Data privacy statement

1. Name and address of the responsible party

Your contact as the responsible party within the meaning of the European General Data Protection Regulation ("EU-GDPR"), other national data protection laws of the member states and other data protection regulations is:

Thurner GmbH
Schwarzachstraße 26-30
88521 Ertingen
Germany

Tel.: +49(0)7371 934 933-0
e-mail: info@thurner-keramik.de

Authorised to represent: Harald Thurner
VAT ID no. DE 158 221 024
Commercial register: Biberach 247-R

2. Data protection /  Data protection officer

For Thurner GmbH, the protection of your personal data has a high priority. 
For all questions concerning the topic of data protection and data security, please contact us directly:
e-mail: info@thurner-keramik.de

3. General information concerning the processing of data

a. Extent of the processing of personal data
We only process your personal data as far as this is necessary to carry out our services. The processing of your personal data only takes place regularly on the basis of your consent. An exception applies to cases where prior consent cannot be obtained for real reasons or the processing of your personal data is permitted by law.

b. Legal basis for the processing of personal data
Insofar as we obtain your consent for the processing of personal data, Art. 6 para. 1 a EU-GDPR serves as the legal basis. In cases where the processing of personal data required to fulfill a contract between you and us, Art. 6 para. 1 b EU-GDPR serves as legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures. If the processing of personal data is required to fulfill a legal obligation to which we are subject, Art. 6 para. 1 c EU-DSGVO serves as the legal basis.
In the event that your vital interests or those of another natural person require the processing of personal data, Art. 6 para. 1 d EU-DSGVO as legal basis.If the processing is necessary for the protection of one of our legitimate interests or that of a third party and its interests and fundamental rights and fundamental freedoms do not outweigh the aforementioned interest, then Art. 6 para. 1 f EU-GDPR serves as the legal basis for processing.

c. Data deletion and storage duration
Your personal data will be deleted or blocked as soon as the purpose for storage no longer applies. It may also be stored if this is provided for by the European or national legislator in EU regulations, laws or other regulations to which we are subject. Blocking or deletion of data also takes place if a storage period prescribed by the aforementioned standards expires, unless there is a need for a further storage of data in order for the contract to be concluded or fulfilled.

4. Provision of the website and the creation of log files

a. Legal basis for data processing
The legal basis for the processing of your personal data within the context of the provision of the website and the creation of log files is Art. 6 para. 1 f EU-GDPR.

b. Purpose of data processing
The temporary storage of your personal data by us is necessary in order to enable the delivery of the website on your computer. For this, your personal data has to be stored for the duration of the session.
The storage of your personal data takes place in log files in order to ensure the functionality of the website. In addition, your personal data is used to optimise the website and to ensure the security of our information technology systems. Within this context, there is no evaluation of your personal data for marketing purposes.For these purposes, our legitimate interest in data processing is governed by Art. 6 para. 1 f EU-GDPR.

c. Duration of the storage
Your personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it is collected. In the case of the collection of your personal data for the provision of the website, this is the case as soon as the respective session is over.
Further storage, beyond this is possible. In this case, your personal data will be deleted or made indistinguishable so that it will no longer be possible to assign the calling client.

d. The opportunity to oppose and seek a remedy
The collection of your personal data for the provision of the website and the storage of your personal data in log files is essential for the operation of the website. As a result, there is no possibility for you to oppose it.

5. Use of cookies

a. Legal basis for data processing
Within the context of the use of cookies that are technically necessary, the legal basis for processing your personal data is Art. 6 para. 1 f EU-GDPR

b. Purpose of data processing
The use of cookies that are technically necessary serves to simplify the use of our website. Some features of our website cannot be offered without the use of cookies. For this, it is necessary that your Internet browser is recognised even after changing the page. The user data that is collected using cookies that are technically necessary is not used to compile user profiles. For this purpose, we have a legitimate interest in the processing of your personal data in accordance with Art. 6 para. 1 f EU-GDPR.

c. Duration of storage
Your personal data will be deleted as soon as it is no longer necessary to achieve the purpose for its collection; this is especially the case when disabling the cookies..

d. The opportunity to oppose and seek a remedy
Cookies are stored on your computer and are transmitted by it to our website. Therefore, you also have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that are already saved can be deleted at any time. This can also be done automatically.
If cookies are disabled for our website, it may not be possible to use all the functions of the website to the full.

