1. Introduction

We, GRIMME Landmaschinenfabrik GmbH & Co. KG, respect your privacy and your personal sphere and take the protection of your personal data very seriously. The processing of your personal data ("your data") by us is carried out on a legal basis. Since 25 May 2018, the most important basis is the EU General Data Protection Regulation (GDPR). It goes without saying that we also observe all other pertinent statutory provisions, in particular the Federal Data Protection Act (BDSG). On this page, we have provided a range of information on the topic of data protection.

2. Who is responsible for data protection?

The data on this website is processed by the website operator. The responsible body for the processing of data on this website is:

GRIMME Landmaschinenfabrik GmbH & Co. KG
Hunteburger Str. 32
49401 Damme
Phone: +49 5491 666-0
E-mail: grimme@grimme.de

3. Data protection officer required by law

We have appointed a data protection officer for our company:

Carla Holterhus
Datenschutzheldin
Papenstraße 20
48488 Emsbüren (Germany)
Phone: +49 157 532 500 64
E-Mail: datenschutz@grimme.de

4. Information on data transfer to the USA

Among other things, tools from companies that are based in the USA are incorporated on our website. When these tools are enabled, your personal data can be passed on to the US servers of the respective companies. We would like to point out that the USA is not a safe third country in terms of the EU Data Privacy Law. US companies are obliged to release personal data to security agencies without you as the affected party being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. secret services) are processing, evaluating and permanently saving your data that are located on US servers for surveillance purposes. We have no influence on these processing activities.

5. Visit to our website

For which purposes are we processing your data?

As a visitor to our website my.grimme.com you can use this page to obtain information about our offers and our company and to use the other functions described here. In the text below, we would like to inform you as accurately as possible about the processing of your personal data in accordance with the pertinent legal requirements.
With us, your personal data are transferred securely through encryption. For this, we make use of the encryption system SSL (Secure Socket Layer). An encrypted connection can be recognised by the browser address line changing from "http://" to "https://" and by the lock symbol in your browser line. When SSL or TLS encryption is enabled, the data you are transmitting to us cannot be read by third parties.

External hosting

This website is hosted at external service providers (hosters). The personal data that are collected on this website are stored on the servers of the hosters. These personal data can comprise

IP addresses,
meta and communication data,
website accesses and
other data that are generated via a website or are incorporated

into it. The hoster is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). To guarantee the data protection compliant processing of data, we have concluded an order processing contract with our hosting partners.
In addition, the respective server calls are recorded in a log file. We use these log file data for technical debugging and to fend off and clarify unlawful attacks on our systems, and, where necessary, to hold responsible persons accountable. We create evaluations of these activities from the stored log files, which we use to optimise our websites. The evaluation as such is done in anonymous form, i.e. by summarising call data, so that the results no longer have a personal reference.
Within the scope of accessing our offer, the following details are collected in a log file:

IP address of the computer through which the query was made
Browser information (browser used, operating system, language, etc.)
Details of the server service used
Protocol version
Name of the requested service (URL)
Date and time of the query
Status details (error messages)

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

The processing of the connection data is carried out on the basis of our legitimate interests according to Art. 6 para 1 lit. f GDPR. Our legitimate interest is to operate a website for advertising purposes and for general information and communication purposes, as well as for the establishment and processing of contractual relationships.
Processing of the log file data is carried out on the basis of our legitimate interests according to Art. 6 para 1 lit. f GDPR. Our legitimate interest is to protect our facilities and systems against attacks and, where necessary, to take legal action against attackers and to enhance our websites for commercial purposes.

Who is involved in the processing of my data?

Basically, the processing of your data is carried out fully automatically on our server. Only in exceptional cases (e.g. for debugging or clarification of attacks) will log files be used by our IT department and where necessary passed on to public bodies such as law enforcement authorities and courts of law for the purpose of clarification or prosecution of unlawful attacks on our systems.

Will your data be transmitted to a third country or to an international organisation?

The data of this website are located on Dutch servers (Western Europe) of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

The log file data are stored for 10 days. Connection data are deleted immediately after transaction of the HTTP/S call.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

It is unfortunately not possible to use the website without processing the above data.

5.1. Geo targeting

For which purposes are we processing your data?

