​

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR for data processing on this website is:

 

Vaihinger GmbH

Horstweg 29

65520 Bad Camberg

Germany

Phone: +49 6434 9405-0

Email: datenschutz@vaihinger.com

 

Represented by the Managing Director Bernd Rehbein.

 

2. Data Protection Officer

We have designated an external Data Protection Officer. If you have any questions regarding data protection or the exercise of your rights, you can contact him directly at any time:

 

CARMAO GmbH

Ulrich Heun

Walderdorffer Hof, Fahrgasse 5

65549 Limburg a. d. Lahn

Email: dsb.vaihinger@carmao.de

 

You can contact our Data Protection Officer directly with your concern without going through the contact details provided above.

 

3. General Information on Data Processing

We process personal data exclusively in compliance with applicable statutory regulations, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications Digital Services Data Protection Act (TDDDG).

 

Personal data means any information relating to an identified or identifiable natural person.

 

Insofar as we obtain your consent for processing operations, Art. 6 (1) lit. a GDPR serves as the legal basis. For processing necessary for the performance of a contract or in order to take steps prior to entering into a contract, the legal basis is Art. 6 (1) lit. b GDPR; for compliance with a legal obligation, it is Art. 6 (1) lit. c GDPR; and for the overriding of legitimate interests, it is Art. 6 (1) lit. f GDPR. Storing information on your terminal equipment or accessing information already stored in the terminal equipment is additionally governed by § 25 TDDDG.

 

4. Provision of the Website and Server Log Files

When you access our website, the browser on your device automatically transmits information to the web server. This information is temporarily stored in so-called log files. The following data is collected:

 

• IP address of the requesting device

   

• Date and time of access

   

• Name and URL of the retrieved file as well as pages accessed

   

• Browser type and version

   

• Operating system used

   

• Referrer URL (the previously visited page)

   

• Access status / HTTP status code

   

This data is processed to establish the connection, to ensure the security, stability, and functionality of our website, and to investigate acts of abuse. A combination of this data with other data sources to evaluate your usage behavior does not take place.

 

Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the technically secure and fault-free operation of our website.

 

Retention period: Server log files are generally erased after seven days, but at the latest after 30 days.

 

5. Hosting and Website Creation (Wix)

This website was created using the website builder system from Wix.com Ltd. and is hosted on their infrastructure.

 

Provider:

 

Wix.com Ltd.

 

Yunitsman 5 St

 

Tel Aviv

 

Israel

 

Representative in the European Union pursuant to Art. 27 GDPR:

 

Wix Online Platforms Limited, 1 Grant's Row, Dublin 2, D02 HX96, Ireland.

 

Wix processes on our behalf those personal data required to provide and securely operate the website. This includes, in particular, the IP address, technical information about the browser and device, access times, log files, and usage data. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Wix.

 

Wix operates a global cloud infrastructure and uses its own group companies as well as sub-processors for this purpose, including in the European Union (e.g., Germany, Ireland, Luxembourg, Lithuania), the USA, and other countries. Processing of personal data outside the European Union or the European Economic Area therefore takes place; for further details, please see Section 17.

 

Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in operating our website securely and efficiently without running our own servers. Insofar as non-technically necessary cookies are set via Wix, this is done on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG.

 

Further information on data processing by Wix: https://de.wix.com/about/privacy

 

6. Domain Registration and DNS Services (IONOS)

The registration of our domain, as well as the provision of the DNS infrastructure and email mailbox service, are carried out via IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Technical data is processed to the extent necessary to operate and ensure the accessibility of the website and email communications. A data processing agreement pursuant to Art. 28 GDPR has been concluded with IONOS.

 

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the operation and accessibility of our online services and email communications).

 

Further information: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

 

7. Cookies and Consent Management

7.1 Use of Cookies

Our website uses cookies and similar technologies. Cookies are small text files that your browser stores on your device. We distinguish between:

 

• Technically necessary cookies: Required for the website to function—such as session management, protection against attacks, and saving your cookie choices. They are set without consent.

   

• Non-necessary cookies: Used for reach measurement, marketing, or integration of external content. They are set exclusively after you have given your explicit consent.

   

Retention period: Technically necessary cookies from the Wix platform are set partly as session cookies and partly stored for up to twelve months. Meta Pixel cookies are stored between the duration of the session and up to 90 days, in individual cases up to two years. YouTube cookies are stored—after consent has been granted—between six months and two years.

 

Legal bases: For technically necessary cookies: § 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) lit. f GDPR. For all other cookies: § 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR.

 

7.2 Consent Management Tool (Usercentrics)

To obtain, manage, and document your consent, we use the consent management platform "Usercentrics for Wix."

 

Provider:

 

Usercentrics GmbH

 

Sendlinger Straße 7

 

80331 Munich

 

Germany

 

When you access our website, a consent banner is displayed. Non-necessary services and tracking technologies—in particular the Meta Pixel and YouTube integration—are only loaded after you have given your consent (opt-in). To document your choice, Usercentrics processes in particular your IP address (in truncated form), date and time of consent, browser and device information, a consent ID, and the enable/disable status of individual service categories.

