Privacy policy

Extent of personal data processing
As a basic principle, we process our users’ personal data only if doing so is necessary to providing a functional website as well as our contents and services. Our users’ personal data is processed regularly, and only after said users have given their consent to this effect. An exception applies in those cases where it is not possible to obtain prior consent for factual reasons and where data processing is permitted by law.

Legal basis for personal data processing
Soweit wir für Verarbeitungsvorgänge personenbezogener Daten eine Einwilligung der betroffenen Person einholen, dient Art. 6 Abs. 1 lit. a EU-Datenschutzgrundverordnung (DSGVO) als Rechtsgrundlage.

Insofar as we obtain the data subject’s consent to process their personal data, Art. 6, Para. 1, lit. a of the EU General Data Protection Regulation (GDPR) shall apply as the legal basis.

In the event of personal data which is necessary to fulfilling a contract, the contracting party for which is the data subject, being processed, Art. 6, Para. 1, lit. b of the GDPR shall apply as the legal basis. This also applies to processing which is required to carry out pre-contractual measures.

If personal data needs to be processed to fulfil a legal obligation to which our company is subject, Art. 6, Para. 1, lit. c of the GDPR shall apply as the legal basis.

In cases where the vital interests of the data subject or another natural person necessitate processing of personal data, Art. 6, Para. 1, lit. d of the GDPR shall apply as the legal basis.

If processing is necessary to protecting a legitimate interest on the part of our company or a third party, and if the data subject’s interests, fundamental rights and fundamental freedoms do not take precedence over the former interest, Art. 6, Para. 1, lit. f of the GDPR shall apply as the legal basis for processing.

Description and extent of data processing
Each time our website is accessed, our system automatically records data and information from the accessing computer’s computer system. The following data is collected:

• The user’s IP address
• Date and time of access
• Information about the browser type and the version used
• The user’s operating system

The data is also stored in our system’s log files. This data is not stored together with other personal data belonging to the user.

Legal basis for data processing
The legal basis for the temporary storage of data and the log files is Art. 6, Para. 1, lit. f of the GDPR.

Purpose of data processing

Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. The user’s IP address must remain stored for the duration of the session for this purpose.

Storage in log files is carried out to guarantee the functionality of the website. Additionally, we also use the data to optimise the website and to ensure the security of our IT systems.

Duration of storage

Our website uses “cookies”. Cookies are text information files which are transmitted to your computer along with the requested data and which are saved on your computer by your web browser. If a user accesses a website, a cookie may be stored on the user’s computer. This cookie contains a characteristic character string which enables unique identification of the browser the next time the website is called up.

Cookies help us to make our website more user-friendly. Some elements of our website 
require the accessing browser to also be identifiable after a page change.
The following data is stored and transferred in the cookies:

• Language settings

When our website is accessed, users are informed of the use of cookies by means of an information banner, and reference is made to this privacy policy. In this regard, information is also provided about how storage of cookies can be prevented in browser settings.

Legal basis for data processing
The legal basis for personal data processing using technically necessary cookies is Art. 6, Para. 1, lit. f of the GDPR.

The legal basis for personal data processing using cookies for analysis purposes, provided that the user has given their consent to this effect, is Art. 6, Para. 1, lit. a of the GDPR.

Purpose of data processing
The purpose of using technically necessary cookies is to simplify use of the website for users.
Some functions of our website cannot be offered without the use of cookies. To this end, the browser must be recognised even after a page change.

We need cookies for the following applications:

• Application of language settings

The user data collected by technically necessary cookies is not used to create user profiles.
In these purposes, we also have a legitimate interest in personal data processing according to Art. 6, Para. 1, lit. f of the GDPR.

Duration of storage and opportunity to object and remove
Cookies are stored on and transferred to us by the user’s computer. You as a user therefore have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transfer of cookies. You can delete cookies that have already been stored at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all of the website’s functions in full.

