Privacy policy

1. Information on the collection of personal data
(1) This policy provides information on the collection of personal data when you use our website. Personal data is all data that relates to you personally, e.g. name, address, email addresses and user behaviour.
(2) When you contact us by email or via a contact form, the data you provide (your email address, name and telephone number) will be stored by us in order to answer your questions. We delete the data collected in this context once storage is no longer necessary or restrict processing if there are statutory retention obligations.
(3) Applications
You can look up vacancies in our company on our website and then apply for them via the job board and/or by email and/or by post. We will store the documents you send us for the duration of the application process. The legal basis is Section 26 (1) of the German Federal Data Protection Act (BDSG). We will store the documents you send us for the duration of the application process. If your application is unsuccessful, this is the case no later than six months after the completion of the application process. As soon as we intend to store the documents you send us beyond the duration of the application process, e.g. because we are considering your application for another vacancy, we will ask for your express consent. We use the digital recruitment service provided by heroes GmbH to manage job advertisements and applications; see section 15. We also use mobile recruitment technology from PitchYou GmbH; see section 16.
(4) We are obliged under commercial and tax law to store your address, payment and order data for a period of ten years. However, we restrict processing after two years, i.e. your data will only be used to comply with legal obligations.
(5) We encrypt your personal data using SSL technology to prevent unauthorised third-party access.
(6) The controller pursuant to Article 4 (7) of the European General Data Protection Regulation (GDPR) is GREIWING logistics for you GmbH, Carl-Benz-Str. 11–15, 48268 Greven, Germany, tel.: +49 (0)25 753 40, email: info@greiwing.de. You can contact our data protection officer at datenschutzbeauftragter@greiwing.de.

2. Your rights
(1) You have the following rights with regard to your personal data:
–     Right to information, Art. 15 GDPR
–     Right to rectification or erasure, Art. 16 and 17 GDPR
–     Right to restriction of processing, Art. 18 GDPR
–     Right to object to processing, Art. 21 GDPR
–     Right to data portability, Art. 20 GDPR.
(2) You also have the right to lodge a complaint with a supervisory authority about the processing of your personal data by us. The competent authority for us is the State Commissioner for Data Protection of North Rhine-Westphalia, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.

3. Collection of personal data when you visit our website
(1) When you use the website, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (the legal basis is point (f) of Article 6 (1) GDPR):
–     IP address
–     Date and time of the request
–     Time zone difference to Greenwich Mean Time (GMT)
–     Content of the request (specific page)
–     Access status/HTTP status code
–     Amount of data transferred in each case
–     Website from which the request was sent
(2) In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on the hard drive assigned to the browser you are using and through which certain information is sent to the entity that provided the cookie (in this case, us). Cookies cannot run programs or install viruses on your computer. They make the website more user-friendly and effective overall.
(3) Use of cookies:
a)     This website uses the following types of cookies, the scope and functionality of which are explained below: Technically necessary cookies and transient cookies (see b)
b)     Technically necessary cookies are essential in order to navigate the website, use basic functions and ensure the security of the website; they neither collect information about you for marketing purposes nor store which websites you have visited.
Transient cookies are automatically deleted when you close the browser. These include, in particular, session cookies. These store a so-called session ID, which can be used to assign various requests from your browser to the joint session. This allows your computer to be recognised when you return to our website. For example, the following data is stored and transmitted during a session: Storage of a login status, filling in multi-page forms, temporary storage of user entries, search parameters, display status of controls. Session cookies are deleted when you log out or close the browser.
c) The legal basis for cookies that are absolutely necessary in order to provide you with the expressly requested service is Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Any use of cookies that is not absolutely technically necessary constitutes data processing that is only permitted with your explicit and active consent in accordance with Section 25 (1) TDDDG in conjunction with point (a) of Article 6 (1) GDPR. This applies in particular to the use of performance, advertising, targeting or sharing cookies. In addition, we only pass on your personal data processed by cookies to third parties if you have given your express consent to this in accordance with point (a) of Article 6 (1) GDPR.
d) Further information on which cookies we use and how you can manage your cookie settings and deactivate certain types of tracking can be found in under section 13 of this policy. 
(4) If it is necessary for data processing to store information on your device or access information already stored on the device, Section 25 (1) and (2) TDDDG are the legal basis for this.

