Data protection statement

This Data protection statement explains the nature, scope and purpose of processing personal data (hereinafter referred to as "data") within our online offering and the related websites, functions and content, as well as our external online presence, including our social media profiles (hereinafter collectively referred to as "online offer"). Regarding the terminology used, e.g. "personal data" or its "processing," we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

Use of our online offer is possible without providing any personal data. However, if a person would like to use our company's special services available on our website, processing of personal data may be required. If the processing of personal data is required and there is no legal basis for this processing, we generally request the consent of the person concerned.

We have implemented multiple technical and organizational measures to ensure the highest level of protection of personal data processed via this website. Nevertheless, Internet-based data transfers can generally have security gaps, so that absolute protection cannot be guaranteed. For this reason, every person concerned is free to submit personal data to us using alternative methods, such as by telephone.

General Information

Responsible Person(s):

Siegwerk Druckfarben AG & Co. KGaA
Alfred-Keller-Strasse 55
53721 Siegburg
Germany
dataprotection(at)siegwerk.com

Data protection Manager:

Mr. Ziar Kabir
SCO-CON:SULT GmbH
Hauptstrasse 27
53604 Bad Honnef
Germany
Z.Kabir(at)sco-consult.de

Anonymous data collection

You can always browse through our non-personalized online offer without telling us who you are. We only know the name of your Internet Service Provider (your IP address), the website from which you are visiting our website, the date, time and web pages you go to when you visit our website. This information is analyzed for statistical purposes. You remain anonymous as an individual user in this case.

Security Measures

In accordance with Article 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

Data Collection and Processing

Scope of processing of personal data

In principle, we collect and use personal data on our users only to the extent necessary for the provision of a functional website and our content and services. The collection and use of personal data of our users is done only with the consent of the user. An exception applies to cases in which prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law.

Legal Basis for the Processing of Personal Data

The following legal bases exist for the processing of your personal data:

• Consent
• Contract fulfillment or pre-contractual measures
• Legal obligation
• To safeguard the legitimate interest of our company and the interests, the fundamental rights and basic freedoms of the person concerned do not outweigh the above-mentioned interest

Purpose of data processing

The purpose of data processing is to make our online offer available. Our online offer is an important part of our service and serves the purpose of customer care and in part the provision of contractual services.

We use it to communicate with the public and to ensure that people who are interested in us can get in contact with us.

Where our online offer provides the ability to submit job applications, we also process applicant data for the purpose of carrying out the recruitment process, including the support of automated and AI-assisted tools which is subject to human review in all cases.

Job Applications and Recruitment

Our online offer includes the ability to submit job applications via our career portal, which is operated through an integrated third-party HR and recruitment management platform. In this context, we process personal data you provide as part of your application — such as your contact details, CV, qualifications, and professional experience — for the purpose of assessing your suitability for the position applied for. The legal basis for this processing is Article 6(1)(b) GDPR (processing necessary for pre-contractual measures) in conjunction with the applicable national provisions on data protection in employment relationships. Use of Automated Processing and AI-Supported Tools As part of our recruitment process, we may use automated processing systems and AI-supported tools provided by our HR software platform to assist in the analysis and pre-screening of applications. These tools may process the personal data contained in your application to support our HR team in evaluating candidate suitability. Any such automated processing serves solely as a decision-support instrument. No binding or legally significant decision regarding your application is made solely based on automated processing within the meaning of Article 22 GDPR. A qualified member of our HR or recruitment team will always review the outcome of any automated analysis before any decision affecting your application is taken (Human in the Loop). You have the right to request meaningful information about the logic involved in any automated processing that significantly affects you, as well as the right to obtain human review of any such decision. To exercise this right, please contact our Data Protection Officer using the contact details provided above.

Duration of retention

Your personal data will only be retained for the time required to achieve the purpose of the retention, or as provided under the European Directives and regulators, or as provided under other regulators in laws or provisions that serve as the basis for data processing by the party responsible. In the context of job applications, applicant data will be deleted no later than six months after conclusion of the recruitment process if the application is unsuccessful, unless you have consented to a longer retention period or a longer period is required by law."

If the retention purpose is dropped or if a retention period prescribed by the European Directives and regulators or any other relevant regulators expires, the personal data will be routinely blocked or deleted in accordance with the legal provisions.

