Privacy Policy

How to contact the data protection officer

The designated data protection officer is:DataCo GmbHDachauer Str. 6580335 MunichGermany+49 89 7400 45840www.dataguard.de

General information on data processing

On this page, we provide you with information regarding the processing of your personal data on our website.

How we collect and use your personal data will depend on how you interact with us or the services you use. We only collect, use or share your personal data where we have a legitimate purpose and a legal basis for doing so.

What do we mean by ‘legal basis’?

Consent (Art. 6(1) (a) GDPR)– You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. For further information on how to withdraw consent, please see the ‘Exercising your rights’ subsections in the subsequent sections of this Privacy Policy.

Contract (Art 6(1) (b) GDPR) – We need to use your data to fulfil a contract you have with us. Alternatively, it’s necessary to use your data because we have asked you to, or you have taken yourself, specific steps before entering that contract.

Legal Obligation (Art 6(1) (c) GDPR) – We need to use you’re your data to comply with the law.

Vital Interests (Art 6(1) (d) GDPR) – Processing your data is necessary to protect your vital interests or of another person. For example, to prevent you from serious physical harm.

Public Task (Art 6(1) (e) GDPR) – Using your data is necessary for the performance of a task carried out in the public interest, or because it is covered by a task set out in law, for example, for a statutory function.

Legitimate Interests (Art 6(1) (f) GDPR) – Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.

Please note where your data is processed under the performance of a contract or for a legal obligation, if you do not provide the data requested, we may be unable to provide you with our app.

Data sharing and international transfers

As explained throughout this Privacy Policy, we use various service providers to help us deliver our services and keep your data secure. When we use these service providers, it is necessary for us to share your personal data with them.

We have agreements in place with all our service providers that we share your data with that oblige them to protect your data.

Where your personal data is shared outside the EU, we ensure that your personal data is given an equivalent level of protection, either because the jurisdiction to which your data is transferred has an ‘adequate’ data protection standard according to the European Commission, or by using another safeguard such as an enhanced contractual agreement, i.e. Standard Contractual Clauses adopted by the European Commission (SCCs).

For example, where we use US service providers, we either rely on SCCs or the EU-US Data Protection Framework, depending on the specific provider. You can request a copy of SCCs we have concluded with our service providers by sending an email to the email address provided in this Privacy Policy.

Your rights

When your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights:

1. Right of access (Art. 15 GDPR)

You may request the data controller to confirm whether your personal data is processed by them.

If such processing occurs, you can request the following information from the data controller:

• Purposes of processing
• Categories of personal data being processed.
• Recipients or categories of recipients to whom the personal data have been or will be disclosed.
• Planned storage period or the criteria for determining this period
• The existence of the rights of rectification, erasure or restriction or opposition.
• The existence of the right to lodge a complaint with a supervisory authority.
• If applicable, origin of the data (if collected from a third party).
• If applicable, existence of automated decision-making including profiling with meaningful information about the logic involved, the scope and the effects to be expected.
• If applicable, transfer of personal data to a third country or international organization.

2. Right to rectification (Art. 16 GDPR)

You have a right to rectification and/or modification of the data, if your processed personal data is incorrect or incomplete. The data controller must correct the data without delay

3. Right to the restriction of processing (Art. 18 GDPR)

You may request the restriction of the processing of your personal data under the following conditions:

• If you challenge the accuracy of your personal data for a period that enables the data controller to verify the accuracy of your personal data.
• The processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of their use instead.
• The data controller or its representative no longer need the personal data for the purpose of processing, but you need it to assert, exercise or defend legal claims; or
• If you have objected to the processing pursuant and it is not yet certain whether the legitimate interests of the data controller override your interests.

4. Right to erasure (“Right to be forgotten”) (Art. 17 GDPR)

If you request from the data controller to delete your personal data without undue delay, they are required to do so immediately if one of the following applies:

• Personal data concerning you is no longer necessary for the purposes for which they were collected or processed.
• You withdraw your consent on which the processing is based pursuant to and where there is no other legal basis for processing the data.
• You object to the processing of the data and there are no longer overriding legitimate grounds for processing, or you object pursuant to Art. 21 (2) GDPR.
• Your personal data has been processed unlawfully.
• The personal data must be deleted to comply with a legal obligation in Union law or Member State law to which the data controller is subject.
• Your personal data was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

The right to deletion does not exist if the processing is necessary

• to exercise the right to freedom of speech and information;
• to fulfil a legal obligation required by the law of the Union or Member States to which the data controller is subject, or to perform a task of public interest or in the exercise of public authority delegated to the representative.
• for reasons of public interest in the field of public health.
• for archival purposes of public interest, scientific or historical research purposes or for statistical purposes.
• to enforce, exercise or defend legal claims.