 

Purpose and legal basis: Processing is carried out to fulfill our legal obligation to be able to demonstrate consent (Art. 7 (1) GDPR), based on Art. 6 (1) lit. c GDPR, and secondarily Art. 6 (1) lit. f GDPR.

 

Revocation: You can revoke or change your consent at any time with effect for the future by accessing the settings again via the permanently displayed button on the website. Alternatively, an informal message to datenschutz@vaihinger.com or a call to +49 6434 9405-0 is sufficient. The lawfulness of the processing carried out up to the time of revocation remains unaffected.

 

Further information: https://usercentrics.com/de/datenschutzerklaerung/

 

8. Fonts and Content Delivery Network

For the uniform display of fonts and the fast delivery of website content, we use the Content Delivery Network and font provision of the Wix infrastructure. When accessing the page, a connection to the provider's servers is established, whereby your IP address is transmitted. This is required so that the content can be delivered to your browser.

 

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in a uniform and high-performance presentation of our online presence).

 

9. Contacting Us

When you contact us via the contact form, email, or telephone, we process the data you provide to process your request and handle any follow-up questions.

 

Via the contact form, we collect: First name, last name, email address, telephone number, and your message. Providing this data is necessary to handle your request and respond to you. Additional details can be provided voluntarily.

 

Legal bases:

 

• Art. 6 (1) lit. b GDPR, insofar as your request aims at concluding or performing a contract (pre-contractual measures).

   

• Art. 6 (1) lit. f GDPR in all other cases; our legitimate interest lies in responding to inquiries submitted to our company.

   

Retention period: We erase the data as soon as your request has been fully processed and no statutory retention obligations prevent erasure. If your request leads to an offer or contract conclusion, commercial and tax retention periods apply (see Section 18).

 

10. Live Chat

We offer a live chat feature on our website allowing you to send us messages directly. Incoming messages are handled exclusively by our own employees. AI assistants or chatbots are not used; automated decision-making does not take place.

 

The processed data includes the content of the chat history, time and duration of the conversation, technical connection status, and any contact details you voluntarily provide in the chat.

 

Legal bases: Art. 6 (1) lit. b GDPR for contract-related requests; otherwise Art. 6 (1) lit. f GDPR (legitimate interest in direct customer communication). If non-necessary cookies are required for the operation of the chat function, this is done based on your consent pursuant to § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR.

 

Retention period: Chat logs are deleted after your request has been fully processed, provided no statutory retention obligations exist.

 

11. Job Applications

We publish job postings on our career page. There is no online application form; please send job applications via email to personal@vaihinger.com.

 

We process the application data you submit—in particular contact details, information on education and career history, and attached documents—exclusively for carrying out the application process.

 

Legal bases: Art. 6 (1) lit. b GDPR (performance of pre-contractual measures) in conjunction with § 26 (1) BDSG. If you voluntarily transmit additional details, their processing is based on Art. 6 (1) lit. a GDPR.

 

Retention period: If no employment relationship is established, we erase your application documents no later than six months after completion of the application procedure. Longer storage—for instance, for inclusion in an applicant pool—only takes place with your explicit consent, which you can revoke at any time.

 

Note on email transmission: Unencrypted emails can be read by third parties during transmission. If you wish to avoid this, you are welcome to send us your documents by post.

 

12. Spare Parts Shop (shop.sanomat.com)

We operate our spare parts shop under the subdomain shop.sanomat.com. For orders, we process data required for contract fulfillment, in particular company and contact details, billing and delivery addresses, and order details.

 

Payment is made on account (invoice); an external payment service provider is not involved. To deliver the goods, we transfer necessary shipping data to the commissioned transport company (parcel service or freight forwarder).

 

Legal bases: Art. 6 (1) lit. b GDPR (fulfillment of the purchase contract) as well as Art. 6 (1) lit. c GDPR for compliance with commercial and tax retention and recording requirements.

 

Retention period: We retain order and invoice data for up to ten years in accordance with statutory periods under § 147 AO (Fiscal Code) and § 257 HGB (Commercial Code).

 

Supplementary privacy notices regarding the ordering process are provided directly in the shop; these take precedence over the details in this section for order transactions processed there.

 

13. Embedded YouTube Videos

On our product pages, we embed videos from our company channel on the YouTube platform.

 

Provider:

 

Google Ireland Limited

Gordon House, Barrow Street

Dublin 4

Ireland

 

Videos are loaded only after you have given your consent. If you visit a page with an embedded video after giving consent, a connection to Google's servers will be established. Among other things, your IP address, browser and device information, and details about the accessed videos will be transmitted. If you are logged into YouTube at the same time, Google can assign this information to your user account. We have no influence over the scope and purpose of further processing by Google.

 

Legal basis: Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. You can revoke your consent at any time via the cookie settings.

 

Further information: https://policies.google.com/privacy

 

14. Meta Pixel

On our website, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

 

The Meta Pixel allows us to track visitor behavior after they have been redirected to our website by clicking on a Facebook or Instagram ad, evaluate the success of our ad campaigns, and serve targeted ads to users. In doing so, device information, your IP address, and details about your behavior on our website are transmitted to Meta.

