Data protection

Our Viega website and its sub-pages can generally be used without providing personal data. However, if Viega special services are used through our website, it may be required to process personal data of the user. If the processing of personal data is required and if there is no legal basis for such processing, we shall generally seek the consent of the data subject. An exception shall apply in cases where processing of the data is permitted by law.

Personal data, such as name, address, e-mail address or telephone number of a data subject, shall be processed in compliance with the requirements of the General Data Protection Regulation and in accordance with applicable national data protection provisions. Viega wishes to inform the public by means of this Privacy Policy about the nature, scope and purpose of the personal data processed by Viega. Furthermore, data subjects shall be informed of their rights by way of this Privacy Policy.
Viega is committed to protect the privacy of website users as much as possible. The security measures used correspond to the state of the art. User data are treated confidentially and protected against unauthorized or unintended disclosure. No publication or unauthorized disclosure of user data shall neither be made without explicit prior consent.

1. Name and address of the controller

Controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions with data protection character is:
Viega Holding GmbH & Co. KG (in this Privacy Policy also called "Viega")
Viega Platz 1, 57439 Attendorn, Germany
+49 (0) 2722 61-0
webmaster@viega.de

2. Name and address of the data protection officer

The data protection officer of Viega Group is:
VIA Consult GmbH & Co. KG
Mr. Karsten Kunde
Address
+49 2761 837511
datenschutz@viega.de

3. Creating log files

Whenever this website is accessed, Viega uses an automated system to collect data and information from the calling computer. They are stored in the log files of the server delivering the website.
In so doing, the following data may be collected:
• IP address of the calling computer
• Date and time of access
• Data, URL and volume of the data retrieved
• Identification data of the Internet browser and the operating system of the calling computer
• Website from which the access or forwarding to this website was made (referer)
• Name of the user's Internet provider
The IP address is transmitted with every server request for the server to know where to send the response. Every Internet user receives the IP address from their Internet service provider (ISP) upon connecting to the Internet. The ISP is able to trace, which IP address was assigned to which of its customers at which time. As long as the IP address is stored, it is theoretically possible to determine the identity of the connection owner via the ISP. We and our statistical service provider therefore store the IP address only in an abbreviated (anonymous) form and use it only for session detection, for geolocation (down to city level) and for the defense against attacks The IP address is then deleted immediately, so that the recorded data becomes anonymous and it is no longer possible to attribute them to the user's identity, not even via the ISP.
The legal basis for the temporary storage of data and log files is Art. 6 (1) (f) GDPR.
The data are processed to deliver the content of the website, to ensure the functionality of our information technology systems and to optimize the website. In so doing, the log file data are always stored separately from other personal data. No personal data are evaluated for marketing purposes in this context.
These purposes also constitute Viega's legitimate interest in data processing according to Art. 6 (1) (f) GDPR.
The data are deleted once they are no longer necessary for the purpose of collection. When collecting the data for providing the website, this is the case once the respective session is terminated. If the data are stored in log files, it is the case after no more than seven days. Extended storage is possible. In this case, the users' IP addresses are deleted or manipulated, making it impossible to attribute the calling user.
The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. The user therefore has no option to opt out.

4. Cookies

Viega uses so-called cookies on this website. Cookies are text files that are stored in or by the Internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. Such cookie contains a characteristic string that allows clear identification of the browser and therefore of the user when visiting the website again.
The following data are stored and transmitted in the cookies:
(Language settings, articles in a shopping cart, log-in information)
In addition, we also use cookies on our website that allow for analyzing users' browsing behavior.
In this way, the following data can be transmitted:
The collected data are listed below. They may for example include: Entered search terms, frequency of page views, use of website functions
Below, we will inform you about the types of cookies stored, their purpose and their expiry:

The legal basis for processing personal data using cookies is Art. 6 (1) (f) GDPR.

The purpose of using technically necessary cookies is to facilitate the use of websites for users. Some features of our website cannot be offered without the use of cookies. They require that the browser is recognized even after a change in site.

The user data collected through technically necessary cookies will not be used to create user profiles.

These purposes also constitute our legitimate interest in processing personal data according to Art. 6 (1) (f) GDPR.

Cookies are stored on the user's computer and transmitted by it to our website. The user therefore also has full control over the use of cookies. By changing the settings in the Internet browser used by the user, the user can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to use all the functions of the website to the full extent.

5. YouTube

Viega has integrated components from YouTube on this website. YouTube is an internet video portal that allows video publishers to post video clips for free and other users to view, rate and comment on them, also for free. Information on YouTube is available at https://www.youtube.com/yt/about/de/.

The operating of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

With each visit to one of the pages of this website, which is operated by Viega and incorporates a YouTube component (YouTube video), the Internet browser on the user's information technology system is automatically caused by the respective YouTube component to download the corresponding YouTube component from YouTube. As part of this technical process, YouTube and Google learn which specific sub-page of our site is visited by the user.

If the user is logged in to YouTube at the same time when visiting a sub-page containing a YouTube video, YouTube recognizes which specific sub-page of our website is visited by the user. This information is collected by YouTube and Google and associated with the user's YouTube account.

If the user does not want such information to be transmitted to YouTube and Google, he/she may prevent transmission by logging out of his/her YouTube account before visiting our website.

YouTube's privacy policy, available at https://www.google.com/intl/en/policies/privacy/, provides information about collection, processing, and use of personal data by YouTube and Google.

6. Analysis tool Webtrekk

Some of the data collected when you visit our website are used for statistical analysis.
Viega uses the services of company Webtrekk GmbH, Hannoversche Str. 19, 10115 Berlin, Germany, to collect statistical data about the use of our website and to optimize our offer accordingly. Webtrekk GmbH is certified for data protection, in the area of web controlling software, by the TÜV Saarland. Part of the certification is an on-site audit of Webtrekk in Berlin and at the hosting site, where collection and processing of tracking data was checked for data privacy compliance and data security.

Such certification was based on the following:

• the catalog of requirements for data protection - V1.3,
• The statutory requirements for data protection,
• the principles of IT security for the current state of the art based on the basic IT protection according to BSI and ISO 27000,
• test report TR00969.

As part of a website visit, some information - transmitted by the browser - is collected and evaluated for our web controlling. Collection is done by a pixel, which is integrated in every website. The following data are collected:

• Request (file name of the requested file)
• Browser type/version (e.g.: Internet Explorer 11.0)
• Browser language (e.g.: German)
• Operating system used (e.g.: Windows 10)
• Internal resolution of the browser window
• Screen resolution
• Java script activation
• Java on/off
• Cookies on/off
• Color depth
• Referrer URL (the last site visited)
• IP address – is anonymized immediately and deleted after processing
• Time of access
• Clicks

A more detailed list of the information transmitted is available at http://www.webtrekk.com/index/datenschutzerklaerung.html. Webtrekk stores the IP address only in an abbreviated (anonymous) form and uses it only for session detection, for geolocation and for the defense against Cyber-attacks. The IP address is then deleted immediately so that the collected data are anonymous.
Webtrekk places the following cookies:
• Session cookie (for session detection, lifetime: one session)

• Long-term cookie (to detect new/regular client: 6 months)

• Opt-out cookie (when objecting to tracking: 60 months)
The user can specify in his/her browser settings whether or not cookies may be placed. If the user does not wish to be tracked specifically for Viega's website, he/she may object to the tracking. To complete the opposition, the user can click on the following link http://www.webtrekk.com/index/datenschutzerklaerung/opt-out.html.
For information, visit the website of Webtrekk GmbH, http://www.webtrekk.com.

7. Newsletter

If a user subscribes to the Viega Newsletter, the data of the respective input mask will be transmitted to Viega.
When registering for the newsletter, the user's IP address as well as date and time of registration are saved. The purpose of this is to prevent misuse of services or e-mail address. The data are not disclosed to third parties. An exception applies in case of a legal obligation to disclose.

The data will be used exclusively for sending the newsletter.

The legal basis for processing the data after the user has registered for the newsletter is Art. 6 (1) (a) GDPR if the user's consent was given.

Subscription to the newsletter may be terminated by the user at any time Likewise, consent to the storage of personal data may be revoked at any time. Each newsletter contains a corresponding link for this purpose.
In addition, the user can opt out by sending an e-mail message to the following address: newsletter@viega.de or datenschutz@viega.de.

8. Other online offers

From our website the user can reach further online offers of Viega, such as the supplier portal and the careers portal. This Privacy Policy also applies to these offers.

Some forms require the user to enter personal data. The data in the respective input mask are transmitted to Viega and stored exclusively for the purpose of internal use by Viega.

When using the input masks, the user's IP address as well as date and time of use are also saved.

The purpose of this is to prevent misuse of services. The data are not disclosed to third parties. An exception applies in case of a legal obligation to disclose.

Likewise, in some instances, the customer's first and last name, telephone, e-mail address, address and company are stored.