We process your IP address to display the appropriate content for your location. For this purpose, we anonymise the address. Thus, the address can no longer be traced back to an identified or identifiable natural person. We transmit this anonymised IP address to an external web service for the purpose of geo targeting. The appropriate contents are then displayed to you based on the location.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of the IP address is carried out on the basis of our legitimate interests according to Art. 6 para 1 lit. f GDPR. Our legitimate interest is to provide you with the following location-based content:

Display of locally relevant website contents
Display of the website in the correct language
Display of a locally responsible contact person at GRIMME who is available for your questions relating to the portal and our products

Who is involved in the processing of my data?

Occasionally, the IT department or IT service providers will be involved.

How long will your data be stored?

The IP address and the location are stored for the duration of your visit.

5.2. Cookies

As does virtually any website, we make use of so-called cookies and similar technologies. A cookie is a small text file that consists of letters and numbers. A cookie contains information that is stored on your computer or mobile terminal device when you visit this website for the duration of your visit (so-called session cookies) or for a longer period of time (so-called permanent cookies) to facilitate recognition.
Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your terminal device until you delete them yourself or until your web browser deletes them automatically.
We use technically necessary cookies, which facilitate the operation of our website and the supply of the appropriate contents to you. For example, the log-in cookie is used to technically facilitate the range of customer account functions. This is technically necessary to be able to provide the range of customer account functions.
Apart from the technically necessary cookies, we also make use of different optional cookies: Thus, the use of cookies also serves to improve the user-friendliness of our website. For example, we make use of so-called session cookies to recognise that you have already visited individual pages of our website or that you have already logged into your customer account.
In addition, also for the purpose of user-friendliness, we use temporary cookies that are stored on your terminal device for a certain specified period. If you visit our website again to make use of our services, the system will automatically recognise that you have already visited us before and also which inputs and settings you have made so that you do not need to re-enter these.
The legal basis for processing your data in connection with cookies depends on whether these are technically necessary or optional (not technically necessary) cookies.
In the case of technically necessary cookies, processing of your data is done on the basis of our legitimate interests according to Art. 6 para 1 lit. f GDPR. Our legitimate interest is to operate a website for advertising purposes and for general information and communication purposes, as well as for the presentation of our company.
In the case of optional cookies, processing of your data is done on the basis of your consent according to Art. 6 Abs. 1 lit. a GDPR, which can be revoked at any time.
As far as cookies of third party companies or cookies for analysis purposes are used, we will separately inform you about this within the scope of this data privacy statement and, where necessary, request your consent.
A list of all cookies with their respective function, description and duration of storage can be found here. You can adjust your browser so that you will be informed about the setting of cookies to allow you to either only agree to cookies on an individual basis, to exclude the acceptance of cookies in certain cases or in general, and to enable the automatic deletion of cookies when the browser is closed. Disabling cookies can restrict the range of functions available on this website.

5.2.1. Consent Tool User Centrics

For which purposes are we processing your data?

This website uses the cookie consent technology of Usercentrics to obtain your consent regarding the saving of certain cookies on your terminal device and to document this consent in compliance with data protection laws.
When you access our website, the following personal data will be transmitted to Usercentrics:

Your consent(s) or the revocation of your consent(s)
Your IP address
Information about your browser
Information about your terminal device
Time of your visit to our website

Furthermore, Usercentrics saves a cookie in your browser to be able to allocate the consents granted or their revocation to you.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

We make use of Usercentrics to obtain the consents required by law for the use of cookies. Legal basis for this is Art. 6 para 1 S. 1 lit. c GDPR.

Who is involved in the processing of my data?

The provider of this technology is Usercentrics GmbH, Rosental 4, D-80331 Munich, website: https://usercentrics.com/de/ (hereinafter referred to as "Usercentrics"). We have concluded an order processing contract with Usercentrics.

Will your data be transmitted to a third country or to an international organisation?

The data will not be transmitted to a third country.

How long will your data be stored?

The collected data are stored until you request us to delete them, delete the Usercentrics cookie yourself or the purpose for storing the data ceases to exist. Mandatory statutory retention periods remain unaffected.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

You can revoke your consent to the setting of cookies and the access to optional cookies and the associated data processing at any time here. You can prevent the use of technically necessary cookies at any time by making corresponding settings in your browser, which prevent the setting of cookies by our website. Please note that in this case, a correct display of our website will no longer be possible.

5.2.2. Language preferences

For which purposes are we processing your data?

