Below you will find the information that has to be provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (“GDPR”) on the processing of your personal data when you visit (hereinafter “you” or “your”) our website https://www.kostal.com (hereinafter each referred to as “Website”) by Leopold KOSTAL GmbH & Co. KG (hereinafter “we” or “us”).
A. Data controller and data protection officer
Leopold KOSTAL GmbH & Co. KG, An der Bellmerei 10, 58513 Lüdenscheid, info@kostal.com, Telefon +49 (0)2351 16 0.
Data Protection Officer of the KOSTAL Group, An der Bellmerei 10, 58513 Lüdenscheid, dataprotection@kostal.com
B. Information on the processing of personal data
Below you will find information on the processing of your personal data for the purposes specified in more detail there and, for example, about the legal basis for this processing. If the legal basis for the processing specified there is the balancing of interests, you can request additional information about the balancing of interests carried out by us using the contact details specified in Section A.
I. Use of the Website
1. Use of the Website for information purposes
When you visit our Website, we process the IP address of your device for technical reasons, i.e. in order to be able to display the Website at all. We cannot provide the Website content accessed without the provision of this data.
In order to protect our IT infrastructure, we also process the IP address of your device, the type and version of the internet browser used by you, information on the operating system of your device, information on the pages accessed, the site previously visited (referrer URL) and the access date and time and store this information in so-called log files.
The legal basis of this processing is the balancing of interests (point (f) of Article 6 paragraph 1 of the GDPR). Our legitimate interest for this processing is the provision of the Website content accessed by you and the protection of the IT infrastructure used to provide the Website, in particular to identify, remedy and document IT disruptions (e.g. DDoS attacks) for evidence purposes. For more information please refer to the contact details specified in Section A.
The recipient of these data is our hosting provider Microsoft Azure, which acts for us as processor. A further recipient is comspace GmbH & Co. KG, which likewise acts as processor and has been commissioned with the development of the Website as well as its maintenance and servicing.
We generally store these personal data in the log files for 3 (three) months. In the case of any security-relevant event (e.g. an attack), we also store the log files until the security-relevant event has been eliminated and clarified in full.
2. Sitecore
To provide this website we use the web content management system Sitecore, which provides analysis functions to evaluate the surfing behaviour. For this purpose, cookies are used to generate information about the use of this website. This information stored in a database on a server of a service provider contractually bound to us. The collected data is anonymized by technical means (e.g. by deleting the last digits of the IP address), including the anonymized IP address (anonymization is achieved by deleting the last digit).
The legal basis for the use of Sitecore is the balancing of interests (point f of Art. 6(1) GDPR). Our legitimate interest is the provision of the website content accessed by the user and the protection of the IT infrastructure used to provide the website.
You can prevent the installation of cookies by setting your browser software accordingly. This is described in Section D.2. However, we would like to point out that this may mean that not all functions of this website can be used to their full extent.
The recipient of this data is our hosting provider Microsoft Azure, which acts as an order processor for us. Another recipient is Sitecore, which also acts as an order processor.
We generally store this personal data in the log files for thirty (30) days. In the event of a security-relevant event (e.g. an attack), we store the log files until the security-relevant event has been eliminated and fully clarified.
3. Usercentrics
The Usercentrics Consent Manager is used by us to manage your consents, possible revocations of consents and objections to the use of cookies.
The data processing in this context is carried out to manage the user decisions regarding cookies (consent, revocation, opt-out) and to ensure the security of the application.
The IP address of your terminal device, the type and version of the Internet browser you are using, information about the operating system of your terminal device, information about the pages accessed, the previously visited page (referrer URL) and the date and time of access are processed. In addition, the user's decision on individual cookies or groups of cookies is stored at the time of the decision and the last visit.
Legal basis for the processing of the balance of interests (point f of Art. 6(1) GDPR). Our legitimate interest is the simple and reliable control of Cookies.
The recipient of the data is Usercentrics GmbH, which acts as our order processor.
We store the data for a period of 6 months. The revocation of a previously given consent is stored for three years (accountability). Server log data is anonymized before storage.
We would like to point out that it is not possible to use the website without transmitting personal data, such as the IP address. An automatic decision-making process for consenting to the use of cookies does not take place.
