.io (BLUEtwin)
It might also include information about our external online presences, such as social media profiles.
1. Controller and data protection officer
Operator of the website is as the controller responsible for data protection:
Boll & Kirch Filterbau GmbH
Siemensstraße 10 – 14
50170 Kerpen
Tel.:+49 (0)2273-562-0
Fax: +49 (0)2273-562-223
Email: info@bollfilter.com
Internet: www.bollfilter.com
You can reach our data protection officer at the following email address:
2. Provision of the website and log files
2.1. Description and scope of the data processing
Each time our website is accessed, our web server automatically collects information from the system of the accessing computer or end device.
The following data is collected:
- User IP address
- Date and time of access
- Address of retrieved data (URL)
- User Agent String
The abbreviated IP address, date and time of access and the accessed URL are stored as log files on our web server.
2.2. Purpose and legal basis of the processing
The temporary storage of the IP address by our system is necessary in order to be able to deliver the website to your computer. Data is stored in the log files in order to ensure the operation and functionality of the website.
It is also used to optimise the website and to ensure the security of our information technology systems (e.g. attack detection).
The legal basis for the temporary storage in log files and the use of this data is Art. 6 Para. 1 f GDPR. Our interest hereby is the safe and functional operation of the webservices. It is our obligation to take the measures necessary to ensure the integrity, confidentiality and availability of users' personal data. For registered users, the legal basis is Art. 6 Para. 1 b GDPR.
2.3. Duration of storage
The above data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. If data is collected for provision of the website, this is the case when the respective session has ended.
Log files are deleted automatically after 14 days.
3. Use of cookies and related technologies
3.1. Description and scope of the data processing
Cookies are used on our websites to enable the use of certain functions use of the platform. Cookies are small blocks of data or other storage notes that store information on end devices and read information from the end devices. We explain which information is stored and read by the cookies in each case in connection with the corresponding functions below.
3.2. Purpose and legal basis of the processing
Cookies and related technologies perform different functions. Cookies and related technologies are used by us for the following purposes.
This website/webapp only uses strictly necessary cookies. Strictly necessary cookies help to make a website usable by enabling basic functions such as site navigation and access to secure areas of the website. This processing is necessary in order to provide the website or to provide a telemedia service explicitly requested by the user.
The Session Cookie stores your login as a hash value and thus allows to maintain the login status during the website visit until you log out.
The CSRF token adds an additional authentication mechanism to requests to protect against a cross-site (CSRF) attack.
Insofar as personal data - such as IP addresses - is used to create hashes, the use of this data is based on Art. 6 Para. 1 f GDPR. Our interest hereby is the safe and functional operation of the webservices. It is our obligation to take the measures necessary to ensure the integrity, confidentiality and availability of users' personal data. For registered users, the legal basis is Art. 6 Para. 1 b GDPR.
3.3. Duration of storage
The cookies we use expire when you close your browser or log out of our web platform/webapp.
4 .Registration
4.1. Description and scope of the data processing
In order to use our services, the user must register to BLUEtwin beforehand. The following information is collected:
- First and Last name
- Email-Address
- Company
- Fabrication Number
- Password
After filling out the registration form, the user will receive an email through which he can create a password-protected user account.
4.2. Purpose and legal basis of the processing
The purpose of the processing is to provide BLUEtwin services such as the notification service and ordering of spare parts to customers and users. The legal basis is Art. 6 Para. 1 lit. b GDPR. Users set whether and which notifications and information they want to receive via user management. They can change this at any time or unsubscribe from email services via an unsubscribe link sent with each email.
4.3. Duration of storage
Personal data will be deleted when it is no longer necessary to fulfill the mentioned purposes and the user account is deleted. Some data may be stored, as long as this is required by legal retention and documentation obligations, e.g. commercial or tax law.