6. Newsletter

a. Legal basis for data processing
The legal basis for the processing of your personal data within the scope of sending out the newsletter is the consent that is given (Art. 6 para. 1 a EU-GDPR) or the statutory permission, as a result of the sale of goods or services (Sect. 7 para. 3 Act Against Unfair Competition).

b. Purpose of data processing
The collection of your personal data takes place so that we can send the newsletter to you. The purpose for the processing of your personal data within the scope of sending the newsletter is the promoted selling of goods or services.

c. Duration of the storage
Your personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it is collected. Your personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.

d. The opportunity to oppose and seek a remedy
You can cancel the subscription to the newsletter at any time. For this purpose, there is a corresponding link in each newsletter. Termination of the subscription also enables the revocation of consent.

7. Contact form and contact by e-mail

a. Legal basis for data processing
The legal basis for the processing of your personal data, which is transmitted in the case of making contact via the contact form or by e-mail, is Art. 6 para. 1 f EU-GDPR. If contact via the contact form or via e-mail aims to conclude a contract, Art. 6 para. 1 b EU-GDPR is an additional legal basis for the processing.

b. Purpose of data processing
In the case of making contact via the contact form or by e-mail, the processing of your personal data only serves our requirement to process the contact.

c. Duration of the storage
Your personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data sent via the contact form or by e-mail, this is the case when the conversation with you has ended. The conversation ends when, from the circumstances, it can be inferred that the matter in question between you and us has finally been clarified.

d. The opportunity to oppose and seek a remedy
You have the possibility to object to the processing of your personal data within the context of making contact at any time via the contact form or by e-mail. This is possible at any time with future effect. In such a case, the conversation between you and us cannot continue. In this case, all personal data that has been stored in the course of making contact will be deleted.

8. Web tracking and web analysis by Google Analytics

a. Handling of the processing
This website uses Google Analytics, the web analysis service of Google Inc. (hereinafter referred to as "Google"). Google Analytics uses so-called "cookies". These are text suggestion files, which are stored on your computer and allow an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be truncated by Google beforehand within member states of the European Union or other parties to the Agreement on the European Economic Area. The full IP address will only be sent to a Google server in the US and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity and provide other services related to website activity and internet usage to the website operator. The IP address provided by Google Analytics as part of Google Analytics will not be merged with other Google data.

b. Legal basis for data processing
The legal basis for the processing of your personal data is Art. 6 para. 1 f EU-GDPR.

c. Purpose of data processing
The processing of your personal data enables us to analyse your surfing behaviour. By analysing the data that has been obtained, we are able to compile information concerning the use of the individual components of our website. This helps us to constantly improve our website and its user-friendliness. For these purposes, our legitimate interest lies in the processing of your personal data in accordance with Art. 6 para. 1 f EU-GDPR. By anonymising your IP address your interests in the protection of personal data will be duly taken into account.

d. Duration of the storage
Your personal data will be deleted as soon as it is no longer needed for our purposes (mentioned above). In our case, this happens after 14 months.

e. The opportunity to oppose and seek a remedy
Users of this site who do not want their data collected by Google Analytics may install the browser add-on in order to disable Google Analytics. This add-on instructs the Google Analytics JavaScript that runs on websites (ga.js, analytics.js, and dc.js) to disallow the sending of information to Google Analytics.

If you want to disable Google Analytics, please visit this page and install the add-on in order to disable Google Analytics for your browser. Detailed information for installing and uninstalling the add-on can be found in the relevant help resources for your browser..

Browser and operating system updates may cause the deactivation add-on to no longer work as intended. Learn more about managing add-ons for Chrome here. If you're not using Chrome, check with your browser manufacturer to see if any add-ons are working properly in the browser version you're using.