II. Job vacancies
You can also find links to job vacancies on our Website. These links lead to an external website for which a separate data protection statement applies. You can find this here.
III. Login for employees
On our website we offer employees the opportunity to inform themselves in an internal area about current internal company activities, instructions, benefits and agreements. For authentication it is necessary to enter personal data such as name and personnel number. The data will only be used for authentication purposes and will not be stored beyond this. The processing of personal data serves to authenticate and prevent the transfer of internal information to third parties.
The legal basis for the collection is the balancing of interests (point (f) of Article 6 paragraph 1 of the GDPR). Our legitimate interest in this case is to protect our company secrets. The recipient of this data is comspace GmbH & Co. KG, which acts as a processor and is responsible for the development of the website and its maintenance and servicing.
IV. Analysis of behaviour on the Website using Google Analytics
If you have given your consent, we use the web analysis tool “Google Analytics” to record and analyse usage behaviour on our Website by means of cookies (see Section C). Google Analytics is a service provided by Google LLC (“Google”), which is headquartered in the USA. The personal data collected with the help of these cookies include your IP address as well as information about the subpages visited, visit duration and the website via which you reached our site and the website you access after visiting our Website. There is no obligation to provide these data. If these data are not provided, we cannot measure web audience.
This processing serves the optimisation of the Website by analysing your usage behaviour on our Website. We can, for example, based on the frequency with which subpages are accessed, identify which content is particularly interesting for our Website visitors and which content has to be placed differently, for example, in order to be seen by visitors.
It is technically necessary that your full IP address is transmitted to Google. However, we use so-called IP anonymization. This means that your IP address is shortened immediately after transmission to Google as our processor and is no longer stored by Google. It is then no longer possible to identify the user of the device.
Based on this shortened IP address and the information contained in the cookies, Google prepares the aforementioned analysis of usage behaviour on our Website. As a rule, it is not possible for us to identify you as an individual based on this usage profiles. We do not know which pseudonym you have been given. Therefore, based on the usage profiles of Google Analytics, we are generally unable to identify what specific actions you have taken on the Website.
The legal basis for this processing, including the setting and reading of cookies, is consent to be given separately by you (point (a) of Article 6 paragraph 1 of the GDPR)). You can withdraw this consent by deleting the cookies. This is described in Section D.II.
The data described in this Section B.IV can be transmitted to Google in the USA. For the purposes of EU data protection law, the USA is not considered a safe third country. We would like to point out that US companies are obliged to hand over personal data to security authorities without giving the data subject the possibility to take legal action against this.
We have no influence on this processing activity and it cannot be ruled out that US authorities (e.g. intelligence services) may process, evaluate and permanently store your data located on US servers for monitoring purposes.
We store profiles for 26 (twenty-six) months.
C. Third-party provider plug-ins
The third-party provider plug-ins described in I and II below are embedded in our Website. These enable you to use certain services of external provider directly on our Website. The providers specified below have sole responsibility for these third-party provider plug-ins.
Plug-in providers can (similar to accessing an external website via a link) in particular receive your IP address and the address (URL) of the website from which you access the plug-in. If you are registered with the third-party provider as a user, the plug-in provider can usually also assign the data received to your user account.
I. Google Maps
The map service Google Maps is embedded in our Website. Google is the third-party provide of this plug-in. Information on Google Maps can be found here. Google’s privacy policy can be found here, where you can find information about the processing of personal data by Google.
Information about the transfer of personal data to the USA can be found in Section B.V.
II. YouTube
The video player YouTube is also embedded in our Website. The third-party provider of this plug-in YouTube LLC, a company under US law. Information about YouTube can be found here. YouTube LLC’s privacy policy can be found here, where you can find information about the processing of personal data by Tube LLC.
YouTube is a subsidiary of Google. The information about the transfer of personal data to the USA in Section B.V. therefore also applies accordingly to the use of the YouTube content embedded in our Website.
D. Use of cookies
When you use our Website, we store cookies in your device’s browser, unless you prohibit this with appropriate settings in your browser.
I. General information on Cookies
Cookies are small text files containing information which can be placed on the user’s device via its browser when a website is visited. When the website is visited again with the same device, the cookie and the information stored in it can be read.