Cookies

We set temporary and permanent cookies, i.e. small files that are stored on users' devices. A cookie is a small data set that is stored on your hard drive by your browser. In part, the cookies are used for security purposes or to operate our online offer (for example, for the presentation of the website) or to save the user's decision when confirming the cookie banner.

You can prevent the storage of cookies by switching them off in your browser settings. Please note that if you do this, it is possible that not all features of this online offer may be used.

Your Rights

Rights of the Persons Concerned

As a concerned person, you have the following rights regarding us:

• You have the right to ask for confirmation regarding whether the data in question is being processed and for information about this data, as well as additional information and copies of the data in accordance with Article 15 GDPR.
• According to Article 16 GDPR, you have the right to request completion of the data about you or the correction of incorrect data about you.
• In accordance with the provisions of Article 17 GDPR, you have the right to request that the relevant data be immediately deleted or, alternatively, in accordance with Article 18 GDPR, that the processing of the data be restricted.
• You have the right to request that the data related to you, which you have provided to us, be provided to you in accordance with Article 20 GDPR and to request its transfer to other responsible persons.
• Furthermore, in accordance with Article 77 GDPR, you have the right to submit a complaint to the supervisory authority responsible.

Right of withdrawal

You have the right to withdraw any consents you have given, in accordance with Article 7 Para. 3 GDPR, with effect for the future.

Right of objection

You can object to the future processing of data concerning you according to the provisions of Article 21 GDPR at any time. The objection can specifically be made against processing for the purposes of direct marketing.

Communication Channels

Newsletters

In the following notes, we are providing you with information about the contents of our newsletters, as well as the announcement, sending and statistical analysis methods we use and your rights to objection. When you subscribe to our newsletters, you state that you agree to receive them and you consent to the procedures described.

Contents of the newsletters: We send newsletters, emails and other electronic notifications (hereinafter "newsletter(s)") only with the consent of the recipient or with legal permission. Insofar as the contents of a newsletter are specifically described, they are decisive for the consent of the users. Our newsletters contain information about our products, offers, promotions and our company.

Double opt-in and recording

Registration for our newsletters is done in a so-called double opt-in procedure. This means that after you register, you receive an email in which you are asked to confirm your registration. This confirmation is necessary so that no one can register with email addresses that belong to other people. The registrations for the newsletter are recorded to be able to prove the registration process in accordance with the legal provisions. This includes the retention of the registration and confirmation date and time and the IP address. In addition, changes to your data that are stored by the dispatch service provider are recorded.

Dispatch service provider: 

• The dispatch of our newsletters is partly carried out by CleverReach GmbH & Co. KG, Muehlenstr. 43, 26180 Rastede, hereinafter referred to as "dispatch service provider." You can review the data protection regulations of the dispatch service provider here: https://www.cleverreach.com/de/datenschutz

In addition, the dispatch service providers may, according to their own information, transmit these data in pseudonymous form, i.e. without assignment to a user, to optimize or improve their own services, e.g. for the technical optimization of the dispatch and the presentation of the newsletters or for statistical purposes, in order to determine in which countries the recipients are located. However, the dispatch service providers do not use the data of our newsletter recipients to write to them directly or to distribute them to third parties.

The dispatch of the newsletters and the measurements of success are carried out based on a consent from the recipient in accordance with Article 6 Para. 1 letter a, Article 7 GDPR in the sense of § 7 Para. 2 No. 3 UWG [Fair Trade Law] and on the basis of legal permission in accordance with § 7 Para. 3 UWG.

The recording of the registration procedure is carried out based on our legitimate interests in accordance with Article 6 Para. 1 letter f GDPR and serves as proof of consent to the receipt of the newsletter.

Cancellation/withdrawal

Newsletter recipients can cancel the receipt of our newsletters at any time, i.e. they can withdraw their consent. You can find a link to unsubscribe from the newsletter at the end of every newsletter. By doing this, you are simultaneously withdrawing your consent to the success measurements. Unfortunately, a separate withdrawal of the success measurements is not possible. In this case, the entire newsletter subscription must be canceled. By unsubscribing from the newsletters, your personal data will be deleted, unless its retention is legally required or justified, in which case, processing this data is limited to only serving these exceptional purposes. We may save the email addresses sent to us for up to three years, based on our legitimate interests, before deleting them for the purposes of sending the newsletters, to be able to provide proof of prior consent. The processing of these data is limited to the purpose of any necessary defense against claims. An individual request for deletion is possible at any time, provided that at the same time, the former existence of a consent can be confirmed.