If you change the language of the website, the language will be stored in a cookie so that you can retrieve this setting again when you next visit our website.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your preferred website language is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

The following are involved in the processing of your data:

Internal departments within the scope of transacting the business processes
Occasionally our IT service providers within the scope of order processing

Will your data be transmitted to a third country or to an international organisation?

There will be no transmission of data to a third country.

How long will your data be stored?

The cookie will be permanently stored until you revoke your consent and will be read out when you visit our website.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

Using the website is possible without processing the above data.

5.2.3. Azure Application Insights

For which purposes are we processing your data?

On our website, we are using Application Insights by Microsoft. Application Insights places a cookie in your browser, which permits an analysis of your use of the website. The information generated by the cookie about the use of our website will as a rule be transmitted to and stored on a Microsoft server in the USA. On behalf of us, as the operator of this website, Microsoft will use this information to evaluate your use of the website, to compile reports on website activities and to provide us as the website operator with other services relating to website and Internet usage You can decline the necessary placement of a cookie, e.g. by a setting in your browser, which generally disables the automatic setting of cookies or you can make a setting in your browser to block all cookies by Microsoft. However, in that case it is possible that not all the functions of our website will be available to you to their full extent.
Through the use of Application Insights, the following additional data will be collected:

Operating system
Browser + version
Screen resolution
Approximate location of the user
IP address

We have the opportunity to evaluate these data by means of different reports. These data are anonymous statistical data. It is not possible to establish a personal reference on the basis of these data. The evaluations are used for clearing of errors and optimisation of the website and the application.
Further information provided by Microsoft on the topic of data protection and Azure can be found at the following link: http://azure.microsoft.com/de-de/support/trust-center/privacy/ and for Application Insights under https://docs.microsoft.com/de-de/azure/application-insights/app-insights-data-retention-privacy.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of the diagnostic data is carried out on the basis of our legitimate interests according to Art. 6 para 1 lit. f GDPR. Our legitimate interest is to provide a website with good performance, to ensure availability and to diagnose performance problems and errors.

Who is involved in the processing of my data?

The following are involved in the processing of your data:

Microsoft Corporation
GRIMME internal IT and marketing department

Will your data be transmitted to a third country or to an international organisation?

Application Insights is a service of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

Telemetry raw data are deleted after 90 days.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

If you would like to prevent a cookie from being stored for our websites on which we use Application Insights, you can set your browser to block cookies from Microsoft. However, we would like to point out that it is possible that you will then not be able to use all the functions of our website to their full extent.

5.3. Registration & verification of the account

For which purposes are we processing your data?

You can create a personal account on this website to be able to use additional functions on this page. It is necessary that you register before you can create an account. When you register, we will process the following personal data:

Name & surname
E-mail
Address and name of company

We use these data to identify you as GRIMME customer. This identification is technically done by linking your myGRIMME Account with an existing customer account in our ERP system. Thus it is possible that we add, for example, machines from our sales history to your account. Once verification has been successfully concluded, you can use the additional functions on our website that are described below.
The e-mail address you have provided during registration will be used by us to inform you about important changes, for example to the scope of our offer, or in the event of technically necessary changes.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your data for the registration and verification process is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

The following are involved in the processing of your data:

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

Your data are located on Dutch servers (Western Europe) of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

Your user account data is stored regularly for the duration of the existence of the customer account. If you would like to have your user account deleted, please write an e-mail to mygrimme@grimme.de or contact GRIMME by mail. Your account will be deleted if there is no legal obligation to retain it, or at the latest after expiry of any legal retention periods.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

Without the provision of account data or without registering on our website, it will only be possible to use it to a very restricted extent.

5.4. Machine park

For which purposes are we processing your data?

Processing of the GRIMME products in your possession (based on the serial number) provides you with permanent access to machine-specific contents such as operator manual, equipment, spare parts lists and much more. In addition, the functions Live Card, myJOBS and the myGRIMME Shop access the list of your machines to be able to offer you specific contents.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your data for the machine park is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales Support, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

Your data are located on Dutch servers (Western Europe) of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

Your machine park data are stored regularly for the duration of the existence of the customer account. If you would like to have your machines deleted, you can remove them at any time under the heading "Machines" or you can write an e-mail to mygrimme@grimme.de or contact GRIMME by mail. Your account will be deleted if there is no legal obligation to retain it, or at the latest after expiry of any legal retention periods.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

Without the provision of data for the machines in your machine park, use will only be possible to a very restricted extent.