4. Additional functions and offers on our website
(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. As a rule, you must provide further personal data, which we use to provide the service in question and to which the aforementioned data processing principles apply.
(2) In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly audited.
(3) Within the scope of our business relationships, your personal data may be passed on or disclosed to third parties. These may also be located outside the European Economic Area (EEA), i.e. in third countries. Such processing takes place solely for the purposes of fulfilling contractual and business obligations and maintaining your business relationship with us (the legal basis is point (b) or (f) of Article 6 (1) in conjunction with Article 44 et seq. GDPR). This policy provides details of each disclosure at the relevant points below.
In some third countries, the European Commission certifies that the level of data protection is comparable to the EEA standard by means of so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. In so far as this is the case, we ensure that sufficient guarantees are in place to ensure the protection of data. This is possible via standard contractual clauses of the European Commission for the protection of personal data in accordance with Article 46 (1) and (2)(c) GDPR (the standard contractual clauses from 2021 are available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0915&locale-en), certificates or recognised codes of conduct. Please contact our data protection officer if you would like more information on this. 

5. Objection or withdrawal of consent to the processing of your data
(1) If you have given your consent to the processing of your data, you may revoke this consent at any time. Such a withdrawal affects the permissibility of the processing of your personal data after your withdrawal of consent.
(2) In so far as we base the processing of your personal data on a weighing of interests, you may object to the processing. This is the case, in particular, if the processing is not necessary for the performance of a contract with you, which is explained by us in each case in the description of the functions below. If you raise such an objection, we will ask you to explain the reasons why we should not process your personal data in the way we do. If your objection is justified, we will examine the situation and either cease or adapt the data processing or explain our compelling legitimate reasons for continuing to process the data.
(3) You can, of course, object to the processing of your personal data for advertising and data analysis purposes at any time. You can inform us of your objection to advertising using the following contact details: GREIWING logistics for you GmbH, Carl-Benz-Str. 11–15, 48268 Greven, tel. +49 2575 34–0, email: info@greiwing.de

6. Use of social media plug-ins
(1) We currently use the following social media plug-ins: Facebook, Instagram, LinkedIn, Xing. Our website uses the open source Shariff plug-in to improve data protection when social media buttons are integrated. Instead of integrating the social media buttons directly on our website, Shariff only establishes a connection to the servers of the social networks if you actively click on one of the social media buttons (consent). This means that no personal data is automatically passed on to the social networks when you visit our website. Only when you click on a social media button will your personal data be transmitted to that social network.
You can identify the provider of the plug-in by the marking on the box above its initial letter or logo. We are giving you the option to communicate directly with the provider of the plug-in via the button. Only if you click on and activate the marked field will the plug-in provider receive the information that you have accessed our website. The data specified in section 3 of this policy will also be transmitted. In the case of Facebook, according to the providers in Germany, your IP address is anonymised as soon as it is collected. When you activate the plug-in, personal data will be transmitted from you to the plug-in provider and stored there (in the case of US providers, the data will be stored in the USA). Since the plug-in provider collects data via cookies in particular, we recommend that you delete all cookies in the security settings of your browser before clicking on the greyed-out box.
(2) Please note that user data may be processed outside of the European Union. We have no influence over the data collected and data processing operations, nor are we aware of the full extent of data collection, the purposes of processing or the retention periods. We also have no information about the deletion of the collected data by the plug-in provider.
(3) The plug-in provider stores the data collected about you in a usage profile and uses it for the purposes of advertising, market research and/or website personalisation. Such an evaluation is carried out in particular (also for users who are not logged in) to display interest-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To do so, you must contact the plug-in provider in question. Using the plug-ins, you can interact with the social networks and other users so that we can improve our website and make it more interesting for you as a user. The legal basis for the use of plug-ins is point (a) of Article 6 (1) GDPR.
(4) The data is transferred regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, your data collected by us will be attributed directly to your existing account with the plug-in provider. If you click on the activated button and, for example, link to the page, the plug-in provider also stores this information in your user account and shares it with your contacts publicly. We recommend that you log out regularly after using a social network, especially before activating the button, as this will prevent an association with your profile with the plug-in provider.
(5) Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the privacy policies of the providers set out below. There you will also find further information about your rights in this regard and settings options to protect your privacy.
(6) Addresses of the plug-in providers and URLs with their data protection notices:
 a) Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; website: https://www.facebook.com. To the Facebook privacy policy: http://www.facebook.com/policy.php. The list and appearance of Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins.  
b) Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA; website: https://www.instagram.com. To the Instagram privacy policy: https://help.instagram.com/155833707900388.
c) LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
d) Xing: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; website: https://www.xing.de; privacy policy: https://privacy.xing.com/en/privacy-policy 

7. Integration of YouTube videos
(1) We have integrated YouTube videos into our website, which are stored on http://www.YouTube.com and can be played directly on our website. These are all integrated in ‘enhanced data protection mode’, which means that no data relating to you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos will the data specified in paragraph 2 be transmitted. We have no influence over this data transfer.
(2) When you visit the website, YouTube receives the information that you have accessed the corresponding sub-page of our website. The data specified in section 3 of this policy will also be transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether there is no user account. If you are logged into Google, your data will be assigned directly to your account. If you do not wish this data to be assigned to your YouTube profile, you must log out before activating the button. YouTube stores your data in a usage profile and uses it for the purposes of advertising, market research and/or website personalisation. Such an evaluation is carried out in particular (even for users who are not logged in) to display interest-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To do so, you must contact YouTube.
(3) The legal basis for the use of YouTube is point (a) of Article 6 (1) GDPR.
(4) Further information on the purpose and scope of data collection and processing by YouTube can be found in the privacy policy. There you will also find further information about your rights and setting options to protect your privacy: https://policies.google.com/privacy?hl=us. Google also processes your personal data in the USA.

8. Google Analytics
(1) This website uses Google Analytics, a web analytics service provided by Google, Inc. (‘Google’). Google Analytics uses cookies, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is active on this website, Google will truncate your IP address beforehand within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activities and providing other services relating to website and internet usage to the website operator.
(2) The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
(3) The legal basis for the use of Google Analytics is point (a) of Article 6 (1) GDPR.
(4) This website uses Google Analytics with the extension ‘_anonymizeIp()’. As a result, IP addresses are processed in truncated form, meaning that they cannot be traced to a particular individual. If the data collected about you contains a personal reference, this will be excluded immediately and the personal data will be deleted immediately.
(5) We use Google Analytics to analyse and regularly improve the use of our website. The statistics obtained enable us to improve our website and make it more interesting for you as a user.
(6) Information about the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001. Terms of service: https://marketingplatform.google.com/about/analytics/terms/us/ and the privacy policy: https://policies.google.com/privacy?hl=us.

9. Mobile.de vehicle management
(1) An iframe for the online vehicle marketplace mobile.de GmbH, Albert-Einstein-Ring 2–6, 14532 Kleinmachnow-Dreilinden, Germany is integrated into this website. We use mobile.de to offer the vehicles we have for sale (advertisements) on our website or on the online vehicle marketplace page. When you visit our website, a direct connection is established between your browser and the mobile.de server. mobile.de receives the information that you have visited our website with your IP address. If you call up the mobile.de iframe while you are logged into your mobile.de account, mobile.de may be able to associate your visit to our website with your user account. Please note that, as the provider of the website, we have no knowledge of the content of the transmitted data or how it is used by mobile.de.
(2) We use a ‘two-click solution’ to integrate the mobile.de website. This means that when you visit our website, no personal data is initially shared with mobile.de. We give you the option of communicating directly with the provider of the plug-in via the button ‘SHOW MOBILE.DE’. Only if you click on and activate the marked field will the plug-in provider receive the information that you have accessed our website.
(3) The legal basis for the use of mobile.de is point (a) of Article 6 (1) GDPR.
(4) Further information can be found in the privacy policy of mobile.de at https://www.mobile.de/en/service/privacyPolicy. If you do not want mobile.de to be able to associate your visit to our website with your mobile.de user account, please log out of your mobile.de account.

10. Google Maps
(1) We use Google Maps on this website. This allows us to display interactive maps directly on the website and enables you to use the convenient map tool.
(2) When you visit the website, Google receives the information that you have accessed the corresponding sub-page of our website. The data specified in section 3 of this policy will also be transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether there is no user account. If you are logged into Google, your data will be assigned directly to your account. If you do not wish this data to be assigned to your Google profile, you must log out before activating the button. Google stores your data in a usage profile and uses it for the purposes of advertising, market research and/or website personalisation. Such an evaluation is carried out in particular (even for users who are not logged in) to display interest-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To do so, you must contact Google.
(3) The legal basis for the use of Google Maps is point (a) of Article 6 (1) GDPR.
(4) Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider’s privacy policy. There you will also find further information about your rights in this regard and settings options to protect your privacy: https://policies.google.com/privacy?hl=us. Google also processes your personal data in the USA.

11. Google Tag Manager
Google Tag Manager is a solution that allows marketers to manage website tags from an interface. The tool that implements the tags is a cookie-free domain and does not collect any personal data. The tool activates other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager; see https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

12. Hosting
This website is hosted by an external service provider (a host). The personal data collected on this website is stored on the host’s servers. This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated through a website.
The host is used for the purpose of fulfilling a contract vis-à-vis our potential and existing customers (point (b) of Article 6 (1) GDPR) and in the interest of the secure, fast and efficient provision of our online services by a professional provider (point (f) of Article 6 (1) GDPR).
Our host will only process your data to the extent necessary to fulfil its performance obligations and follow our instructions in relation to this data.
We use the following host:
NETZCOCKTAIL GmbH
Dorpatweg 10
48159 Münster, Germany
 

13. ISSUU
(1) Our website uses the application from Issuu Inc., Palo Alto, CA 94301, USA (‘Issuu’). This allows you to view catalogues in e-paper format. Issuu uses cookies that make it possible to analyse how you use the website. In this way, Issuu collects and stores personal data such as your IP address and information about the time and duration of your visit. The data is transmitted to an ISSUU server in the USA. The transfer takes place if you have activated JavaScript in your browser. Further information on Issuu’s terms of use and data protection can be found here: https://issuu.com/legal/privacy.
(2) The legal basis for the use of ISSUU is point (a) of Article 6 (1) GDPR.