The latest versions of Internet Explorer occasionally load the Google Analytics opt-out add-on after data has been sent to Google Analytics. Therefore, if you use Internet Explorer, the add-on will install cookies on your computer. These cookies ensure that any collected data is deleted immediately by the server that collected the data. Make sure that third-party cookies are not disabled for Internet Explorer. If you delete your cookies, these cookies will be reset by the add-on within a short period of time in order to ensure that your Google Analytics browser add-on can continue to operate without restriction.

The browser add-on for disabling Google Analytics does not prevent data from being sent to the website or other services relating to web analytics.

For further information concerning terms of use and data protection, please see
www.google.com/analytics/terms/de.html bzw. unter
support.google.com/analytics/answer/6004245.
IP anonymisation is enabled on this website.

9. Social media usage

a. Legal basis for data processing
The legal basis for the processing of your personal data is Art. 6 para. 1 a EU-GDPR.

b. Purpose of data processing
The processing of your personal data enables us to analyse your usage of social media. By analysing the data that has been obtained, we are able to compile information concerning the use of the individual components of our website. This helps us to constantly improve our Facebook, Instagram, YouTube and Google+ pages and their user-friendliness.

c. Duration of the storage
Your IP address and the name of your Internet service provider, which we only save for security reasons, will be deleted after seven days. In addition, we will delete your personal data as soon as the purpose for which we collected and processed the data no longer applies. Beyond this date, storage will only take place if it is required by the laws, regulations or other legal provisions of the European Union or of a Member State of the European Union to which we are subject.

d. The opportunity to oppose and seek a remedy
Because the collection of data via the plug-in only takes place if you click on it, you can only revoke the consent to data collection (that you granted on one occasion) by no longer clicking on the plug-in and no longer agreeing to data collection by means of the second "click".

i. Clicking on the social media plug-in for the first time
When you visit our websites, the social plug-ins are disabled, i.e. there is no transmission of any data to the operators of these networks.

If you would like to use one of the networks, click on the respective social media plug-in in order to establish a direct connection to the server of the respective network.

If you activate a social media plug-in, the network transfers the content that becomes available directly to your browser, which then integrates it into our web pages.
The following data is transmitted: 

• Address of the web page on which the activated link is located 
• Date and time when the web page was accessed and/or activated
• Information about the browser and the operating system that are used
• IP address

The social plug-in remains active until you click it disable or delete your cookies.

ii. Existing user account and being logged in
If you have a user account with the social media network and you are logged in when you activate the social plug-in, the social media network can assign your visit to our web pages to your user account.
The following data is transmitted: 

• Address of the web page on which the activated link is located
• Date and time when the web page was accessed and/or activated
• Information about the browser and the operating system that are used
• IP address

If you want to avoid this, do not click on the plug-in of the social media network.

10. Direct marketing

a. Legal basis for data processing
Within the context of the use of direct marketing by post, the legal basis for processing your personal data is Art. 6 para. 1 f EU-GDPR.

b. Purpose of data processing
The purpose of processing your personal data within the context of direct marketing by post is to promote the sale of goods and services. For this purpose, our legitimate interest lies in the processing of your personal data in accordance with Art. 6 para. 1 f EU-GDPR.

c. Duration of the storage
Your personal data will be deleted as soon as it is no longer needed in order to achieve the purpose for which it was collected; this is especially the when opposition is received.

d. The opportunity to oppose and seek a remedy
You can object to the processing of your personal data within the context of direct marketing by post at any time in the future.

11. Defending legal interests and law enforcement

a. Legal basis for data processing
Within the context of defending legal interests and law enforcement, the legal basis for processing your personal data is Art. 6 para. 1 f EU-GDPR.

b. Purpose of data processing
The purpose for processing your personal data within the context of defending legal interests and law enforcement is to defend against unauthorised use and the legal enforcement of claims and rights. For this purpose, our legitimate interest lies in the processing of your personal data in accordance with Art. 6 para. 1 f EU-GDPR.

c. Duration of the storage
Your personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it is collected.

d. The opportunity to oppose and seek a remedy
Within the context of defending legal interests and law enforcement, the processing of your personal data is mandatory in order defend legal interests and enforce the law. As a result, there is no possibility for you to oppose it.