5. Email Notification Services
5.1. Description and scope of the data processing
We use the above registration data to send registered users status notifications of filters and transactional emails (e.g. registration, password changes) and to inform about new or changed documents about filters. In addition to the registration data, the following data is processed:
- Emails and Email history
- Usermanagement settings
To send BLUEtwin mails, we use the Mailgun service from Synch as a data processor within the meaning of Art. 28 GDPR, which means that personal data may only be processed by the provider on our behalf and according to our instructions. We are utilizing the EU region of the processor, therefore all data will be located at datacenter in the EU (Germany and Belgium) and will remain in the EU.
4.2. Purpose and legal basis of the processing
Users define in the user management whether and which emails they want to receive and can unsubscribe from the BLUEtwin email service via an unsubscribe link in the footer of the emails. The processing is necessary to send the selected emails and to organize email service. The legal basis is Art. 6 Para. 1 b GDPR.
4.3. Duration of storage
Personal data will be deleted when it is no longer necessary to fulfill the mentioned purposes and the user account is deleted. Some data may be stored, as long as this is required by legal retention and documentation obligations, e.g. commercial or tax law.
6. Request Email Service and General Contact
6.1. Description and scope of the data processing
You can order spare parts or send a support request via a form request. In addition, you generally have the option of contacting us via the email addresses provided. The data you enter will be stored by us and used for the purpose of contacting you. The forms requests contain mandatory fields that must be filled in and optional fields in which you only provide information if you consider it useful. The information we request from you depends on the context of the request.
In addition to this form field data, we also store the content of your request or order. The procedure described above also applies accordingly if you contact us directly by telephone or Email.
6.2. Purpose and legal basis of the processing
The data is collected and used to process your request and to contact you. If the data collection is based on a registration in connection with a consent, the data will be processed on the basis of Art. 6 Para. 1 a GDPR.
If the data collection is necessary for the initiation or execution of a contract (e.g. order of spare parts or support request), the legal basis is Art. 6 Para. 1 b GDPR. The same applies to the data processing necessary for the provision and sending of content.
6.3. Duration of storage
The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For personal data sent via contact forms, this is the case when the respective conversation has ended. The conversation is ended when the circumstances indicate that the matter has been conclusively clarified.
Data collected for the purpose of performance of a contract shall be stored for the duration of the contract and until expiry of the statutory and contractual warranty and guarantee rights. After expiry of this period, we retain the information required under commercial and tax law for the periods specified by law (usually 6 to 10 years).
7. Your rights
You can assert your rights as a data subject with regards to your processed personal data at any time using the contact details given above. As a data subject, you have the right:
to request information about your data processed by us according to Art. 15 GDPR. In particular, you can obtain information about the processing purposes, the data category, the categories of recipients to whom your data was or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if it was not collected from us, as well as the existence of automated decision-making including profiling and, if necessary, meaningful information about the details;
to immediately request the correction of incorrect data or the completion of your data stored by us according to Art. 16 GDPR;
request the deletion of your data stored by us according to Art. 17 GDPR, unless the processing is required in order to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
to request the restriction of the processing of your data according to Art. 18 GDPR, if you dispute the accuracy of the data or the processing is unlawful;
to receive the data that you have provided to us in a structured, common and machine-readable format or to request transmission to another person responsible ("data portability"), according to Art. 20 GDPR;
to object to the processing according to Art. 21 GDPR if the processing is based on Art. 6 Para. 1 Clause 1 e or f GDPR. This is particularly the case when the processing is not required for the fulfilment of a contract with you. Unless it is an objection to direct advertising, we ask that you explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and will either stop or adjust the data processing or show you our compelling legitimate reasons for continuing the processing;
according to Art. 7 Para. 3 GDPR, your consent once given - i.e. your voluntary, informed and unequivocally made clear by a declaration or other clear affirmative action, that you consent to the processing of the personal data concerned for one or more specific purposes - can be revoked at any time, if such consent has been given. As a result, we are no longer allowed to continue the data processing based on this consent in the future and
in accordance with Art. 77 GDPR, you have the right to complain to a data protection supervisory authority about the processing of your personal data by our company
8. Changes to the privacy statement
As part of the further development of data protection law and technological or organisational changes, our data protection notice is checked regularly for any need for adjustment or supplementation. You will be informed of changes in particular on this website.
This data protection notice is dated 12-06-2023