14. Google reCAPTCHA
We use Google reCAPTCHA (‘reCAPTCHA’) on this website. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.
The purpose of reCAPTCHA is to check whether data is being entered on this website (e.g. in a contact form) by a human or an automated program. For this purpose, reCAPTCHA analyses the behaviour of the website visitor on the basis of various characteristics. This analysis begins automatically as soon as the visitor accesses the website. For the purposes of analysis, reCAPTCHA evaluates various information (e.g. the data mentioned under section 3 of this policy, the length of time the visitor stays on the website or mouse movements made by the user). The data collected during the analysis is transmitted to a Google server in the USA and processed there.
The reCAPTCHA analyses run entirely in the background. Website visitors are not informed that an analysis is taking place.
Data is stored and analysed on the basis of point (a) of Article 6 (1) GDPR and Section 25 (1) TDDDG, in so far as the consent includes the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.
Further information on Google reCAPTCHA can be found in Google’s privacy policy and terms of use at the following links: https://policies.google.com/privacy?hl=us and https://policies.google.com/terms?hl=us.

15. heroes e-recruiting
(1) We use the Heroes e-recruitment service on this website for application purposes. If you click on a job advertisement on our website, you will be redirected to our recruitment portal with your consent. In this case, a connection is established with the servers of heroes GmbH. The technical operator is heroes GmbH, Welfenstrasse 22, 81541 Munich, Germany. In the course of this, the following data is transmitted to heroes:
–     Your IP address
–     Date and time of the request
–     Information about your browser
–     Information about your device
–     External link that was clicked on
The legal basis for processing is point (a) of Article 6 (1) GDPR.
(2) Data collected on our recruitment portal (https://greiwing.recruiting-portal.com/) will be processed exclusively for the purposes of your application. This includes your email address, first and last name, date of birth, telephone number and other application documents submitted by you. We will store the documents you send us for the duration of the application process. If your application is unsuccessful, we will delete the documents you uploaded no later than six months after the end of the application process. If we intend to retain the documents you sent us beyond the duration of the application process, e.g. to consider your application for another vacancy, we will ask for your express consent for this. The legal basis for processing is point (a) of Article 6 (1) GDPR and Section 26 BDSG.
(3) Further information on the purpose and scope of data collection and processing by Heroes, including how to object, can be found in the privacy policy of Heroes: https://heroes.eu/datenschutzerkl%C3%A4rung

16. PitchYou
(1) When you respond to a job advertisement, we offer the option of applying via WhatsApp Messenger. With your consent, the PitchYou service is used for this purpose, which forwards the applicant’s data from WhatsApp to the recruitment service. The provider of this service is PitchYou GmbH, Campusallee 9, 51379 Leverkusen, Germany. The legal basis for processing is point (a) of Article 6 (1) GDPR.
(2) Communication via WhatsApp is end-to-end encrypted. This means that the content of the communication is protected. Only the information that communication has taken place between your number and the number of the PitchYou bot is transmitted to WhatsApp. By accepting the terms of use of WhatsApp when installing WhatsApp, you have already agreed to this.
The storage of communication metadata in the USA is covered by the current Data Privacy Framework (DPF) pursuant to Article 45 GDPR. As the legal situation regarding data transfers with the USA has already changed several times as a result of ECJ rulings, PitchYou also explicitly refers to the risks of data storage in the USA when you grant consent.
(3) The data subsequently collected via PitchYou will only be processed for the purposes of your application. This includes all application documents submitted by you. We will store the documents you send us for the duration of the application process. If your application is unsuccessful, we will delete the documents you uploaded no later than six months after the end of the application process. If we intend to retain the documents you sent us beyond the duration of the application process, e.g. to consider your application for another vacancy, we will ask for your express consent for this. The legal basis for processing is point (a) of Article 6 (1) GDPR and Section 26 BDSG.
(4) Further information on the purpose and scope of data collection and processing by PitchYou, including how to object, can be found in the privacy policy of PitchYou: https://www.pitchyou.de/en/data-privacy and the data protection notice of PitchYou: https://www.pitchyou.de/en/pitchyou-gdpr