12. Categories of recipient

Within our company, offices and departments receive the personal data that they need to fulfil the purposes mentioned above. In addition, we sometimes use different service providers and we transfer your personal data to other trusted recipients. For example, these may be: 

• banks
• scanning services
• printers
• letter shops
• IT service providers
• lawyers and courts

13. Rights of the data subject

If your personal data is processed by us, you are a data subject as defined by EU-GDPR and you have the following rights with regard to us:

a. The right to information
You can request confirmation from us as to whether personal data concerning you is processed by us.

If such processing occurs, you may request information from us about the following:

(1) the purposes for which personal data is processed;
(2) the categories of personal data being processed;
(3) the recipients and/or categories of recipients to whom personal data relating to you has been or will be disclosed;
(4) the planned duration of the personal data storage or, if specific information is not available, criteria for determining the duration of storage;
(5) the existence of a right to rectification or deletion of personal data concerning you, a right to restrict the processing we perform or a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) all available information concerning the origin of the data if the personal data is not collected from you;
(8) the existence of automated decision-making including profiling in accordance with Art. 22 paras. 1 and 4 EU GDPR and - at least in such cases - meaningful information about the logic involved and the consequences and implications of such processing for you.

You have the right to request information about whether or not the personal data relating to you will be transmitted to a third country or an international organisation. In connection with this, you can request that you are informed of the appropriate guarantees in accordance with. Art. 46 EU-GDPR in relation to the transfer.

b. Right to rectification
You have a right to rectification and/or completion by us, if the processed personal data concerning you is incorrect or incomplete. We have to correct this immediately.

c. Right to restrict the processing
You may request a restriction of the processing of personal data concerning you under the following conditions:

(1) if you contest the accuracy of your personal data for a period of time that enables us to verify the accuracy of your personal data;
(2) the processing is unlawful, you refuse to delete the personal data and instead request that the use of the personal data is restricted;
(3) we no longer need the personal data for processing purposes, but you need this data in order to assert, exercise or defend legal claims, or
(4) if you have objected to the processing pursuant to Art. 21 para. 1 of EU-GDPR and it is not yet certain whether our legitimate reasons prevail over your reasons.

If the processing of personal data concerning you has been restricted, this data may only be used with your consent for the purpose of asserting, exercising or defending legal claims, for protecting the rights of another natural or legal person or for reasons of important public interest affecting the EU or a Member State.

If the limitation of the processing according to the conditions mentioned above is restricted, you will be informed by us before the restriction is lifted.

d. Right to deletion

i. Obligation to delete data
You can request that personal data relating to you is deleted immediately and we will be obliged to delete this personal data immediately if one of the following reasons applies:

(1) Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
(2) You revoke your consent to processing in accordance with Art. 6 para. 1 a or Art. 9 para. 2 a EU-GDPR, and there is no other legal basis for processing.
(3) You revoke your consent to processing in accordance with Art. 21 para. 1 EU-GDPR and there are no prior justifiable reasons for the processing or you revoke your consent to processing in accordance with Art. 21 para. 2 EU-GDPR.
(4) Your personal data has been processed unlawfully.
(5) The deletion of your personal data is required to fulfil a legal obligation under EU law or national law to which we are subject.
(6) The personal data concerning you has been collected in relation to services offered by the IT company in accordance with Article 8 para. EU GDPR.

ii. Information to third parties
If we have made personal data relating to you public and if, in accordance with Art. 17 para. 1 of the EU-GDPR, we are obliged to delete it, we shall take appropriate measures (taking available technology and implementation costs into account) including those of a technical nature, to inform data controllers who process the personal data that you, as the data subject, have requested the deletion of any links to such personal data and the deletion of copies or replications of such personal data.

iii. Exceptions
The right to deletion does not exist insofar as processing is required