5.5. Live card

For which purposes are we processing your data?

Apart from the current GPS position, the function Live Card also shows you the GPS track of the last up to 7 days and in addition a wide selection of machine settings and values, such as:

Work status & machine status
Position data (position, speed)
Machine settings
Process key data (hectare meter, hour meter)
Machine operating data (speeds, etc.)

For the purpose of visualisation, the data of your machine will be processed by us.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your data for the Live Card is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales Support, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

Your data are located on Dutch servers (Western Europe) of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

The application itself does not save any personal data, but only displays them if they are available.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

Processing of the data on the website has no influence on existing or future contracts. Alternative processing of machine data, e.g. within the scope of contracts or consents remains unaffected by this.

5.6. Jobs

For which purposes are we processing your data?

myJOBS is the clear and powerful order management, in which a selection of machine and telemetry data of your GRIMME machines is displayed. Because the system can distinguish between road and field travel, jobs are automatically generated in which all required information is stored. This eliminates the manual creation of jobs and saves the driver, scheduler, etc. a lot of time and effort, and provides a basis for order billing.
For this purpose, the following data of your machine will be processed:

GPS
Machine process data (machine status, hectare meter, tank contents, etc.)

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your data for the myJOBS function is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales Support, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

Your data are located on Dutch servers (Western Europe) of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

If jobs are linked with each other, this information will be stored for the duration of the existence of the account. Deleting the account will also delete the linking of jobs. Apart from that, the application itself does not save any personal data, but only displays them if they are available.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

Processing of the data on the website has no influence on existing or future contracts. Alternative processing of machine data, e.g. within the scope of contracts or consents remains unaffected by this.

5.7. Geofencing

For which purposes are we processing your data?

With the location tracker, the so-called geo fencing, you can highlight a specific area of land on a map. If the machine leaves or enters this area within a designated period of time, a message will be sent to you.
For this purpose, the GPS information of your machine, as well as periods of time and areas designated by you will be processed.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your data for the geo fencing function is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales Support, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

Your data are located on Dutch servers (Western Europe) of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

The geo fencing data are stored regularly for the duration of the existence of the customer account. If you would like to have these data deleted, you can remove them at any time under the heading "Geofencing" or you can write an e-mail to mygrimme@grimme.de or contact GRIMME by mail. Your account will be deleted if there is no legal obligation to retain it, or at the latest after expiry of any legal retention periods.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

Processing of the data on the website has no influence on existing or future contracts. Alternative processing of machine data, e.g. within the scope of contracts or consents remains unaffected by this.

5.8. Agrirouter

For which purposes are we processing your data?

The web-based data exchange platform called "agrirouter" enables the exchange of data between machines and agricultural software from different manufacturers and suppliers. All machines equipped with a telemetry unit that transmit machinery data and GPS data to the myGRIMME customer portal on request can be connected with the agrirouter. Once the machine(s) are connected, the agrirouter allows the user to specify which machine and GPS data will be transmitted to different agricultural software such as a Farm Management Information System (FMIS).
For this purpose, we store the linked e-mail address including a token and the machines and data fields that are transmitting data via the agrirouter.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your data for the agrirouter is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales Support, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

The servers, which are used for any data transmission are located in Germany, are secured and are subject to German law. The hard- and software components are certified and regularly tested.

How long will your data be stored?

The agrirouter sends data according to your specifications. The data transport, by use of a personalised agrirouter account, and the possible temporary storage (maximum up to 4 weeks) is encrypted. If you log on to your agrirouter with a PC, tablet or smartphone, you determine who may exchange data with whom, to what extent and for what period.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

It is not possible to use the agrirouter without the above data being specified and processed.

5.9. My GRIMME dealer

For which purposes are we processing your data?

Selecting your favoured GRIMME dealer enables you fast access to the dealer's contact data. In addition, it is possible to transmit order requests to this GRIMME dealer in myGRIMME Shop and to view its price and stock for specific spare parts.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of your data for the favourite GRIMME dealer is done on the basis of the consent you have given (Art. 6 Abs. 1 lit. a EU GDPR). You can revoke your consent at any time. The legitimacy of the data processing operations already carried out remains unaffected by the revocation.

Who is involved in the processing of my data?

