Data protection – an integral part of our company

The data controller for providing the website and related functions as described within this data privacy information, is Bundesdruckerei GmbH, Kommandantenstraße 18, 10969 Berlin, Germany, which decides on and designs the external appearance of D-Trust GmbH here.You can reach the data protection officer of Bundesdruckerei GmbH at the above address by adding ‘To the data protection officer’ (To the data protection officer) and also by e‑mail at: datenschutz@bdr.de

2.1  Data categories, purpose of processing and legal basis

We regularly process the following personal data when you use Bundesdruckerei’s web pages, applications or online tools (‘online offering’):

Personal data, such as

• contact data, e.g., first and last name, e-mail address, telephone number, which you yourself enter voluntarily within the scope of a Bundesdruckerei online offering, for instance, when registering, when making enquiries about contacting us, when participating in surveys, etc.,
• information provided as part of a support request,
• information that is automatically sent to us by your web browser or device, such as your IP address, device type, browser type, previously visited web pages, visited sub-pages or date and time of the respective visitor request.

We process your personal data for the following intended purposes:

 

• to enable you to make use of the services and functions offered online,
• to verify your identity and enable user authentication,
• to process your enquiry.

The processing of personal data is necessary in order to achieve the aforementioned purposes. Details can be found below in this data protection information. Detailed information is provided on the individual processing series and the legal basis for processing your personal data. 

2.2  Use of cookies

When you visit our website, we collect data while connected via your internet browser and using technically required so-called session cookies. These session cookies enable us to provide the various websites of the Bundesdruckerei Group. They expire when the session ends.

Most browsers are set to accept cookies automatically. However, you can deactivate the storage of cookies or set your browser to notify you as soon as cookies are sent. When cookies are set, the following information is sent to the party that set the cookie (in this case, to us):

• date and time the website was accessed,
• web browser and operating system used,
• complete IP address of the requesting computer,
• volume of data transferred.

The legal basis for the storage of information in the end user’s device is Sec. 25 (2) No. 2 TTDSG. The use of session cookies is absolutely necessary so that we, as the provider of the Bundesdruckerei Group websites (telemedia service), can provide this expressly requested telemedia service.

2.3  Log file processing

Every time this website is accessed or every time a file is retrieved, data about this process is temporarily processed in a log file. The following data is stored:

• date and time the website was accessed,
• web browser and operating system used,
• complete IP address of the requesting computer,
• volume of data transferred.

In the event of attacks (e.g., DDoS attacks) on the communication systems, this data is analyzed and, if necessary, used to initiate legal and criminal prosecution. These log files are deleted after seven days at the latest. The legal basis for this processing of your personal data is Art. 6 (1) (f) GDPR. Our legitimate interest is the investigation of security-related incidents.

3.1 Newsletter

For newsletter and premium content of D-Trust GmbH, this company is jointly responsible with Bundesdruckerei GmbH.

The data protection officer of D-Trust GmbH, Kommandantenstraße 15, 10969 Berlin, can be reached at the above address c/o “To the data protection officer” as well as by e-mail at: datenschutz@d-trust.net.

The data protection officer of Bundesdruckerei GmbH, Kommandantenstraße 18, 10969 Berlin, can be reached at the above address c/o “To the data protection officer” as well as by e-mail at: datenschutz@bdr.de.

 

Below, we would like to inform you of our newsletter content, as well as the registration, mailing and statistical analysis processes and your rights to object. By subscribing, you consent to receiving this newsletter and to the procedure described. We only send newsletters with promotional information with the recipient’s consent or legal permission. Our newsletters contain information on our products, offers, campaigns and innovations from D-Trust GmbH.