Extent of personal data processing
We use the software tool Google Analytics, a web analysis service provided by Google Ireland Limited
(“Google”), on our website. The software sets a cookie on the user’s computer (see above under “Cookies”). If individual pages of our website are accessed, the following data is stored:

• Entered search terms
• Frequency of page views
• Two bytes of the IP address of the user’s accessing system
• The accessed web page
• The sub-pages accessed from the accessed website
• The time spent on the website
• The frequency of website access
• The browser type / version
• The operating system used
• The referrer URL (page visited previously)
• The host name of the accessing computer (IP address)
• The time of the server enquiry

This data is generally transmitted to and stored on a Google server in the USA. The IP address transmitted by your browser in the context of Google Analytics is not associated with any other data held by Google. We have also enhanced Google Analytics on this website to include the “anonymizeIP” code. This guarantees that your IP address will be masked so that all data is collected anonymously. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.

Legal basis for personal data processing
The legal basis for processing users’ personal data is Art. 6, Para. 1, lit. f of the GDPR.

Purpose of data processing
Processing users’ personal data allows us to analyse our users’ surfing behaviour. Evaluating the obtained data enables us to compile information about how the individual components of our website are used. This helps us to continuously improve our website and its user-friendliness. In these purposes, we also have a legitimate interest in data processing according to Art. 6, Para. 1, lit. f of the GDPR. IP address anonymisation means that users’ interest in protecting their personal data is sufficiently taken into account.

Duration of storage
The data is deleted as soon as it is no longer needed for our recording purposes.

Opportunity to object and remove
Cookies are stored on and transferred to us by the user’s computer. You as a user therefore have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transfer of cookies. You can delete cookies that have already been stored at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all of the website’s functions in full.

An opt-out cookie that prevents your data from being collected on future visits to this website is set. The opt-out cookie only applies to this browser and to our website, and is stored on your device. It will have to be set again if you delete the cookies from this browser. [Note: You will find information about inclusion of the opt-out cookie at: 
developers.google.com/analytics/devguides/collection/gajs/.

We additionally use Google Analytics to evaluate data from DoubleClick cookies and AdWords
for statistical purposes. If you would not like this to happen, you can disable it using the ad
preferences manager 
Anzeigenvorgaben-Manager ( www.google.com/settings/ads/onweb/) deaktivieren.

You will find further information about data protection in connection with Google Analytics in the Google Analytics Help section, for example ( support.google.com/analytics/answer/6004245.

Description and extent of data processing
On our website, there is a contact form which can be used to contact us electronically. If a user uses this option, the data entered in the input screen shall be transferred to us and stored. This data includes:

• First name
• Surname
• Address
• Phone / fax
• Email

Your consent for data processing is obtained during the sending process, and reference is made to this privacy policy. Alternatively, you can also contact us on the email address provided. In this case, the user’s personal data which is transferred with the email is stored.

Your data shall not be disclosed to third parties in this regard. The data is only used for processing the conversation.

Legal basis for data processing The legal basis for data processing, provided that the user has given their consent to this effect, is Art. 6, Para. 1, lit. a of the GDPR.

The legal basis for processing data transferred in the course of sending an email is Art. 6, Para. 1, lit. f of the GDPR. If you have contacted us by email with the aim of concluding a contract, Art. 6, Para. 1, lit. b of the GDPR forms an additional legal basis.

Purpose of data processing We only process personal data from the input screen to process the contact request. If the user makes contact by email, there is also a required legitimate interest in data processing.

The other personal data processed during the sending process is used to prevent misuse
of the contact form and to ensure the security of our IT systems.

Duration of storage
The data shall be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the contact form’s input screen and the data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when the circumstances indicate that the situation concerned has been conclusively clarified.

Opportunity to object and remove

This privacy policy only applies to our website and its sub-pages. Our website may contain links to other providers, who are not covered by this policy. If you leave our website by clicking on a link, we recommend that you carefully read the privacy policy of each website that collects personal data.

Use of Google Maps
On our website, you can use the “Google Maps” map service provided by Google Ireland Limited to view our subsidiaries’ sites on an interactive map. As a result, information about the use of Rodriguez’s website, including your IP address, is transmitted to and stored on Google servers in the USA.