Collection of such data is necessary for the provision of the desired content or services. Likewise, this serves solely for purposes of processing or contacting.

Legal basis for processing the data transmitted by means of an input mask is Art. 6 (1) (f) GDPR. If the contact aims at concluding a contract, Art. 6 (1) (b) GDPR forms an additional basis for processing.

Users have at all times the option to delete or modify the stored data. The user receives information about his/her stored personal data at any time.

The data are deleted once they are no longer necessary for the purpose of collection.

9. Contact options

The website provides a contact form that may be used for electronic contact. Contact may also be made via the e-mail address provided. If the user contacts Viega via one of these channels, personal data transmitted by the user will be automatically saved. This always includes first and last name, telephone, e-mail address and company. The user may optionally specify additional data.

Storage solely serves the purposes of processing or contacting the user. The data are not disclosed to third parties.

Legal basis for processing the data transmitted in the context of transmitting an e-mail is Art. 6 (1) (f) GDPR. If the e-mail contact aims at concluding a contract, Art. 6 (1) (b) GDPR forms an additional basis for processing.

We process personal data from the input mask only to handle the contact. In case of contact via e-mail, this also includes the required legitimate interest in processing the data.
The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

The data are deleted once they are no longer necessary for the purpose of collection. Regarding the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.

10. Routine deletion and blocking of personal data

In general, Viega processes and stores personal data of users only as long as this is necessary to achieve the purpose of the storage. In addition, such storage may take place if provided for by the European or national legislator in Union regulations, laws or other regulations governing Viega. Data are furthermore blocked or deleted when a storage period prescribed by such standards mentioned expires, unless such data storage must continue for conclusion or fulfillment of a contract.

Once the storage purpose ceases to apply or a storage period prescribed by the aforementioned regulations expires, the personal data are routinely blocked or deleted.

11. Rights of data subjects

If the user's personal data are processed, the user is a data subject within the meaning of the GDPR and has the following rights vis-à-vis Viega:

11.1 Right to information

The user may request Viega to confirm if personal data relating to him/her is processed by us.
If so, the Viega user may request disclosure of the following information:
a. The purposes, for which the personal data are processed;
b. The categories of personal data that are processed;
c. The recipients or categories of recipients to whom the user's personal data user have been or will be disclosed;
d. The planned storage duration of the user's personal data or, if specific information is not available, criteria for determining the storage duration;
e. The existence of a right to correct or delete the user's personal data, a right to restrict processing by the controller or a right to object to such processing;
f. The existence of a right of appeal to a supervisory authority;
g. Any available information about the origin of the data, if the personal data are not collected from the user;
h. The existence of automated decision-making, including profiling pursuant to Art. 22 (1) and (4) GDPR and - at least in such cases - meaningful information about the logic involved and the scope and intended impact of such processing on the user.
The user has the right to request information as to whether the user's personal data are transmitted to a third country or to an international organization. The user may in this context request to be notified about the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transmission.

11.2 Right to correction

The user has the right to rectification and/or completion vis-à-vis Viega if his/her processed personal data are incorrect or incomplete. Viega shall implement such correction without delay.

11.3 Right to restriction of processing

The user may request the restriction of the processing of his/her personal data under the following conditions:
a. If the user denies the accuracy of his/her personal information for a period that enables Viega to verify the accuracy of the personal data;
b. the processing is unlawful and the user rejects deletion of the personal data and instead requests the restriction of the use of the personal data;
c. Viega no longer requires the personal data for processing purposes, but the user requires them for asserting, exercising or defending legal claims, or
d. if the user has objected to the processing pursuant to Art. 21 (1) GDPR and it has yet to be determined if Viega's legitimate reasons outweigh the user's reasons.

If the processing of the user's personal data was restricted, such data may be used only - apart from storing them - with the user's consent or to assert, exercise or defend legal claims or to protect the rights of another individual or entity or for reasons of substantial public interest to the Union or of a Member State.
If the processing was restricted in accordance with the aforementioned requirements, the user will be notified by Viega before the restriction is lifted.

11.4 Right to deletion

11.4.1. Obligation to delete

Any user may request that Viega delete his/her personal data without delay and Viega is obliged to delete such data without delay if any of the following reasons apply:

a. The user's personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
b. The user revokes his/her consent, which was the basis for processing pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR and there is no other legal basis for processing.
c. You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding justifiable reasons for processing, or the user objects to processing pursuant to Art. 21 (2) GDPR.
d. The user's personal data were processed unlawfully.
e. The deletion of the user's personal data is necessary to meet a legal obligation under Union law or the law of the Member States governing Viega.
f. The user's personal data were collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

11.4.2. Information for third parties

If Viega has made the user's personal data public and if Viega is required to deleted them pursuant to Art. 17 (1) GDPR, Viega will take appropriate measures, including technical measures, taking into account available technology and the costs of implementation, to notify controllers processing the personal data that the user as data subject has requested that Viega deletes all links to such personal data or copies or replications of such personal data.