5. Right to data portability

You have the right to receive your personal data given to the data controller in a structured and machine-readable format. In addition, you have the right to transfer this data to another person without hindrance by the data controller who was initially given the data.

6. Right to object

For reasons that arise from your particular situation, you have, at any time, the right to object to the processing of your personal data pursuant to Art. 6 (1) (e) or 6 (1) (f) GDPR; this also applies to profiling based on these provisions.

If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data in regard to such advertising; this also applies to profiling associated with direct marketing.

7. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR. A list, of the locally competent supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

Data processing when you load our website

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and relevant information from the computer system of the calling device.

The following data is collected:

• The IP address of the calling device
• Information about the browser type and the version used
• The user’s operating system
• The Internet service provider of the user
• Date and time of access
• The page requested and the page visited before it (referrer)

This data is stored in the log files of our system.

2. Purpose of data processing

The temporary storage of the IP address by the system is necessary for the delivery of the website to the computer of the user. For this purpose, the user’s IP address must be kept for the duration of the session.

The storage in logfiles is done to ensure the functionality of the website. The data is also used to optimize the website and to ensure the security of our IT systems. An analysis of the data for marketing purposes does not take place.

3. Legal basis for data processing

The legal basis for the temporary storage of data and logfiles is Art. 6 (1) (f) GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. The session is complete when the collection of data for the provision of the website is accomplished.

If the data is stored in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated so that an assignment of the calling client is not possible.

5. Exercising your rights

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. The user can object to this. Whether the objection is successful is to be determined within the framework of a balancing of interests.

Cookies and local storage

1. Description and scope of data processing

Our website sets no cookies of its own. For a single function we use your browser’s local storage. This is a technique that keeps information on your device in much the same way a cookie does, but without transmitting it to our server on every page view.

The only thing kept in local storage is:

• Your decision on whether analytics and marketing services may be used, together with the time of that decision (key “sli-consent”)

The language you are reading follows from the address you called up (/de/ or /en/) and is not stored. The session itself is not tracked through a cookie either.

Cookies are only set once you have consented to the statistics or marketing category. They then come from the Google services described under “Analytics and advertising”. Without your consent none of those providers’ scripts is loaded.

2. Purpose of data processing

Storing your decision allows us to honour it on every further visit, so that you are not asked again. At the same time it lets us meet our obligation to demonstrate a consent that has been given.

3. Legal basis for data processing

The storage of information on your device and access to information already stored there is governed by the German Telecommunications Digital Services Data Protection Act (TDDDG). Storing your consent decision is necessary in order to provide the service you have expressly requested and therefore takes place on the basis of Section 25 (2) no. 2 TDDDG.

Where information that is not technically necessary is stored on or read from your device beyond that, this happens solely on the basis of your consent under Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) and Art. 7 GDPR. If personal data is processed afterwards, the provisions of the GDPR apply. You will find information on this in the following sections of this privacy policy.

4. Duration of storage

Your decision expires after six months, after which we ask you again. You can also clear local storage at any time through your browser settings, which removes your decision as well.

5. Exercising your rights

You may withdraw your consent at any time with effect for the future, or give it later on. The dialogue for this opens through the “Cookie settings” link in the footer of every page. Alternatively you can prevent cookies from being stored through the settings of your browser software. Please note that such browser settings only affect the browser you are using.

6. Consent management

The consent banner and the management of your choice are part of this website. We use no third-party consent software for it. Your decision stays on your device and is transmitted neither to us nor to third parties.

Analytics and advertising

The services described below are only loaded once you have consented to the relevant category. As long as you have not, none of these providers’ scripts is present on the page and no connection to their servers is established.

In addition we use Google Consent Mode v2. The consent signals for advertising, ad user data, ad personalisation, analytics and personalisation are set to “denied” from the outset and are only set to “granted” by your consent.

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistical tools and other technologies into our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any analyses of its own. It only serves to manage and deliver the tools integrated through it. Google Tag Manager does, however, record your IP address, which may also be transferred to Google’s parent company in the United States.

It is used solely on the basis of your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. Consent can be withdrawn at any time.

The company is certified under the EU-US Data Privacy Framework (DPF), an agreement between the European Union and the United States intended to ensure compliance with European data protection standards for processing in the United States. Every company certified under the DPF undertakes to comply with those standards. Further information is available from the provider at: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Google Analytics

This website uses functions of the web analytics service Google Analytics 4. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so the website operator receives various usage data such as page views, time on site, operating systems used and the origin of the user. This data is assigned to the respective end device of the user. It is not assigned to a user ID.

Google Analytics uses technologies that make it possible to recognise the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website may be transferred to a Google server in the United States and stored there.

