Skip to main content

Privacy Policy

Data protection is very important to us. Your personal data is collected and processed in compliance with the applicable data protection regulations, particularly those set down in the General Data Protection Regulation (GDPR).

Last updated: May 2020

1. NAME AND CONTACT DETAILS OF THE DATA CONTROLLER

The data controller is:

C + P Möbelsysteme GmbH & Co. KG
Boxbachstrasse 1
35236 Breidenbach, Germany

Phone: +49 (0)6465 / 919-0
Email: info(at)cp.de

Data protection officer prescribed by law:

The data protection officer appointed by our company is:

Peter Christian Felst
Mazars Rechtsanwaltsgesellschaft mbH
Domstrasse 15
20095 Hamburg, Germany

Phone: +49 (0)40 28801 - 3290
Email:  datenschutz.hamburg@mazars.de

2. PERSONAL DATA

Personal data is information that can be used to obtain personal or factual information about you, such as your name, address, phone number, or email address.

3. EXTENT AND PURPOSE OF DATA PROCESSING

3.1. Server log data

When you view our website, your internet browser automatically sends data to the server of this website where the data is stored for a limited period of time in what is known as a ‘log file’. The following data, to name but a few examples, is stored until it is automatically deleted:

  • IP address of the visitor’s device
  • Date and time the visitor accessed this website
  • The web page from which the visitor accessed this website
  • The browser and operating system of the visitor’s device and the name of the service provider the visitor is using

Processing of this personal data is a legitimate interest pursuant to Art. 6 (1) (f) of the GDPR. The legitimate interest lies in ensuring the website’s security and stability.

3.2 Contact form

If you use the contact form on the website to contact us, we will process the personal data you provide us with (including your name and contact details). We use this data only for the purpose of processing your contact request.

The legal basis for processing is Art. 6 (1) (a) and (f) of the GDPR. Processing is necessary for communication with you and is a legitimate interest of the company.

3.3 Product configurator

A product configurator is also made available to you on the website. It allows you to configure our products and send us inquiries. The personal data you enter will be passed on to a C + P authorized dealer for the purpose of processing product inquiries and make contact with you in order to answer your question.

The legal basis for processing is the necessity to implement pre-contractual measures according to Art. 6 (1) (b) of the GDPR.

3.4 Data processing during the application process

Any personal data you provide in the context of an application (including your name, contact details, and application documents) will only be processed for the purposes of processing the application and in order to shortlist candidates for an employment relationship. Your data will not be used for other processing purposes.

The legal basis is the implementation of pre-contractual measures according to Art. 6 (1) (b) of the GDPR in conjunction with Section 26 of the German Federal Data Protection Act.

3.5 Google Analytics

This website uses functions of Google Analytics, the web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses cookies. The information relating to your use of this website generated by the cookies is generally transmitted to and stored on a Google server in the United States.

We have activated the IP anonymization function on this website. This means that Google truncates your IP address before transmission to the United States within member states of the European Union or other states that are parties to the Agreement on the European Economic Area. The full IP address is only transmitted to a Google server in the United States and truncated there in exceptional cases. Google uses this information on behalf of the operator of this website for the purpose of evaluating your use of this website, compiling reports on website activities, and providing the website operator with other services relating to website and internet use. The IP address transmitted by your browser in the context of Google Analytics will not associated with any other data held by Google.

You may prevent the storage of cookies by selecting the appropriate settings in your browser software. However, please note that if you do so, you may not be able to use all of the functions of this website in full. You can also prevent Google’s collection, processing and use of data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser plugin available at: https://tools.google.com/dlpage/gaoptout?hl=en-US.

More information about how Google Analytics handles user data in Google’s privacy policy is available at https://support.google.com/analytics/answer/6004245?hl=en.

Google Analytics is used in accordance with Art. 6 (1) (f) of the GDPR. The website operator has a legitimate interest in analyzing user behavior to optimize both their website and their advertising activities.

3.6 YouTube functions

The provider of this website uses components (videos) provided by YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, USA, a company of Google Inc., of Amphitheatre Parkway, Mountain View, CA 94043, USA.

The “Privacy-Enhanced Mode” option provided by YouTube is used for this purpose.

If you view a page with an embedded video, a connection is established with YouTube servers and the content is shown on the web page by notifying your browser.

According to YouTube, in “Privacy-Enhanced Mode” data (particularly which of our web pages you have visited) is only transmitted to the YouTube server when you watch the video. If you are logged into YouTube at the same time, this information will be associated with your YouTube member account. You can prevent this happening by logging out of your member account before visiting our website.

Google provides more information about YouTube’s privacy policy at https://policies.google.com/privacy?hl=en.

YouTube components are used in accordance with Art. 6 (1) (f) of the GDPR. The website operator's legitimate interest is effectively providing users with information, communicating with users, and presenting the company profile online.