In the context of its own privacy policy, while Google undertakes not to disclose information to third parties, it does make exceptions to this rule. The data collected in this way can therefore be transferred to third parties if necessary, if this is stipulated by law in the USA or if third parties process the data on Google’s behalf. You will find the Google Ireland Limited privacy policy here:

www.google.com/policies/privacy/. 
You can disable the map service and prevent data transfer to Google. To do this, disable JavaScript in your browser. If you do this, you will no longer be able to use the location display feature.

If you have given your consent or we are otherwise entitled to do so by law, we shall also disclose your personal data to the following third parties for specific purposes in addition to those third parties mentioned in Section 8:

Sometimes, we use external service providers to process your data. They have been carefully selected by us and engaged in writing. They are bound by our instructions and are regularly inspected by us. The service providers shall not disclose this data to third parties.

The recipients described are located in countries within the European Economic Are

Rights of data subjects

The following list includes the rights of data subjects according to the GDPR. Rights which are

irrelevant to our own website do not have to be mentioned. The list can be shortened in this respect.

If personal data about you is processed, you are the data subject under the terms of the GDPR, and you are entitled to the following rights vis-à-vis the controller:

Right of access
You can request confirmation of whether personal data concerning you is processed by us from the controller.

If such processing does take place, you can request information on the following from the controller:

(1) The purposes for which the personal data is being processed;

(2) The categories of personal data which are processed;

(3) The recipients or categories of recipients to whom the personal data concerning you was or shall be disclosed;

(4) The planned duration of storage of the personal data concerning you or, if specific information cannot be provided on this matter, criteria for defining the duration of storage;

(5) The existence of a right to correct or delete the personal data concerning you, a right to restrict processing by the controller, and a right to object to such processing;

(6) The existence of a right to lodge a complaint with a supervisory authority;

(7) All of the available information about the origin of the data, if the personal data was not collected from the data subject;

(8) The existence of automated decision-making, including profiling according to Art. 22, Paras. 1 and 4 of the GDPR, and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You are entitled to the right to request information about whether the personal data concerning you is transferred to a third country or an international organisation. In this context, you can request to be informed of the appropriate safeguards according to Art. 46 of the GDPR in connection with such transfer.

Right to correction
You have a right to correction and/or completion vis-à-vis the controller, provided that the processed personal data concerning you is incorrect or incomplete. The controller must correct the data without delay.

Right to restriction of processing

You can request that processing of the personal data concerning you be restricted under the following conditions:

((1) If you dispute the accuracy of the personal data concerning you for a duration that enables the controller to check the accuracy of the personal data;

(2) If processing is unlawful and you refuse deletion of the personal data and instead request restriction of your personal data’s use;

(3) The controller no longer needs the personal data for the purposes of processing, but you require the same to establish, exercise or defend legal claims; or

(4) If you have objected to processing according to Art. 21, Para. 1 of the GDPR and it has not yet been determined whether the controller’s legitimate grounds take precedence over your grounds.

If processing of the personal data concerning you is restricted, such data may – with the exception of storage – only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.

If restriction of processing was not carried out according to the aforementioned conditions, you shall be informed by the controller before the restriction is removed.

Right to deletion
Duty to delete

You can make a request to the controller that the personal data concerning you be deleted immediately, and the controller is obligated to delete this data immediately where one of the following grounds apply:

(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.

(2) You revoke your consent on which processing according to Art. 6, Para. 1, lit. a or Art. 9, Para. 2, lit. a of the GDPR was based, and there are no other legal grounds for processing.

(3) You object to processing according to Art. 21, Para. 1 of the GDPR and there are no other overriding legitimate grounds for processing, or you object to processing according to Art. 21, Para. 2 of the GDPR.

(4) The personal data concerning you was processed unlawfully.

(5) Deletion of the personal data concerning you is required to fulfil a legal obligation under Union law or the law of the member states to which the controller is subject.

(6) The personal data concerning you was collected in relation to the offer of information society services according to Art. 8, Para. 1 of the GDPR.