Registration/double opt-in procedure: In order to receive the newsletter you must enter your e-mail address. The disclosure of your first names and surname is optional. Registration for our newsletter is via what is known as a double opt-in procedure. This means that you receive an email after subscribing, in which you are requested to confirm your subscription. This confirmation is necessary to ensure that no-one can subscribe using third-party or non-existent email addresses. The subscriptions to the newsletter are logged, to allow us to verify the subscription process in accordance with the statutory requirements. In this procedure we store the IP address, the date and time of registration and confirmation. The legal base for storing these data is Article 6 (1) (f) of the GDPR. In cases of doubt, our legitimate interest lies in being able to prove that informed consent has been given and the newsletter received. After careful consideration has been carried out, the exclusion interests of the visitors to the website are not shown.

The legal base for the despatch of the newsletter and the processing of your personal data is your informed, voluntary consent in accordance with § 7 (2) (2) Unfair Competition Act in conjunction with Article 6 (1) (a) GDPR.

Shipping service provider: The Evalanche application from SC-Networks GmbH, Würmstraße 4, 82319 Starnberg is used to deliver the newsletter. Evalanche's data protection statements are available here: SC-Networks GmbH.

Statistical analysis: In order to continue to improve our newsletter and to adjust our contents to the interests of our users, or to send different contents in accordance with the interests of our users, we conduct statistical analyses with our newsletters. Two cookies called ewafut and ewafutano are also used for this purpose. Technical information, such as data on your browser and your system, plus your IP address and the date and time of access are collected. The statistical analyses also detect whether the newsletter is opened and which links are clicked. This information can be attributed to individual recipients of the newsletter. The cookies have an operational lifetime of 24 months. As the legal base, both for the use of cookies, the statistical analysis based thereon, and for the processing of your personal data for the newsletter delivery, we rely on your informed, voluntary consent, respectively in accordance with § 25 (1) Telecommunications and Telemedia Data Protection Act (Cookie Use) and Article 6 (1) (f) GDPR (Data Processing).

We use various survey templates (e.g. pop-up modules) to ascertain whether you want to register for a newsletter. At this point you may consent in the scope described above or refuse to grant your consent by clicking once on "Close window". In the case that you have not consented in order to prevent the pop-up module, or the exit intent module being immediately displayed again on your screen, we place a further cookie with the name, exit pop-up or exit intent. This technically necessary cookie has an operational lifetime of 21 days and serves the sole purpose of storing the consent status. The legal base for the use of cookies is § 25 (2) Telecommunications and Telemedia Data Protection Act.

Withdrawal: Your consent is valid until you withdraw it; you can declare withdrawal at any time with effect for the future. You can unsubscribe from email communications, the “Unsubscribe” link can be found at the bottom of emails. Alternatively, send us an email to Datenschutz-Request@bdr.de. The withdrawal of consent does not affect the legality of processing carried out prior to withdrawal.

Please note that, if you withdraw your consent to the use of Evalanche, this consent will be erased from our newsletter distribution list and you will no longer receive newsletters from D-Trust GmbH. The withdrawal of consent does not affect the legality of processing carried out prior to withdrawal. If you withdraw your consent, the consent data is stored for a reasonable period of time in blocked form. The legal base for this purpose is Article 6 (1) (f) GDPR. Our legitimate interest lies in being able to prove that informed consent has been given and the newsletter received, in cases of doubt. After careful consideration has been carried out, the exclusion interests of the visitors to the website are not shown.

3.2 Premium Content

On our website we provide Premium Content such as whitepapers for download. Such contents relate to specific topics and are extensively processed. With respect to the provision of Premium Content we request your consent to the use of your e-mail address, your first and last name, and your company for the purposes of advertising the services of D-Trust GmbH. Please refer to Point 3.1 of the privacy policy for details of the scope of your consent, how we process your data in the event of your consent, what analyses we conduct and for further details on Evalanche, as well as on the possibility of withdrawing your consent. Besides on the basis of the consent you have granted within the meaning of § 7 (2) (2) Unfair Competition Act in conjunction with Article 6 (1) (a) GDPR your e-mail address is processed under data protection law on the base of Article 6 (1) (b) GDPR, i.e. on the basis of a contract. You provide us with this data as consideration for the possibility of using the available Premium Content. Without this it would not be commercially viable for us to offer Premium Content. Once the registration process has been fully completed (cf. 3.1) we will send a link to the e-mail address provided, which allows you to access the desired content or you can download the content. In addition, through the email address, we are able to ascertain whether the person using the service is already in contact with D-Trust GmbH or whether the person has already registered for other Premium Content. This correlation is ascertained on the base of Article 6 (1) (f) GDPR. Avoiding duplicates and the correlation of which contacts have accessed which content is considered legitimate within the purpose of this regulation. Here, a comprehensive weighting process produces the result that the person using the service has no conflicting interests.