 

The Pixel is loaded exclusively after your explicit consent.

 

Joint Responsibility: For the collection of data on our website and its transmission to Meta, we are jointly responsible with Meta Platforms Ireland Limited within the meaning of Art. 26 GDPR. The agreement concluded for this purpose ("Controller Addendum") is available at https://www.facebook.com/legal/controller_addendum. It outlines which party fulfills which obligations under the GDPR. Responsibility for upholding your data subject rights regarding data stored at Meta lies with Meta. Nevertheless, you may also assert your rights against us; we will then forward your request. Meta is solely responsible for subsequent processing of the data by Meta.

 

Legal basis: Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. You can revoke your consent at any time with effect for the future via the cookie settings.

 

Further information: https://www.facebook.com/privacy/policy/

 

15. Social Media Links and Company Profiles

15.1 Links on Our Website

Icons for our profiles on LinkedIn, Facebook, and Instagram are integrated on our website. These are standard links only. No active social plugins are used; therefore, no data is transferred to the respective providers simply by viewing our pages. Data transmission only occurs when you actively click the icon and open the respective provider's page.

 

15.2 Company Pages on Facebook and Instagram

We operate company pages on Facebook and Instagram, offered by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

 

When visiting these pages, Meta processes personal data of users. Meta provides us with aggregated, non-personally identifiable statistics on page usage ("Insights"). For the processing underlying these statistics, we are jointly responsible with Meta within the meaning of Art. 26 GDPR. The agreement concluded for this purpose is available at https://www.facebook.com/legal/terms/page_controller_addendum. Meta has assumed primary responsibility for informing data subjects and upholding their rights.

 

Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in corporate communications and interacting with interested parties and customers.

 

Further information: https://www.facebook.com/privacy/policy/

 

15.3 Company Page on LinkedIn

We operate a company page on LinkedIn, offered by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

 

When visiting our LinkedIn page, LinkedIn processes personal data of users. Insofar as LinkedIn provides us with statistical evaluations on the use of our page ("Page Analytics"), we are jointly responsible with LinkedIn in this respect within the meaning of Art. 26 GDPR; the corresponding agreement is available at https://legal.linkedin.com/pages-joint-controller-addendum. LinkedIn is solely responsible for further processing.

 

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in corporate communication).

 

Further information: https://www.linkedin.com/legal/privacy-policy

 

16. Recipients and Data Processors

Within our company, access to your data is granted only to those departments that require it to fulfill contractual and statutory obligations.

 

In addition, we use service providers who assist us in providing our services and whom we have carefully selected. Insofar as these service providers process personal data on our behalf subject to instructions, we have concluded data processing agreements with them pursuant to Art. 28 GDPR. In connection with this website, this mainly concerns the following categories of recipients:

 

• Website platform and hosting provider (Wix.com Ltd.)

• Domain, DNS, and email service providers (IONOS SE)

• Consent management provider (Usercentrics GmbH)

• External IT service providers for setup, maintenance, and technical support

• Transport and logistics companies for order delivery

• Tax advisors and auditors for compliance with legal auditing and retention obligations

   

Transmission to other third parties takes place only if a legal obligation exists, you have consented, or we are otherwise authorized to do so. This may particularly affect financial and tax authorities, law enforcement and other public authorities, as well as attorneys in connection with legal enforcement.

 

Your data will not be transmitted to third parties for advertising purposes.

 

17. Data Transfer to Third Countries

In connection with the services described in Sections 5, 13, and 14, personal data is also processed outside the European Union and the European Economic Area. This particularly concerns Israel and the USA.

 

The following safeguards exist for these transfers:

 

• Israel: The European Commission decided (Decision 2011/61/EU) that Israel ensures an adequate level of data protection. Transfer to Wix.com Ltd. takes place on this basis pursuant to Art. 45 GDPR.

   

• USA and other third countries: Transfer takes place, insofar as the receiving company is certified under the EU-U.S. Data Privacy Framework, on the basis of the European Commission's adequacy decision of July 10, 2023 (Implementing Decision (EU) 2023/1795) pursuant to Art. 45 GDPR. In addition and otherwise, we or our service providers have agreed upon the Standard Contractual Clauses of the European Commission pursuant to Art. 46 (2) lit. c GDPR with the recipients and implemented additional protective measures where necessary.

   

Please note that in third countries without an adequacy decision, a level of data protection equivalent to European law cannot be guaranteed. In particular, it cannot be ruled out that local authorities may access the data and that enforcing your rights may be made more difficult. Insofar as processing is based on your consent, by granting it you also consent to the associated transfer to a third country (Art. 49 (1) lit. a GDPR).

 

You can request a copy of the respective safeguards using the contact details specified in Section 1 or 2.

 

18. Retention Period and Erasure

We store personal data only for as long as necessary for the respective processing purposes or as long as statutory retention obligations exist. Specific timeframes are detailed under the individual processing operations above. In summary: