/ Legal

Privacy policy

Dear Sir or Madam,

With this document we fulfil our obligation to provide information under data protection law and would like to transparently inform you about how we handle your personal data.

1. Controller Responsible for Data Processing

finova Feinschneidtechnik GmbH
Am Weidenbroich 24
42897 Remscheid
Germany

2. Contact for Data Protection

Email: vural@hopp-flaig.de

3. Data Processing on Our Website

3.1 Server Log Files

 
The provider of the website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:
 
  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address
 
The processing of this data is technically necessary in order to ensure the correct display and stability of our website.
The legal basis for this processing is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.
This data will not be merged with other data sources. Log files are deleted after seven days.
 

3.2 Cookies and Similar Technologies

Our website uses cookies and comparable technologies (e.g. Local Storage) in order to provide a user-friendly and secure user experience. Cookies are small text files that are stored on your device via your browser.
 
We use different types of cookies and technologies:
Technically necessary cookies
These are required to ensure the secure and error-free operation of our website. Without them certain functions (e.g. login, language settings or security tools) could not be provided.
 
The legal basis is Art. 6 (1) lit. f GDPR in conjunction with § 25 (2) No. 2 TDDDG.
Our legitimate interest lies in providing a stable and secure website.
Functional, analysis and marketing technologies
These technologies are not strictly necessary for the operation of the website. They serve to improve performance, design and user experience or to analyse visitor behaviour.
 
These technologies are used exclusively with your explicit consent.
The legal basis is Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG.
The cookie borlabs-cookie stores the consent you have given when entering the website. If you wish to revoke this consent, simply delete the cookie in your browser. When you visit or reload the website again, you will be asked for your cookie consent again.
 

4. Integration of Additional Services and Content

We use various external services on our website to provide content, functions and analyses and to improve the user experience. When using these services, personal data may be processed and, where applicable, transmitted to servers in third countries.
 
For all services that are not technically necessary, your consent is obtained via our consent management tool.
 

4.1 Consent Management

To obtain and manage the legally required consent for the use of cookies and similar technologies, we use the Consent Management Tool Borlabs Cookie.
Provider:
Borlabs GmbH
Hamburger Straße 11
22083 Hamburg
Germany
Borlabs Cookie displays a consent banner on your first visit to our website where you can determine whether and which categories of cookies and services you wish to allow.

Your selection is stored so that your preferences are taken into account on future visits and your consent does not need to be requested again.
Data processing is carried out to fulfil our legal obligations pursuant to Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR and § 25 (1) TDDDG.
Borlabs Cookie stores in particular the consent status and a consent ID in the user’s browser.

Further information can be found at:
https://de.borlabs.io/datenschutz/

 

4.2 SalesViewer

Our website uses the web analytics service SalesViewer.
Provider:
SalesViewer® GmbH
Huestr. 30
44787 Bochum
Germany
SalesViewer collects and evaluates information about the visiting behaviour of companies on our website. Technical information such as IP address, pages visited and time and duration of the visit are processed.
Processing takes place exclusively on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG.
Further information can be found at:
https://www.salesviewer.com/de/datenschutz/

 

4.3 OpenStreetMap

We use map services provided by OpenStreetMap.
Provider:
OpenStreetMap Foundation
132 Maney Hill Road
Sutton Coldfield
West Midlands B72 1JU
United Kingdom

In order to use the map functions, it is necessary to process your IP address. This information is usually transmitted to an OpenStreetMap server and stored there.
Use takes place exclusively on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG.
Further information:
https://wiki.osmfoundation.org/wiki/Privacy_Policy

 

4.4 Hosting

Our website is hosted by:
Hetzner Online GmbH

Industriestraße 25

91710 Gunzenhausen

Germany

Within the scope of hosting, technically necessary data is processed in order to ensure the secure and stable operation of the website. This includes in particular IP addresses, access times and technical log information.

Processing is carried out on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting provider.

5. Social Media

 
Our website contains links to our profiles on social media networks. The respective platforms are linked via icons in the footer of our website.
If you click on such an icon, you will be redirected directly to our profile on the respective platform. Personal data will only be processed by the operator of the social network when you access the respective platform.
The processing is carried out under the responsibility of the respective platform operator.
 
We maintain profiles on the following platforms:
 
  • Facebook (Meta Platforms Ireland Limited, Dublin, Ireland)
  • LinkedIn (LinkedIn Ireland Unlimited Company, Dublin, Ireland)
  • XING (New Work SE, Hamburg, Germany)
  • YouTube (Google Ireland Limited, Dublin, Ireland)
 
Please note that operators of social networks may also process personal data outside the European Union, particularly in the USA.
 
Further information can be found in the respective privacy policies:
 
 
 
 
 

6. Contact

If you contact us via contact form, email or post, we store the information you provide in order to process your request.
 
The processed data includes:
  • name
  • email address
  • telephone number
  • message content
  • postal address (if relevant)
 
The legal basis depends on the purpose of your enquiry:
If your request relates to the initiation of a contract (e.g. service enquiries), processing takes place pursuant to Art. 6 (1) lit. b GDPR.
For general enquiries, the legal basis is Art. 6 (1) lit. f GDPR, as we have a legitimate interest in responding to enquiries and communicating with customers and interested parties.
 
Data will be deleted once your enquiry has been fully processed and no statutory retention obligations exist.
 
Providing your contact data is necessary to process your enquiry. Without this information we may not be able to respond.
Providing additional information is voluntary.
 

7. Processing of Applicant Data

Within the context of your application, we process your personal data to assess your suitability for the position and to carry out the recruitment process.
 

7.1 Collection and Processing of Application Data

You can apply via our career page, which is operated using the Softgarden applicant management system.
Provider:
softgarden e-recruiting GmbH
Tauentzienstraße 14
10789 Berlin
Germany
 
The following personal data may be processed:
  • name
  • contact details (address, email address, telephone number)
  • application documents (CV, certificates, cover letter)
  • qualifications and professional experience
  • additional information voluntarily provided by you
 
Processing takes place in order to:
  • conduct the recruitment process
  • assess suitability for the advertised position
  • communicate during the selection process
  • potentially initiate an employment relationship
 
Legal basis:
§ 26 (1) BDSG in conjunction with Art. 6 (1) lit. b GDPR
If you voluntarily provide special categories of personal data (e.g. health data or religious affiliation), processing takes place on the basis of Art. 9 (2) lit. a GDPR (consent).
 
Providing application data is necessary for participation in the recruitment process.
 

7.2 Storage Period of Applicant Data

If your application is successful and you are hired, your application documents will become part of your personnel file and will be stored in accordance with the statutory retention periods.
 
If your application is rejected, your data will be deleted or anonymised six months after completion of the application process.
This serves to fulfil documentation obligations under the German General Equal Treatment Act (AGG).
 

7.3 Recipients of Applicant Data

Within our company, only those persons who are involved in the recruitment process have access to your application data, in particular the HR department and the responsible managers of the respective specialist department.

For the administration of our applications, we use the applicant management system of softgarden e-recruiting GmbH, Tauentzienstraße 14, 10789 Berlin, Germany. In this context, Softgarden acts as a processor pursuant to Art. 28 GDPR on our behalf. A corresponding data processing agreement has been concluded with the provider.

Further information on data processing by Softgarden can be found at:
https://softgarden.com/de/datenschutz-webseite/

If applications are submitted via external platforms such as LinkedIn, XING, X (formerly Twitter) or YouTube, the initial collection and processing of data is carried out by the respective platform providers. The respective providers’ privacy policies apply to the processing of your data on these platforms.

LinkedIn: https://www.linkedin.com/legal/privacy-policy

XING: https://privacy.xing.com/de/datenschutzerklaerung

X (Twitter): https://twitter.com/de/privacy

YouTube (Google): https://policies.google.com/privacy

Please note that when using these platforms, the processing of your personal data outside the European Union, particularly in the United States, cannot be excluded. We have no influence over the data processing carried out by the respective platform operators.

8. Processing of Data of Trade Fair Visitors

If you visit our trade fair stand and provide us with your contact details, for example by means of a form or by handing over a business card, we process this personal data in order to contact you, provide you with information about our products and services, and initiate a potential business relationship.

For this purpose, we store your data in order to enable future communication and, where necessary, prepare individual offers. The processing is carried out on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, as we wish to maintain and further develop the business contacts established during a trade fair.

The provision of your data is voluntary. Within our company, only those employees responsible for following up trade fair contacts, in particular from the sales or marketing departments, have access to your data. As a rule, your data is not disclosed to external third parties unless this is necessary for processing your request or required by law. In such cases, the data is only passed on to carefully selected service providers who support us in customer communication and with whom corresponding data processing agreements have been concluded.

9. Data Protection Information for Business Partners

In addition to the general information in this privacy policy, we would like to inform you below about the processing of personal data in the context of our business relationships with suppliers, service providers and other business partners.

9.1 Customers and Prospective Customers

We process your personal data in order to prepare individual offers for works or services, conclude contracts or execute orders, as well as to handle enquiries regarding services already rendered, products or complaints, and to settle invoices.

For the performance of these processes, the collection of a minimum amount of personal data is necessary in order to provide contractually agreed services or prepare offers. In doing so, we always adhere to the principle of data minimisation and only collect the data required for the fulfilment of our tasks. Your data is processed on the basis of Art. 6 (1) lit. b GDPR, insofar as this is necessary for the performance of a contract or the implementation of pre-contractual measures, and on the basis of Art. 6 (1) lit. f GDPR, insofar as it serves the handling of enquiries and the protection of legitimate interests.

Your personal data is only shared internally insofar as this is necessary for the fulfilment of contractual obligations or other tasks related to the activities described.

Your personal data may be shared externally under the following circumstances:

  • Cooperation partners/subcontractors: forwarding of your contact details for the coordination of several contractors with one another, in the event that another service provider/supplier is commissioned to fulfil the contractual obligations agreed with you as part of our cooperation.
  • Service providers: commissioning support services in the course of which access to your personal data is necessary or at least cannot be completely ruled out. These include, for example, IT service providers (IT support services), financial service providers (services in connection with invoice settlement), or tax advisers (tax advisory services). Where required, data processing agreements have been concluded with these service providers.
  • Authorities: disclosure of your personal data on the basis of statutory obligations to, for example, tax authorities, courts or other competent authorities.

 

9.2 Suppliers and Service Providers

We process your personal data in order to prepare individual offers for requested works or services, conclude contracts, provide and invoice the contractually agreed services, and to protect ourselves against payment defaults.

In order to properly provide our services or submit a suitable offer to you upon request, the collection of a minimum amount of personal data is necessary. In doing so, we strictly adhere to the principle of data minimisation and only collect those data that are necessary for the fulfilment of our tasks. Your data is processed on the basis of Art. 6 (1) lit. b GDPR for the performance of a contract or the implementation of pre-contractual measures, as well as on the basis of Art. 6 (1) lit. f GDPR for the protection of our legitimate interest in safeguarding against payment defaults.

We process your personal data for the following purposes:

  • preparation of individual offers following requests for works or services addressed to us
  • preparation of a service contract or contract for work
  • performance of the contractually agreed service
  • invoicing of the contractually agreed service
  • safeguarding against payment defaults

In order to perform our contractually agreed services or prepare an individual offer in response to your enquiry, we require a minimum amount of personal data. We always observe the principle of data minimisation and do not collect any personal data that we do not need to fulfil our tasks.

Your personal data is only shared internally insofar as this is necessary for the fulfilment of contractual obligations or other tasks related to the activities described.

Your personal data may be shared externally under the following circumstances:

  • Subcontractors: commissioning of a subcontractor to fulfil the contractual obligations agreed with you in the context of our cooperation. Where required, data processing agreements have been concluded with such subcontractors.
  • Service providers: commissioning support services in the course of which access to your personal data is necessary or at least cannot be completely ruled out. These include, for example, IT service providers (IT support services), financial service providers (services in connection with invoicing), or tax advisers (tax advisory services). Where required, data processing agreements have been concluded with these service providers.
  • Authorities: disclosure of your personal data on the basis of statutory obligations to, for example, tax authorities, courts or other competent authorities.
  • Credit agencies: obtaining information from credit agencies (e.g. Creditreform, Schufa) for creditworthiness checks, based on our legitimate interest in safeguarding against payment defaults (Art. 6 (1) lit. f GDPR).

10. Processing of Visitor Data (Access Control)

When entering our company premises, we collect personal data at reception such as your name, company, time of visit and, where applicable, vehicle registration number.

The processing is carried out for access control, to ensure the security of the company, and to fulfil statutory verification and documentation obligations, for example for fire protection and evacuation lists.

The legal basis is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.

The data is stored only for as long as necessary for the stated purposes and is then deleted, provided that no statutory retention obligations apply.

11. German Whistleblower Protection Act (Whistleblowing System)

As an internal reporting office pursuant to the German Whistleblower Protection Act (HinSchG), we enable persons who have obtained information about violations in connection with their professional activity or in the run-up to a professional activity to report such information to us without hindrance.

The provision and use of our whistleblowing system and other communication channels made available for this purpose serve to implement the reporting channel required under the German Whistleblower Protection Act.

The reporting offices are authorised to process personal data insofar as this is necessary to fulfil the tasks set out in Section 13 HinSchG.

  • The type of personal data processed depends on the nature of the reported violation and the information contained in the report. This may include, for example, name, contact details, information on professional activity, and information on the reported violation (including names of persons concerned and descriptions of the facts).
  • Processing of reports concerning violations, conducting internal investigations, and fulfilling statutory obligations under the HinSchG.

We process your personal data on the basis of the following legal grounds:

  • Art. 6 (1) lit. c GDPR in conjunction with Section 10 HinSchG (compliance with a legal obligation).
  • Art. 9 (2) lit. g GDPR in conjunction with Section 10 HinSchG (processing for reasons of substantial public interest in the field of labour law, social security and social protection law, insofar as this is proportionate and respects the essence of the right to data protection).

Personal data is disclosed only insofar as this is necessary for the processing of a report or for the fulfilment of statutory obligations.

Recipients of your personal data may include the following under certain circumstances:

  • Authorities: disclosure of your personal data on the basis of statutory obligations to, for example, supervisory authorities or law enforcement authorities.
  • Internal investigation bodies: organisational units within the employer or the respective organisational unit that are responsible for internal investigations.
  • Bodies designated by you: other bodies where this is requested and authorised by you.
  • External advisers: external lawyers or other external advisers where this is necessary in connection with handling the whistleblowing incident.

12. Your Rights as a Data Subject

You have the right at any time to obtain information about the data stored concerning you. In addition, subject to the statutory requirements, you have the following rights:

  • Right of access (Art. 15 GDPR): You have the right to request information as to whether and which personal data concerning you is being processed by us.
  • Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate personal data or the completion of incomplete personal data.
  • Right to erasure (Art. 17 GDPR, “right to be forgotten”): You may request the deletion of your personal data if, for example, the purpose of storage no longer applies or the data has been processed unlawfully.
  • Right to restriction of processing (Art. 18 GDPR): You may request restriction of the processing of your data if, for example, the accuracy of the data is contested.
  • Right to data portability (Art. 20 GDPR): You have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller.
  • Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data, provided that the processing is based on the legitimate interests of our company or on a task carried out in the public interest. In the event of a justified objection, we will cease processing unless there are compelling legitimate grounds for the processing.
  • Right to withdraw consent (Art. 7 (3) GDPR): Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): If you believe that the processing of your data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

To exercise your rights, you may contact us or our data protection officer at any time (see contact details above). We will process your requests without undue delay. We reserve the right to require prior identification of your person for the purpose of processing your request, in order to ensure that the information is provided to the correct person.

13. Right to Lodge a Complaint with the Supervisory Authority

If you consider it necessary to lodge a complaint with the competent supervisory authority, you are free to do so at any time. The address of the competent supervisory authority in Baden-Württemberg is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany

14. Amendments to This Privacy Policy

We reserve the right to amend this privacy policy from time to time in order to ensure that it always complies with current legal requirements or to reflect changes to our services in the privacy policy. We therefore recommend that you review this policy regularly.

Version as of: 4 March 2026