Information to third parties
If the controller has made the personal data concerning you public and is obligated to delete the same according to Art. 17, Para. 1 of the GDPR,
taking account of the available technology and the associated implementation costs the controller shall take appropriate measures,
including those of a technical nature, to inform other controllers processing the personal data that you as the data subject have requested
the deletion of all links to this personal data or to copies or replications of the same.

Exceptions
The right to deletion does not exist insofar as processing is required

(1) to exercise the right to freedom of expression and information;

(2) to fulfil a legal obligation which requires processing according to Union or member state law to which the controller is subject, to perform a task carried out in the public interest, or to exercise official authority vested in the controller;

(3) for reasons of public interest in the area of public health according to Art. 9, Para. 2, lit. h and i, as well as Art. 9, Para. 3 of the GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes according to Art. 89, Para. 1 of the GDPR, insofar as the right mentioned under a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or

(5) for the establishment, exercise or defence of legal claims.

Right to information
If you have asserted your right to correction, deletion or restriction of processing vis-à-vis the controller,
the controller is obligated to inform all the recipients to whom the personal data concerning you was disclosed
of this correction or deletion of data or of the restriction of processing, unless doing so proves to be impossible or would involve a disproportionate effort.

You are entitled to receive information about these recipients from the controller.

Right to data portability
You have the right to receive the respective personal data which you provided to the controller in a structured, common and machine-readable format.
You also have the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, insofar as

(1) processing is based on consent according to Art. 6, Para. 1, lit. a of the GDPR or Art. 9, Para. 2, lit. a of the GDPR or on a contract according to Art. 6, Para. 1, lit. b of the GDPR; and

(2) processing is carried out by automated means.

In exercising this right, you further have the right to have the personal data concerning you transferred directly from one controller to another, where technically feasible. The rights and freedoms of others must not be adversely affected by the exercising of this right.

The right to data portability does not apply to the processing of personal data which is necessary for the performance
of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right of objection
You have the right, on grounds relating to your particular situation, to object at any time to processing of the personal data concerning you based on Art. 6, Para. 1, lit. e or f of the GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless they can demonstrate compelling and legitimate grounds for processing which outweigh your interests, rights and freedoms, or if processing serves to establish, exercise or defend legal claims.

If the personal data concerning you is processed for the purpose of carrying out direct advertising, you have the right at any time to object to processing of the personal data concerning you for the purposes of such advertising; this also applies to profiling if it is in conjunction with such direct advertising.

If you object to processing for the purposes of direct advertising, the personal data concerning you shall no longer be processed for these purposes.

In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you can exercise your right of objection by automated means where technical specifications are used.

Right to revocation of your declaration of consent under data protection legislation

You have the right to revoke your declaration of consent under data protection legislation at any time. Revocation of consent does not affect the lawfulness of processing carried out based on consent up until the same is revoked.

Automated individual decision-making, including profiling

You have the right to not be subjected to a decision based solely on automated processing – including profiling – which has legal implications for you or significantly affects you in another way. This does not apply if the decision

(1) is required to conclude or fulfil a contract between you and the controller;

(2) is permissible based on Union or member state legislation to which the controller is subject, and this legislation contains appropriate measures to protect your rights and freedoms as well as your legitimate interests; or

(3) is made with your express consent.

However, these decisions may not be based on specific categories of personal data according to Art. 9, Para. 1 of the GDPR, insofar as Art. 9, Para. 2, lit. a or g of the GDPR does not apply and appropriate measures were taken to protect rights and freedoms as well as your legitimate interests.

With regard to the cases mentioned in (1) and (3), the controller shall take appropriate measures to protect rights and freedoms as well as your legitimate interests, which at least includes the controller’s right to request someone’s intervention, present their own point of view and contest the decision.

Right to lodge complaints with a supervisory authority

Regardless of another administrative or judicial legal remedy, you have the right to lodge complaints with a supervisory authority, particularly in the member state where your place of residence, your workplace or the place of the suspected violation is located if you believe that the processing of the personal data concerning you is in violation of the GDPR.

The supervisory authority with whom the complaint was lodged informs the complainant of the status and results of the complaint, including the possibility of a judicial legal remedy according to Art. 78 of the GDPR.