We have provided a contact form so that you can get in touch with us. You can choose whether to have us respond to your enquiry by telephone or by email. You can specify this in a free text field after you have preselected the topic of your enquiry. This will enable us to find the right contact person in the Bundesdruckerei Group as quickly as possible. Possible recipients of your data will therefore be the internal employees responding to your enquiry and affiliated companies pertaining to the topic of your enquiry.

If you want to schedule a consultation appointment via the contact form, you have the option of specifying an initial non-binding preferred date. In order for our consultation team to contact you to arrange a binding consultation appointment, we will first need your confirmation that you are the owner of the email address you provided. This confirmation is done via what is known as a double opt-in procedure. This means that after you have requested an appointment, you will receive an email from us asking you to confirm your request. Appointment requests are logged to allow us to verify the appointment confirmation process in accordance with the statutory requirements. In this procedure, we store the IP address, the date and time of the registration and confirmation, as well as any possible changes. The legal base for storing this data is Article 6 (1) (f) GDPR. In cases of doubt, our legitimate interest lies in being able to prove that we have permission to contact you for the purpose of scheduling a specific consultation appointment. After careful consideration, predominant competing interests on the part of visitors to the website are not evident. The Evalanche application from SC-Networks GmbH, Würmstraße 4, 82319 Starnberg, is used to process appointment scheduling. There is a data processing relationship in accordance with Article 28 GDPR. Evalanche’s privacy policy is available for viewing here: SC-Networks GmbH.

Some fields are not mandatory. Nevertheless, if you choose to provide the corresponding information, you consent to us processing your personal data for the purpose of responding to your enquiry. If you also consent to receiving our newsletter when scheduling an appointment, we will proceed as described in Section 3.1.

If you are interested in more information about our products, the legal basis for processing your personal data in connection with the contact request is Art. 6 (1) (b) GDPR. However, if you have a different request, we will process your personal data according to Art. 6 (1) (f) GDPR. Our legitimate interest is to respond to your enquiry.

In order to reach potential colleagues in the best possible way, we operate a company page on popular business networks. The following data protection information therefore applies to the processing of personal data on these portals.

LinkedIn

If you want to use our LinkedIn company page, follow our page or engage with the page, LinkedIn processes personal data about this interaction which enables us to analyze user behavior on the basis of statistics. This is the so-called ‘page insights’ function. For these statistical analyses, LinkedIn primarily processes data that you have made available to the platform via information within your profile. In addition, LinkedIn processes information about how you interact with our LinkedIn company page, for instance, if you follow our company page. If we organize so-called ‘polls’, i.e., if we release topic-related surveys on our company website, we will see related analyses showing voting behavior.

LinkedIn does not provide us with any personal data through page insights. We only have access to summarized page insights which do not allow any conclusions to be drawn regarding specific members.

The processing of personal data as part of the page insights function is carried out by LinkedIn and us as joint controllers. The analysis of activities on our LinkedIn company page helps us in our constant efforts to align our PR work with the needs of our users. The legal basis for this processing is Art. 6 (1) (f) GDPR.

