Introduction
The companies ARCFLOW AG and ARCFLOW GmbH take the protection of personal data serious. Therefore, we explain below in accordance with the „European General Data Protection Regulation“ (EU-GDPR) in what way personal data is collected and processed by us.
Legal basis
The storage and processing of the accruing „technical data“ (see „Log files and the gathering of personal data“) is based on article 6 of the GDPR „lawfulness of processing“, paragraph 1 letter f:
„Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.“
Definitions (in accordance with Art. 4 GDPR, excerpts)
For the purposes of this Regulation:
- „personal data“ means any information relating to an identified or identifiable natural person („data subject“); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- „processing“ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
- „filing system“ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
- „controller“ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
- „processor“ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
- „third party“ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
- „consent“ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
- „enterprise“ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;
- „group of undertakings“ means a controlling undertaking and its controlled undertakings;
Log files and the gathering of personal data
When using our online services, our Apache web server and spam filter (own development) saves personal data in log files. This data can be used to identify the user by the IP address.
The Apache web server is using the „combined“ log file format. An entry of a log file contains basically the following data:
- IP address
- Date and time of access
- Accessed web page or static file
- File size
-
User agent
(Information about product and version of the program used to access our online services).
These data are hereinafter referred to as „technical data“.
Log files are stored exclusively in areas where public access is not possible. These data can only be used by authorized persons in the context of technical processes.
Operational safety of our website and processing of personal data
For the operational safety of our website and to be able to protect ourselves against spam attacks, the „technical data“ contained in the log files (see above „Log files and the gathering of personal data“) are evaluated manually. The log files are
- Checked manually to identify spam or attempts of attacks weekly.
- Deleted after two weeks, no later than the end of the month or the beginning of the following month.
- Not further processed for other purposes. For additional information see „User behaviour - No user tracking“.
- Processed in our house exclusively. A passing on to third does not take place.
User behaviour – No user tracking
An evaluation of the log files in relation to the respective user behaviour, for example, which web pages were retrieved by a user, is not done. For the protection of the user of our services, we do not use any tracking code or similar technics in our websites and do not use analysis products, such as „Google Analytics“.
Cookies
A cookie is a piece of information sent from the web server and stored on the user’s computer. The information can be retrieved if necessary. Cookies are used to store configurations or information about users to track them.
We don’t use cookies for user tracking. The „Content Management System“ (CMS) we use, stores configurations and use these information to control and display our web content.
Contact form(s)
So that the users of our online offer can easily get in touch with us, we offer so-called contact forms in various places. When using these contact forms, personal data is collected. These are the name and surname of the user, address, e-mail address, etc. These data are hereinafter referred to as „personal data“. The transmission of the data takes place via a protected encrypted https connection.
In order for a request to be processed and for the purpose of contacting the requester, the fields marked with ‘*’ in the contact form must be filled in. By submitting the entered data, the user gives us his consent to contact and to store this data. The submission of the consent is logged.
The data submitted to us are cached in the CMS and forwarded by e-mail to the processor. The form data cached by the CMS, i.e. your personal data transmitted to us, are manually checked at least every two weeks and deleted afterwards.
In general, we only use the form data submitted to us to get in touch with the submitting person. Further processing of the data or a transmission to third parties will not take place. After processing the data or successfully contacting the person, the email and the form data contained therein will be deleted.
The storage of personal data takes place exclusively in areas to which public access is not possible. This data can only be used by authorized persons in the context of technical or commercial processes.
In several places we use links to XING. By clicking those links a person will be redirected to our XING company entry or a XING user group. Since this is done by links and not by „social media plugins“, no user data is transmitted to XING. You can read the XING privacy policy at „XING Privacy Policy“.
Transmission of personal data
There will be no transmission of technical or personal data to third parties, unless there is an explicit consent of the user. Insofar as we are legally obliged to do so or by court order, we will forward your data to authorized sources.
Deletion of personal data
If you have provided us with personal data, you can have them deleted at any time. Data that cannot be deleted due to legal regulations can be blocked. Due to the blocking, this data will no longer be used in the future.
Website owners
Daeniken/Roedermark, 17. Mai 2018
Monitor Digital Ltd.