Generally and also in the description of the individual cookies used by us in Section D.III, a distinction is made between (i) first-party and third-party cookies, (ii) transient and persistent cookies as well as (iii) cookies that do not require consent and those that do require consent.
First-party cookies are cookies placed by us or a processor commissioned by us, whereas third-party cookies are cookies that are placed and accessed by another controller.
Transient cookies are deleted when you close your browser, whereas persistent cookies are cookies that are stored on your device for a specific period of time.
Cookies that do not require consent are cookies whose sole purpose is to transmit a message via an electronic communications network. Cookies that are strictly necessary so that the provider of an information society service expressly requested by the subscriber or user can make this service available do not require consent either (also referred to as “strictly necessary cookies”). All other cookies require consent.
II. Cookie management
If the user’s consent is required for the use of certain cookies, we only place these cookies when you use the Website if you have given your consent to this beforehand. Please refer to Section D.III for information about whether the use of a cookie requires consent.
When you visit our Website, we display a so-called cookie banner in which you can give your consent to the use of cookies on this Website. By clicking on the button provided for this, you have the possibility to consent to the use of all cookies requiring consent described in detail in this Section D.III of this cookie information.
We likewise store your consent and, where applicable, your individual selection of cookies requiring consent in an additional cookie (“opt-in cookie”) on your device so that we can determine whether you have already given your consent when the Website is accessed again. The opt-in cookie is valid for a limited period of 1 (one) month.
Strictly necessary cookies cannot be deactivated with the cookie management function of this Website. However, you can at any time deactivate these cookies generally in your browser.
You can also manage the use of cookies in your browser settings. Additional detailed information can, for example, be found at http://www.allaboutcookies.org/manage-cookies/.
When you deactivate the storage of cookies in your browser, some Website functions may no longer work or no longer work properly.
III. Cookies used on this Website
Below we provide you with information about the cookies we use.
1. Name: cookieconsent_status
Purpose and content: Strictly necessary opt-in cookie (see Section D.II above) used to store your consent and, where applicable, your individual selection for the use of cookies on your device, in order to determine whether you have already given your consent when the Website is accessed again.
- Responsibility: First-Party
- Validity: persistent (1 month)
- Consent required: no
Legal basis under data protection law: Balancing of interests (point (f) of Article 6 paragraph 1 of the GDPR). Our legitimate interest is the management of cookie consents given by the user for this Website.
2. Name: _ga
Purpose and content: For use with Google Analytics (see Section B.IV), used to differentiate users by means of an assigned ID.
- Responsibility: First-Party
- Validity: persistent (2 years)
- Consent required: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
3. Name: _gid
Purpose and content: For use with Google Analytics (see Section B.IV), used to differentiate users by means of an assigned ID.
- Responsibility: First-Party
- Validity: persistent (24 hours)
- Consent required: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
4. Name: _gat_UA-81341348-4 / gat_UA-81441348-5 (regarding to www.kostal.com) and gat_UA-81341348-3 (regarding to www.kostal-automobil-elektrik.com)
Purpose and content: For use with Google Analytics (see Section B.IV), used to throttle the request rate, i.e. the maximum number of requests that can be sent to Google’s servers.
- Responsibility: First-Party
- Validity: persistent (1 minute)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
5. Name: ASP.NET_SessionId
Purpose and content: When the Website is visited, each visitor is assigned an individual ID for the duration of the visit. Your input and your behaviour on the Website are assigned to this ID by our web server. It is, for example possible, to associate your input with you while you navigate through the Website.
- Responsibility: First- Party
- Validity: transient
- Requires consent: no
Legal basis under data protection law: Balancing of interests (point (f) of Article 6 paragraph 1 of the GDPR). Our legitimate interest is providing the informational function of the Website requested by the user.
6. Name: SC_ANALYTICS_GLOBAL_COOKIE
Purpose and content: This cookie is used to recognise returning users by means of an assigned ID.
- Responsibility: First-Party
- Validity: persistent (2 years)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
7. Name: __RequestVerificationToken
Purpose and content: This cookie is used to prevent, by means of an assigned ID, unauthorised content being published on the Website (cross-site request forgery).