We have entered into a joint controller agreement with LinkedIn which lays down the the allocation of data protection obligations between us and LinkedIn. The agreement can be retrieved here. In principle, the company alone is responsible under data protection law for the processing of personal data within the LinkedIn platform. More information about the processing of personal data by LinkedIn can be found here. Please note that LinkedIn processes personal data in the US or other third countries. LinkedIn only transfers personal data to countries for which an adequacy decision has been issued by the European Commission in accordance with Art. 45 GDPR or on the basis of appropriate safeguards in accordance with Art. 46 GDPR.

Inclusion of YouTube videos

Our website embeds videos from YouTube. The provider of this video platform is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, Ireland. Only when you call up an embedded video will a connection to the YouTube server be established (so-called two-click method). This tells the YouTube server which of our pages you have visited. In addition, YouTube obtains your IP address. This also applies if you are not logged into YouTube or do not have an account with Google. If you are logged into your Google account on YouTube at the same time, you enable Google to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your Google account on YouTube. By the loading of the embedded YouTube video confirmed by you, your IP address could be read by the Google Fonts Tool used by YouTube and forwarded to Google, over which we have no control. For this reason, please load embedded YouTube videos only if you agree to such data forwarding.

Personal data is normally sent to a Google server in the US and stored there. Due to the activation of IP anonymization – _anonymizeIp() – Google will first shorten your IP address within the EU member states or in other signatory states of the Agreement on the European Economic Area. Please note that it cannot be guaranteed that data processing will be carried out at the same level of protection as within the EU. In this respect, we believe that there is a risk that you may have difficulty enforcing your rights as a data subject and that state security authorities disproportionately access data. Moreover, there is no data protection supervisory authority. We expressly draw your attention to this matter.

The legal basis for the processing of your IP address and related information is your voluntary and informed consent pursuant to Art. 6 (1) (a) GDPR, which you can revoke at any time with effect for the future. The legality of the data processing carried out until revocation remains unaffected by the revocation. You can find further information on the handling of user data in Google’s Privacy Policy.

Ensuring compliance with legal regulations and internal rules, such as our Code of Conduct, and also with our Code of Conduct for Business Partners is a top priority for the Bundesdruckerei Group. This applies to our own business unit as well as to our supply chains.

It is important to us that risks are identified at an early stage and violations are avoided as far as possible. We want to initiate appropriate countermeasures in good time and avoid possible damages for those affected, as well as customers, employees, business partners and our group of companies.

That is why we have set up an independent, impartial and confidential whistleblowing system that allows internal and external whistleblowers to also report anonymously.

With the help of the transparent Complaints Procedure, we create the greatest possible protection for those affected, the whistleblowers and the employees who are involved in clarifying the reported facts. All actual and alleged violations of legal requirements, the Code of Conduct and the Code of Conduct for Business Partners can be reported under the Complaints Procedure. Likewise, the subject of a report may involve human-rights or environmental risks, or breaches of duty along the entire supply chain of our Group companies and in our own business area.

Rapid, standardised processes plus confidential and professional processing of tips by internal experts form the foundation of this system, which is based on the principle of fair proceedings.

Discrimination or punishment of whistleblowers and persons entrusted with the handling of complaints and tips will not be tolerated.

The aformentioned Complaints Procedure is applicable to Bundesdruckerei Group GmbH and the group companies Bundesdruckerei GmbH, Maurer Electronics GmbH, genua GmbH, D-Trust GmbH, Maurer Electronics Split d.o.o, iNCO Sp. z o.o. and Xecuro GmbH (together being the “Bundesdruckerei Group”).

a) Purpose and legal basis of data processing

The purpose of processing personal data is the management of the whistleblower system, including the detection of serious violations or potential violations of applicable law or other serious matters.

The processing of personal data is necessary for the fulfillment of legal obligations to which we are subject; see Art. 6 (1) (1) (c) GDPR. This is the law for better protection of whistleblowers (Whistleblower Protection Act – Hinweisgeberschutzgesetz, HinSchG).

The processing serves to safeguard the legitimate interest in the detection of serious violations or potential violations of applicable law or other serious matters pursuant to Art. 6 (1) (1) (f) GDPR.