11.4.3. Exceptions

The right to deletion does not exist if the processing is necessary
a. to exercise the freedom of expression and information;
b. to meet a legal obligation requiring processing under the laws of the Union or of the Member States governing Viega or to perform a task of public interest or in the exercise of public authority delegated to Viega;
c. for reasons of public interest in the field of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;
d. for archival purposes of public interest, scientific or for historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, to the extent that the law referred to in paragraph 1 is likely to render realization of the objectives of such processing impossible or seriously affects it; or
e. to assert, exercise or defend legal claims.

11.5 Right to information

If the user has asserted the right of correction, deletion or restriction of processing to Viega, Viega is obliged to notify all recipients who have been disclosed the user's personal data of such correction or deletion of this proves to be impossible or associated with unreasonable effort.
The user is entitled vis-à-vis Viega to be informed about these recipients.

11.6 Right to data portability

The user has the right to receive the user's personal data supplied by Viega in a structured, common and machine-readable format. Moreover, the user has the right to transmit such data to another controller without any obstruction by Viega, whom the personal data has been furnished, provided that
a. the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR, and
b. the processing is done using automated procedures.
In exercising this right, the user furthermore has the right to effect that the user's personal data are transmitted directly from one controller to another controller if this is technically feasible. Freedoms and rights of other persons must not be affected.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on Viega.

11.7 Right to object

You have the right at any time, for reasons that arise from the user's particular situation, to object to the processing of the user's personal data based on Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions.
Viega no longer processes the user's personal data, unless Viega can prove compelling legitimate reasons for the processing, outweighing the user's interests, rights and freedoms or the processing serves the assertion, exercise or defense of legal claims.
If the user's personal data are processed in order to engage in direct marketing, the user has the right at any time to object to the processing of the user's personal data for the purpose of such marketing; this also applies to profiling insofar as it is associated with such direct marketing.
If the user objects to the processing for direct marketing purposes, the user's personal data will no longer be processed for such purposes.
The user has the option to exercise the right of objection in connection with the use of information society services - notwithstanding Directive 2002/58/EC- by means of automated procedures.
11.8 Right to revoke the data protection consent declaration
The user has the right to revoke his/her data protection declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

11.9 Automated decision on an individual basis including profiling

The user has the right not to be subject to a decision based solely on automated processing - including profiling - that significantly affects him/her. This does not apply if the decision
a. is required for conclusion or performance of a contract between the user and Viega,
b. is permitted under Union or Member State legislation governing Viega and if such legislation contains reasonable measures to safeguard the user's rights and freedoms and the legitimate interests of the user, or
c. is done with the user's explicit consent

However, these decisions must not be based on special categories of personal data under Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) apply and reasonable measures have been taken to protect the rights and freedoms and the user's legitimate interests.
Regarding the cases specified in a. and c., Viega will take reasonable steps to safeguard the user's rights, freedoms and legitimate interests, including, but not limited to, the right of effect someone to intervene on the part of Viega, to state his/her own position and to contest the decision.

11.10 Right to complain to a supervisory authority

Notwithstanding any other administrative or judicial remedy, the user has the right to complain to a supervisory authority, in particular in the Member State of his/her residence, place of work or place of alleged infringement if the user believes that the processing of the user's personal data is in breach of the GDPR.
The supervisory authority where the complaint was filed notifies the complainant of status and results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

12. Legal basis of processing

Insofar as Viega obtains the user's consent for processing of personal data, Art. 6 (1) (a) of the General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
Article 6 (1) (b) GDPR serves as the legal basis when the processing personal data that are required to fulfill a contract where the user is a party. This also applies to processing operations required to carry out pre-contractual actions.
To the extent that personal data need to be processed to fulfill a legal obligation of Viega, Art. 6 (1) (c) GDPR serves as the legal basis.
In the event that vital interests of the user or another individual require the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.
If the processing is necessary to safeguard the legitimate interests of Viega or of a third party and if the user's interests, fundamental rights and fundamental freedoms do not outweigh the former interest, Art. 6 (1) (f) GDPR serves as legal basis for processing. Viega's legitimate interest lies in conducting Viega's business.