3.7 LinkedIn Insight Tag

This website uses the “LinkedIn Insight Tag”, a conversion tool provided by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). This enables targeted advertising outside this website without identifying you as a website user. This is used to analyze and optimize our website, particularly retargeting (i.e. renewed advertising on other websites and allocation to target groups).

In connection with this service, we process your personal data as follows:

a) Purpose of processing

We process your personal data to use the LinkedIn Insight Tag to show ads.

b) Legal basis of processing

Processing of your personal data for the use of the LinkedIn Insight Tag for showing ads is based on your consent pursuant to Art. 6 (1) (a) of the GDPR. You can revoke your consent at any time in the cookie settings. 

c) Recipients / categories of recipients of your personal data

We disclose your personal data to LinkedIn.

d) Storage period of your personal data

We store your personal data for as long as is necessary for the use of the LinkedIn Insight Tag for showing ads

e) Reference to third countries regarding processing of your personal data

LinkedIn processes your personal data in the USA. The USA does not offer an adequate level of data protection. However, any transfer of personal data shall take place in compliance with the conditions set out in Arts. 44 – 50 of the GDPR and the other provisions set out in the GDPR to ensure that the level of protection for natural persons ensured thereby is maintained.

More information about LinkedIn’s standard contractual clauses is available at

https://www.linkedin.com/help/linkedin/answer/62533/eu-eea-and-swiss-data-transfers

 f) Obligation to provide your personal data

You are not obligated to disclose personal data. The above tracking function through the LinkedIn Insight Tag is only possible if you have enabled it.

You can learn more about the data that is processed through the use of LinkedIn by reading the entire privacy policy at

https://www.linkedin.com/legal/privacy-policy

3.8 Pinterest Web Analytics

We use Pinterest Web Analytics, a web analytics program, on our website. The service provider is Pinterest Inc., an American company, which also has an Irish registered office with the address Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. When you visit a page containing a plugin such as this, your browser establishes a direct connection to Pinterest’s servers. The plugin transmits log data to the Pinterest server in the USA. This log data may include your IP address, the address of websites you visit that also contain Pinterest features, the browser type and settings, the date and time of the request, how you use Pinterest, and cookies.

Processing of your personal data by Pinterest Web Analytics is based on your consent pursuant to Art. 6 (1) (a) of the GDPR. You can revoke your consent at any time in the cookie settings. 

Following the discontinuation of the EU-US Privacy Shield framework, data transfer to the USA can at best be based on standard contractual clauses issued by the European Commission and further guarantees. Pinterest therefore uses standard contractual clauses as a basis for data processing with recipients based in third countries (outside of the European Union, Iceland, Liechtenstein, Norway, thus in particular in the USA) or a data transfer there (= Art. 46 (2) and (3) of the GDPR). Standard contractual clauses (SCCs) are templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). 

Through these clauses, Pinterest undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. 

More information about Pinterest’s standard contractual clauses is available at https://policy.pinterest.com/en/privacy-policy#section-residents-of-the-eea.

To learn more about the data processed through the use of Pinterest Web Analytics, please refer to the full privacy policy at https://policy.pinterest.com/en/privacy-policy.

3.9 Facebook pixel

We use the Facebook pixel from Facebook (from Meta Platforms Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA, with a further subsidiary at: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin, Dublin 2, Ireland) on our website. We have added a code to our website for this purpose. This is a JavaScript code (pixel) that enables certain functions on the site. If you have accessed our website through Facebook ads, Facebook can track your usage actions via the Facebook pixel. For example, if you purchase a product on a website, the Facebook pixel is triggered and stores your actions on the website in one or more cookies. The following data is collected during this process:

  • Ads viewed
  • Content viewed
  • Device information
  • Geographical location
  • HTTP header
  • Interactions with the ad(s), services and products
  • IP address
  • Elements clicked on
  • Marketing information
  • Non-confidential custom data
  • Pages visited
  • Pixel ID
  • Referrer URL
  • Marketing campaign success
  • Usage data
  • User behavior
  • Facebook cookie information
  • Facebook user ID
  • Usage / click behavior
  • Browser information

Provided that you have a Facebook account, Facebook can match the data with your Facebook account data. This data collected using the Facebook pixel is anonymous for us and only becomes usable for us when we want to place ads. If you are logged in as a Facebook user when you access our website, your visit to our website will be assigned to your Facebook account.

The purpose of using the Facebook pixel is to better tailor our advertising measures to your wishes and interests. This enables us to show personalized advertising to you. Facebook collects your data for data analysis and tracking purposes, and for the purpose of implementing its own advertising measures. 

The legal basis is your consent pursuant to Art. 6 (1) (a) of the GDPR, which you can revoke at any time in our cookie settings.