As far as the processing of special categories of personal data is concerned, processing on the basis of the Whistleblower Protection Act is necessary for reasons of substantial public interest, see Art. 9 (2) (g) GDPR. Special categories of personal data are processed pursuant to Art. 9 (2) (f) GDPR in conjunction with Art. 6 (1) (1) (f) GDPR for the establishment, exercise or defence of legal claims.

Data subjects are persons who are the subject of the notification. They may be employees, contractual partners or other persons who are professionally associated with us. In addition, we process personal data about whistleblowers even if the contact information or other information transmitted or communicated by them exposes their identity. Whistleblowers must therefore be aware that we may process personal data about them in connection with the processing of the reported case.

b) Categories of personal data

The report can be made anonymously. In this case, no personal data of the whistleblower will be processed.

The categories of personal data processed will depend on the information reported. If the whistleblower reports personal data about another person, including that of the person or persons being reported on, this personal data will also be processed. The following categories of personal data may be processed:

• General personal data (name, address, e-mail address, telephone number, position, etc.)
• Personal data relating to criminal convictions or suspicion of such
• Special categories of personal data (information revealing racial or ethnic origin, political opinions, religious or philosophical convictions or trade union membership, data concerning health and data concerning a person’s sex life or sexual orientation)

We advise the whistleblower only to report information that is of specific relevance to the reported case and, in particular, not to report sensitive information unless it is of central importance for the processing of the reported case.

c) Obligation to provide personal data

There is no obligation to provide the personal data listed under section b, as it is also possible to report anonymously. However, it may not be possible for us to process the report without being provided with personal data.

d) Recipients of personal data

The reports are documented as a process in the WhistleB System at Bundesdruckerei GmbH. Following an assessment, the processes are passed on internally to the relevant departments, and any necessary follow-up measures are initiated. If a report concerns one of the Group companies of the Bundesdruckerei Group, these processes will be forwarded to the responsible persons of the respective Group company and evaluated internally by the responsible person, and any necessary follow-up measures will be initiated. Personal data is only passed on for a specific purpose and in accordance with the principle of data minimisation; in other words, only the personal data that is absolutely necessary to process the notification is passed on.

We disclose personal data about the whistleblower to authorities if this is necessary to deal with serious offences or serious matters or to ensure the right of defending the data subjects. In other cases, personal data about the whistleblower will only be passed on with the consent of the whistleblower. Personal data about persons other than the whistleblower will only be passed on in the context of following up a reported case or to deal with serious offences or serious matters.

The reporting platform is provided by the processor, WhistleB Whistleblowing Centre AB, Stockholm, Sweden. Further information on WhistleB, Whistleblowing Centre AB can be found in the Terms of Use.

e) Storage duration

Personal data that proves to be irrelevant for the processing of a reported case, along with reports that we consider to be unfounded, is immediately categorised as “irrelevant”, and any personal reference (unless it is already an anonymous report) is removed. In order to guarantee compliance with the legally required documentation obligation or statutory deletion period from Sec. 11 (1), (5) HinSchG, this report will then be archived at first (without personal reference), but not yet deleted. Archived cases are used exclusively to fulfil documentation obligations and can therefore no longer be called up for processing.

Reports and personal data collected in the course of processing a report form the basis for further processing and are anonymised as soon as possible. However, if the need for follow-up measures within the meaning of Sec. 3 (8) and Sec. 18 HinSchG arises, it is possible that the anonymisation must be deviated from due to an official order or in order to secure legal claims. In this case, pseudonymisation is generally striven for unless something else has been specified (e.g., by a court order). The documentation will be deleted three years after completion of the procedure. The documentation may be kept for longer to fulfil the requirements of this Act or other legislation, as long as this is necessary and proportionate.

In order to obtain information about the behavior of users when they visit our websites, we use the web tracking tool etracker from etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany. To count visitors, we only use data that the browser transmits anyway. However, for the further purpose of ‘analyzing user behavior’, we anonymize this data so that we do not create user profiles. Web analysis is therefore not carried out on the basis of personal data, but with the help of so-called ‘cross device IDs’ which cannot be referenced to individual users.  