Online Presence in Social Media

Based on our legitimate interests within the meaning of Article 6 Para. 1 letter f GPRD we maintain an online presence on social networks and platforms to communicate with customers who are active there, prospective customers and users, and to inform them about our services. When the respective networks and platforms are accessed, the terms and conditions and the data processing guidelines apply to their respective operators.

Unless otherwise stated in our data protection statement, we process users' data if they communicate with us through social networks and platforms, i.e. they write posts on our online media presence or send us messages.

Service Providers

Google Analytics, Google Maps, Youtube

Based on our legitimate interests (i.e. interests in the analysis, optimization and economic operation of our online offer in the sense of Article 6 Para. 1 letter f. GDPR), we use Google Analytics, a web analysis service of Google LLC ("Google").

Based on our legitimate interests (i.e. interests in the corresponding presentation of our online offers and in the ease of finding the places we have listed on the website in the sense of Article 6 Para. 1 letter f. GDPR), we use Google Maps, a web analysis service of Google LLC ("Google").

Based on our legitimate interests (i.e. information for business partners in the sense of Article 6 Para. 1 letter f. GDPR), we use Youtube, a video platform of Google LLC ("Google").

Google uses cookies. The information generated by the cookie about the use of the online offer by users is usually transmitted to a Google server in the USA and stored there.

Google LLC has certified its compliance with the EU-U.S. Data Privacy Framework (DPF), which was adopted by the European Commission on 10 July 2023 as the successor to the invalidated EU-U.S. Privacy Shield. Transfers of personal data to Google in the USA are carried out on this basis. Further information is available at: https://policies.google.com/privacy/frameworks.

Google will use this information on our behalf to evaluate the use of our online offer by users to compile reports on the activities in our online offer and to provide us with additional services related to the use of this online offer and Internet usage. In this regard, pseudonymous use profiles of the users may be created from the processed data.

We only use Google Analytics with activated IP anonymization. This means that the IP addresses of the users are shortened by Google within member states of the European Union or in other contractual states under the Convention on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there.

The IP address submitted by the user's browser will not be merged with other data provided by Google. Users can prevent the storage of cookies by setting their browser software accordingly; in addition, users can also prevent the collection by Google of the data generated by the cookie, which is related to their use of the online offer, as well as the processing of this data by Google if they download the browser plug-in available under the link below and install it: tools.google.com/dlpage/gaoptout;

You can find further information about data use by Google, setting and objection options on Google's website: https://www.google.de/intl/de/policies/privacy/.

Cloudflare - Content Delivery Network

Based on our legitimate interests (i.e. interests in the optimization of the performance of our online offer and recognition of the language settings of the user within the meaning of Article 6 Para. 1 letter F GDPR), we use the Cloudflare CDN service from Cloudflare, Inc. ("Cloudflare"). Cloudflare uses cookies. The information generated by the cookie about the use of the online offer by users is usually transmitted to a Cloudflare server in the USA and stored there.

Cloudflare, Inc. has certified its compliance with the EU-U.S. Data Privacy Framework (DPF), the Swiss-U.S. DPF, and the UK Extension to the EU-U.S. DPF. Transfers of personal data to Cloudflare in the USA are carried out on this basis. Further information is available at: https://www.cloudflare.com/privacypolicy/

You can find further information about data use by Cloudflare, setting and objection options on Cloudflare's website: https://www.cloudflare.com/privacypolicy/

SAP SuccessFactors – HR and Recruitment Management Platform

Based on Article 6(1)(b) GDPR (pre-contractual measures) we use SAP SuccessFactors, a HR and recruitment management platform of SAP SE ("SAP"), to operate our career portal and manage job applications, including AIsupported functionality for application processing. SAP processes applicant data on our behalf as a data processor within the meaning of Article 28 GDPR. Where data is processed outside the European Economic Area, appropriate safeguards are in place in accordance with Chapter V GDPR (e.g. Standard Contractual Clauses). Further information on data protection at SAP is available at: https://www.sap.com/about/trust-center/data-privacy.html