- Responsibility: First- Party
- Validity: transient
- Requires consent: no
Legal basis under data protection law: Balancing of interests (point (f) of Article 6 paragraph 1 of the GDPR). Our legitimate interest is ensuring the security of our Website.
8. Name: kostalgroup#lang (regarding to www.kostal.com) and kostalautomobilelektrik#lang (regarding to www.kostal-automobil-elektrik.com )
Purpose and content: Stores the language chosen by you on the Website.
- Responsibility: First-Party
- Validity: transient
- Requires consent: no
Legal basis under data protection law: Balancing of interests (point (f) of Article 6 paragraph 1 of the GDPR). Our legitimate interest is providing the informational function of the Website requested by the user.
9. Name: 1P_Jar
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: persistent (six (6) months)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
10. Name: GPS
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: persistent (one (1) day)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
11. Name: DV
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: persistent (one (1) day)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
12. Name: CONSENT
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: persistent (nineteen (19 years)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
13. Name: Nid
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: persistent six (6) months)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
14. Name: PREF
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: persistent (two (2) years)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
15. Name: VISITOR_INFO!_LIVE
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: persistent (six (6) months)
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
16. Name: YSC
Purpose and content: This cookie is used for the YouTube plug-in (see Section C.II) in order to be able to embed videos on our website.
- Responsibility: Third-Party
- Validity: Session
- Requires consent: yes
Legal basis under data protection law: Consent (point (a) of Article 6 paragraph 1 of the GDPR).
17. Name: cookie_notice
Purpose and content: absolutely necessary opt-in cookie (see Section D.II above) for storage of your consent and, where applicable, your individual settings for the use of cookies on your device, in order to establish whether you have already given your consent when you visit the Website again.
- Responsibility: first party
- Validity: persistent (one (1) month)
- Requires consent: no
Legal basis under data protection law: Balancing of interests (point (f) of Article 6 paragraph 1 GDPR). Our legitimate interest is our the management of cookie consents given by the user for this Website.
18. Name: kosemp_l
Purpose and content: In order to visit the login area for employees, the respective user must be authenticated. This authentication is assigned to the user for the duration of the visit in order to prevent unauthorized use.
- Responsibility: First-Party
- Validity: transient
- Requires for consent: no
Legal basis under data protection law: balancing of interests (point (f) Article 6 paragraph 1 GDPR). Our legitimate interest is to make the internal user platform available only to authorised persons (employees) and to protect it from external access.
19. Name: privacy-notification
Purpose and content: The cookie keeps track of whether or not the visitor consents to Sitecore tracking.
- Responsibility: first party
- Validity: persistent (one (1) year)
- Requires consent: no
Legal basis under data protection law: Balancing of interests (point (f) of Article 6 paragraph 1 GDPR). Our legitimate interest is to ensure that tracking only takes place with prior consent.
E. Information on the rights of data subjects
As a data subject, you have the following rights with respect to the processing of your personal data. You can contact us for the purpose of exercising your rights using the contact details in Section A:
- A right to obtain access to and information (Article 15 GDPR) about which personal data from you we process. This includes additional information on the data processing, such as the purpose and legal basis as well as the recipients of these data. You also have the right to request a copy of these data.
- A right to obtain from us the rectification of inaccurate personal data concerning you and the completion incomplete personal data concerning you (Article 16 of the GDPR).
- A right to obtain the erasure of personal data concerning you in the cases provided for by law (Article 17 of the GDPR), such as when the data are no longer needed for the purposes for which they were collected or have been unlawfully processed.
- A right to obtain the restriction of processing in the cases provided for by the law (Article 18 of the GDPR).
- A right to receive the personal data concerning you that we process on the basis of consent which has been given or for the performance of a contract (see Section B) in a structured, commonly used and machine-readable format (right to data portability, Article 20 of the GDPR).
- A right to withdraw the consent given to us at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.
- A right to lodge a complaint with a supervisory authority (Article 77 of the GDPR). A list of the data protection supervisory authorities and their addresses can be found here.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (f) of Article 6 paragraph 1 of the GDPR (see Section B). We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
The above rights do not necessarily apply to you without limitation in every case. The law provides for restrictions in each case. You can find the full extent of your rights in the Articles of the GDPR specified above, which you can access by using the following link:
http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.
Last modified: 20th of January 2021