The legal basis for the processing of your personal data to analyze your user behavior is your voluntary and informed consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with future effect by sending an e‑mail to: Datenschutz-Request@bdr.de. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

We use Google Ads Conversion Upload for improved analysis of our Google Ads campaigns. Google Ads allows the import of conversion data from third-party systems, such as etracker Analytics. When we upload data from etracker Analytics to Google Ads, no personal data is transferred. The only data transferred is statistical data on the number of conversions and, if applicable, the sales value assigned for each campaign click.

Our employees use their own upload and download portal for the secure exchange of documents. With the help of your e‑mail address, we can assign credentials to you and provide you with documents in a secure way.

a) Web interface (WebUI)

With UDP, you can now transmit large amounts of data and/or sensitive data via the web user interface, which is described in this manual without having to install special software. Your documents remain encrypted along the entire transmission path and are therefore protected against disclosure to unauthorized persons.

b) SecuPass

SecuPass encryption, which was developed by FTAPI, enables the transmission of all kinds of files with consistent (end-to-end) encryption. Besides maximum security, another special feature of SecuPass is that these transfers can take place between any persons (or end points) without the need to perform complex key and/or certificate creation and installation procedures. With UPD, this process is fully automated and is as simple and easy as sending an e‑mail.

c) SubmitBox link

You can use the SubmitBox link in order to send large amounts of data and/or sensitive data via a simple website without having to install special software or remember login data. All you need is to receive the link (SubmitBox link) from the respective Bundesdruckerei employee. This link could be as shown in this example: https://udp.bundesdruckerei.de/submit/MMustermann.

More information can be found in the user manual at: https://udp.bundesdruckerei.de/bdr/UDP_Anwenderdokumentation.pdf.

We take all the necessary technical and organizational precautions to protect personal data against loss or misuse. Your data is stored in a secure operating environment which cannot be accessed by the public.

The web pages also contain links to third-party websites. Liability for these websites lies with the respective operators. Bundesdruckerei GmbH is not responsible for the content nor for the data protection provisions of third-party websites.

Bundesdruckerei GmbH may transfer personal data to other Bundesdruckerei Group companies for the above-mentioned purposes only if this is necessary to fulfil the above-mentioned purposes.

Personal data may also be transmitted to courts, supervisory authorities or law firms if this is legally permissible and necessary in order to comply with applicable legislation or to assert, exercise or defend legal claims.

In as far as we cooperate with service providers (so-called commissioned data processors), such as service providers for IT maintenance services, these providers will only act on our instructions and are contractually obliged to comply with the applicable data protection requirements. Bundesdruckerei GmbH remains the controller for data processing.

If no explicit storage period is specified during collection (e.g. within the scope of a declaration of consent), personal data will be deleted as soon as it is no longer required for the intended purpose, unless statutory storage obligations (for instance, storage obligations under commercial and tax law) prevent deletion.

Under applicable data protection law, you generally have the following data subject rights:

The right

• to request confirmation as to whether personal data about you is being processed and to receive information about the personal data processed as well as further information (see Art. 15 GDPR),
• to request the correction of inaccurate personal data (see Art. 16 GDPR),
• to request the deletion of processed personal data (see Art. 17 GDPR),
• to request the restriction of the processing of personal data (see Art. 18 GDPR),
• to receive personal data provided by you, in a structured, customary and machine-readable format or to request that the personal data be transmitted to a third party (see Art. 20 GDPR),
• to object to data processing carried out on the basis of Art. 6 (1) (f) GDPR or for the purpose of direct advertising (see Art. 21 GDPR),
• to revoke consent at any time with effect for the future. Revocation is only effective for the future and will not affect the lawfulness of the processing of personal data up until revocation.

In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with a

data protection supervisory authority.