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales Support, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

Your data are located on Dutch servers (Western Europe) of the cloud platform Azure of the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). It cannot be ruled out that some of the information collected may also be processed outside the European Union by Microsoft, which is based in the USA. We have concluded the standard contractual clauses adopted by the EU Commission with Microsoft, through which Microsoft undertakes to comply with European data protection requirements.

How long will your data be stored?

The favourite GRIMME dealer is stored for the duration of the existence of your account. You can change or delete the chosen GRIMME dealer in your profile at any time. When you delete your account, the favourite GRIMME dealer will also be deleted.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

It is not possible to order spare parts from the shop without selecting a GRIMME dealer.

5.10. My GRIMME dealer

We integrate external services or contents into our website. These services are by default disabled, but can be enabled by the user. The services are predominantly located in the USA, but are subject to the usual data protection regulations in EU and EEA countries.
If you are using such a service or if you are shown contents of a third party, communication data are exchanged for technical reasons between you and the respective provider.

5.10.1. Google Maps

For which purposes are we processing your data?

This website makes use of the map service Google Maps via an API. Provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Another application is the use of "Place Autocomplete Address Form" to simplify input of your address data.
To use the functions of Google Maps, it is necessary to store your IP address. This information will as a rule be transmitted to and stored by a Google server in the United States. We have no influence on the way the platforms use these data, possibly also for the generation of usage profiles.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

The use of Google Maps takes place in the interest of presenting our online offers in an appealing manner and of making the locations specified on our website easy to find. This constitutes a legitimate interest in terms of Art. 6 para 1 lit. f GDPR.
If a corresponding consent was requested, processing is based exclusively on Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.
More information on the handling of user data can be found in Google's Data Privacy Statement.

6. Contact by telephone, e-mail or fax

For which purposes are we processing your data?

If you contact us by e-mail, phone or fax, your request including all resulting personal data (name, request) will be stored and processed for the purpose of dealing with your request. We will not pass on this data without your consent.

On which legal basis do we process your data? Which legitimate interests do we pursue with this?

Processing of this data is based on Art. 6 para. 1 lit. b GDPR, if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures.
In all other cases, processing is based on our legitimate interest in the effective processing of the requests sent to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this was requested.

Who is involved in the processing of my data?

Depending on the type of your request, the following are involved in the processing of your data:

Internal IT service providers
External IT service providers within the scope of order processing
Departments within the scope of transacting the business processes (After Sales Support, Accounting, Sales)

Will your data be transmitted to a third country or to an international organisation?

Your data will not be transmitted to a third country or to an international organisation?

How long will your data be stored?

The data sent by you by means of contact queries will remain with us until you request us to delete them, until you revoke your consent to their storage or until the purpose for the data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

Is there an obligation for you to provide your data or is this necessary for the conclusion of a contract and what happens if you decide against it?

We cannot process your request without you specifying your data.

7. Automatic decision making and profiling

There will be no automatic decision making or profiling according to Art. 22 para. 1 and 4 GDPR.

8. Rights of the persons affected

Insofar as we process your data, you have a right within the respective legal scope to:

information, in particular about the data stored with us and the purpose of processing them (Art. 15 GDPR)
correction of incorrect or completion of incomplete personal data (Art. 16 GDPR).
deletion of, for example, unlawfully processed data or data that is no longer required (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
objection to processing if it is carried out to protect the legitimate interests of the data controller (Art. 21 GDPR) and
data transfer, provided processing is based on consent or is carried out for the performance of a contract or by means of automated procedures (Art. 20 GDPR)

If processing is based on consent given by you (Art. 6 para 1 lit. a or Art. 9 para 2 lit. a GDPR), you are entitled to revoke your consent at any time. The legitimacy of processing carried out on the basis of the consent until your revocation is not affected by this.

9. Right of appeal

You have the right of appeal to a supervisory authority, without prejudice to any other administrative or judicial remedy, if you are of the opinion that the processing of personal data concerning you is contrary to the GDPR (Art. 77 GDPR). You may exercise this right before a supervisory authority in the Member State of your place of residence, your place of work or the place where the alleged infringement occurred.
In Lower Saxony (Germany) the competent supervisory authority is: The State Commissioner for Data Protection of Lower Saxony. Contact details at:
https://www.lfd.niedersachsen.de/wir_ueber_uns/impressum/impressum-56113.html

WV 165

On request