(1) to exercise the right to freedom of expression and information;
(2) to fulfill a legal obligation which involves processing under EU law or of a law of the Member States to which we are subject, or to perform a task in the public interest or to exercise public authority delegated to us;
(3) for reasons of public interest in the field of public health in accordance with Art. 9 para. 2 h and i as well as Art. 9 para. 3 EU-GDPR;
(4) for archiving purposes in the public interest, for scientific/historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 EU-GDPR, insofar as the right cited under section a) is likely to render the realisation of the aims of this processing impossible or seriously affect them, or
(5) to assert, pursue or defend legal claims.

e. The right to be informed
If you have asserted the right to rectification, deletion or restricted processing in relation to us, we are obliged to notify all recipients to whom your personal data has been disclosed of this rectification, deletion of data or restricted processing, unless this proves to be impossible or involves a disproportionate work/costs.

With respect to us, you have the right to be informed about these recipients.

f. Right to data portability
You have the right to receive personal data you have provided to us in a structured, usual and machine-readable format. In addition, you have the right to request that we transfer this personal information that has been provided to us, to another responsible party without hindrance, provided that 

(1) the processing is based on a consent in accordance with. Art. 6 para. 1 a EU-GDPR or Art. 9 para. 2 a EU-GDPR or on a contract in accordance with Art. 6 para. 1 b EU-GDPR and
(2) the processing is performed by automated means.

In exercising this right, you also have the right to obtain the personal data concerning you which is transmitted directly by us to another responsible party, insofar as this is technically feasible. This does not affect the freedoms and rights of others.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task in the public interest or in exercising official authority that has been delegated to us.

g. The right to oppose
You have the right at any time, for reasons arising from your particular situation, to oppose the processing of personal data concerning you which takes place in accordance with Art. 6 para. 1 e or f EU-GDPR; this also applies to profiling based on these provisions.

We no longer process personal information concerning you unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purposes of asserting, exercising or defending legal claims.

If personal data concerning you processed to operate direct mail, you have the right to object to the processing of your personal data for the purpose of such publicity at any time; this also applies to profiling insofar as it is associated with such direct mail.

If you object to processing for the purposes of direct mail, your personal data will no longer be processed for these purposes.

In connection with using the services of the IT company and notwithstanding Directive 2002/58/EC. You have the opportunity to exercise your right of opposition by means of automated procedures that use technical specifications.

h. Right to revoke the data protection consent form
You have the right to revoke your consent under data protection law at any time. The revocation of consent does not affect the lawfulness of processing carried out on the basis of the consent until the revocation.

i. Automated decision making, including profiling
You have the right not to be subject to a decision based solely on automated processing - including profiling - that will have legal effect or negatively affect you in a similar way. This does not apply if the decision

(1) is required in order to conclude or fulfil a contract between you and us
(2) is permitted by EU or Member State legislation to which we are subject, and this legislation provides for reasonable safeguards for protecting your rights and freedoms as well as your legitimate interests or
(3) where it takes place with your express consent.

However, these decisions must not be based on special categories of personal data in accordance with Art. 9 para. 1 EU-GDPR, unless Art. 9 para. 2 a or g EU-GDPR applies and reasonable measures have been taken to protect rights and freedoms as well as your legitimate interests.

With regard to the cases referred to in paras. 1 and 3 we shall take reasonable steps to safeguard the rights and freedoms as well as your legitimate interests. This includes at least the right to allow the intervention of one person on our part, in order to express our own position and to contest the decision.

j. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, especially in the Member State of your place of residence, employment or the place of alleged infringement, if you believe that the processing of your personal data violates the EU-GDPR.

Our competent supervisory authority is:

State Officer for Data Protection and Freedom of Information (Landesbeauftragte für den Datenschutz und die Informationsfreiheit)
Königstrasse 10 a
70173 Stuttgart
Deutschland

The supervisory authority where you have lodged a complaint shall inform you about the status and outcome of the complaint, including the possibility of a legal remedy in accordance with Art. 78 EU GDPR.

If you have any questions, please do not hesitate to contact our data protection officer.

December 2018