The data processed using the Facebook pixel is partly stored on servers in the European Economic Area (“EEA”). However, the data also ends up on servers managed by Meta Platforms in the USA. Following the discontinuation of the EU-US Privacy Shield framework, data transfer to the USA can at best be based on standard contractual clauses issued by the European Commission and further guarantees. Despite this, the transfer of personal data is based on standard contractual clauses, according to which Meta Platforms undertakes to carry out personal data processing in accordance with European data protection standards. However, this does not rule out the possibility of the US security authorities, which have extensive powers, accessing your personal data at any time and without any reason. This is true even if the servers are located in Europe. As a US company, Meta Platforms may also be required to transfer personal data belonging to EU citizens that is located on servers in the EEA to US security authorities. There are no effective legal remedies available to you against this.

Meta Platforms will delete your personal data after 720 days at the latest.

More information about processing is available here: https://www.facebook.com/legal/terms/dataprocessing 

General information about Facebook’s privacy policy is available here: https://www.facebook.com/policy.php 

3.10 Taboola

We use Taboola, a content discovery platform, on our website. The service provider is the American company Taboola, Inc., 16 Madison Square West, 7th Floor, New York, NY, USA.

Taboola also processes data belonging to you in the USA, among other places. We would like to point out that, according to the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may be accompanied by various risks concerning the lawfulness and security of data processing.

Taboola uses “standard contractual clauses” as a basis for data processing with recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, thus in particular in the USA) or a data transfer there (= Art. 46 (2) and (3) of the GDPR). Standard contractual clauses (SCCs) are templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through these clauses, Taboola undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision made by the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: 

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

More information about the standard contractual clauses and about the data processed through the use of Taboola is available in the privacy policy at https://www.taboola.com/policies/privacy-policy or at https://www.taboola.com/policies/media-privacy-addendum

4. DISCLOSURE OF DATA AND CATEGORIES OF RECIPIENTS

Personal data is transferred to third parties if

  • you have given your explicit consent under Art. 6 (1) (a) of the GDPR;
  • disclosure according to Art. 6 (1) (f) of the GDPR is necessary for establishing, exercising or defending legal claims, and there is no reason to believe that you have an overriding legitimate interest in your data not being transferred;
  • there is a legal obligation for data transfer according to Art. 6 (1) (c) of the GDPR; and
  • doing so is necessary according to Art. 6, (1) (b) of the GDPR for fulfilling a contractual relationship with you.

Under the conditions mentioned above, categories of recipients of personal data may be in particular:

  • Authorities and other public bodies in the context of fulfilling their sovereign duties, provided transfer of the data is mandatory
  • Data processors to enable them to provide services such as maintenance and servicing of IT systems
  • Other companies in the context of the performance of the contract

5. DATA STORAGE PERIOD

We observe the principles of data avoidance and data minimization. Your personal data will therefore only be stored for as long as is necessary to achieve the purposes stated for the respective data processing activities or for the various storage periods prescribed by law. Once the purpose in question no longer applies, or the prescribed storage periods expire, the relevant data is routinely deleted and in accordance with the statutory provisions.

6. TRANSFERRING DATA TO A THIRD COUNTRY

Your personal data may be transferred to, and processed and stored in a location outside the European Economic Area (“third country”). Transfer to a third country is carried out particularly if doing so is necessary for conducting a business relationship with you, or in order to establish, exercise or defend legal claims, or if you have given your consent to transfer the data. We only transfer data to recipients who ensure that your data is protected according to Arts. 44 to 49 of the GDPR. Copies of the respective agreement are available on written request if data have been transferred under Art. 46 (2) of the GDPR and relevant guarantees have been obtained.

7. AUTOMATED DECISION-MAKING

We do not use any automated decisional processes, including for profiling.

8. YOUR RIGHTS AS A DATA SUBJECT

In relation to our processing of your personal data, you as a data subject have the following rights:

  • Right of access to the processed personal data according to Art. 15 of the GDPR.
  • Right to immediate rectification of incorrect personal data according to Art. 16 of the GDPR.
  • Right to immediate erasure of personal data according to Art. 17 of the GDPR.
  • Right to restriction of processing according to Art. 18 of the GDPR.
  • Right to data portability according to Art. 20 of the GDPR.
  • Right to object to processing according to Art. 21 of the GDPR, if processing is carried out in the public interest or in the exercise of official authority according to Art. 6 (1) (e) of the GDPR or in the controller’s legitimate interest according to Art. 6 (1) (f) of the GDPR.
  • Right to revocation of any consent granted according to Art. 7 (3) of the GDPR.

Please do not hesitate to contact our data protection officer if you would like to exercise any of the rights listed above. You will find their contact details in Section 1.

In addition, data subjects may lodge a complaint with the competent data protection supervisory authority in the location of their residence or place of work, or in which the alleged breach occurred.

9. COOKIES