This service is used on the basis of your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. Consent can be withdrawn at any time.

The transfer of data to the United States is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/

The company is certified under the EU-US Data Privacy Framework (DPF). Further information is available from the provider at: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Handling of IP addresses

In Google Analytics 4 the IP address is used only to derive the approximate location and is not stored permanently. The separate IP anonymisation setting that earlier versions of Google Analytics required no longer exists; truncation happens automatically. For access from the European Economic Area the data is first collected on servers within the European Union. The IP address transmitted as part of Google Analytics is not merged with other data held by Google.

Google Ads and conversion tracking

1. Description and scope of data processing

We use Google Ads with its conversion tracking, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The service allows us to determine whether users have carried out certain actions on our website after clicking one of our ads. Google uses cookies or similar technologies to recognise returning users. On our website such an action is recorded when you send an enquiry through our contact form. The information is made available to us in aggregated form, so that no conclusions about the identity of individual users are possible.

2. Purpose of data processing

The processing serves to analyse and optimise our advertising. The data collected helps us assess how effective our ads are and improve our marketing strategy in order to provide relevant content and offers.

3. Legal basis for data processing

The processing takes place on the basis of your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future.

4. Duration of storage

The personal data collected through conversion tracking is stored for as long as it is required for the purposes stated, or until you withdraw your consent. After that the data is deleted or anonymised, unless statutory retention obligations apply.

5. Exercising your rights

You have the right at any time to request information about the data stored about you, to have inaccurate data corrected or to have your data erased, unless statutory retention obligations prevent this. You also have the right to request restriction of processing or data portability. If you have questions about the processing of data by Google you may contact us or Google directly.

6. Privacy policy of the provider

Further information on data processing by Google can be found in Google’s privacy policy at: https://policies.google.com/privacy

Newsletter

1. Description and scope of data processing

You can subscribe to our newsletter through the sign-up form on our website. In doing so we collect your first and last name, your email address and the time of your sign-up. Signing up requires you to confirm your consent explicitly in the form.

For sending we use the services of Brevo, operated by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. The personal data you provide is processed and stored on Brevo servers within the EU. Brevo acts as our processor pursuant to Art. 28 GDPR.

Your details are transmitted to Brevo by our server. Your browser establishes no connection to Brevo in the process, and no Brevo script is loaded on our website.

After you submit the form you receive an email in which you confirm the subscription (double opt-in). Only after that confirmation do we add you to the distribution list. The confirmation is how Brevo documents your consent.

The following personal data may be processed as part of this service:

• First and last name
• Email address
• IP address when confirming the subscription and when interacting with our emails
• Open and click rates of emails
• Date and time of sign-up and of email dispatch
• Further details you provide yourself

2. Purpose of data processing

The data is processed in order to send and evaluate our email newsletters, maintain recipient lists, prevent misuse, ensure the integrity and security of the system and comply with legal obligations.

3. Legal basis for data processing

The processing takes place on the basis of your consent under Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with effect for the future, for example through the unsubscribe link in every newsletter email.

4. Duration of storage

Your personal data is stored for as long as you are subscribed to the newsletter. After you unsubscribe or withdraw your consent your data is deleted or anonymised within 100 days, unless statutory retention obligations or legitimate interests require longer storage. This period of 100 days follows from the data processing agreement with Brevo (Art. 28 GDPR).

5. Exercising your rights

To exercise your rights you may contact us or Brevo directly. Brevo provides the following address for data protection enquiries: dpo@brevo.com

Further information on the processing of personal data by Brevo can be found at: https://www.brevo.com/legal/privacypolicy/

Contact via Email

1. Description and scope of data processing

You can contact us via the email address provided on our website. In this case the personal data of the user transmitted with the email will be stored.

The data will be used exclusively for the processing of the conversation.

2. Purpose of data processing

If you contact us via email, this also constitutes the necessary legitimate interest in the processing of the data.

3. Legal basis for data processing

The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 (1) (f) GDPR. Our legitimate interest is to optimally answer your request that you send by e-mail.

If the purpose of the email contact is to conclude a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation ends when it can be concluded from the circumstances that the matter in question has been conclusively resolved.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5. Exercising your rights

You have the possibility to withdraw consent to the processing of their personal data at any time. If you contact us via email, you can object to the storage of his personal data at any time, by the following means:

Nimmt der Nutzer per Kontaktformular Kontakt mit uns auf, so kann er der Speicherung seiner personenbezogenen Daten jederzeit per E-Mail an info@slichemicals.com widersprechen. In einem solchen Fall kann die Konversation nicht fortgeführt werden. Alle personenbezogenen Daten, die im Zuge der Kontaktaufnahme gespeichert wurden, werden in diesem Fall gelöscht.

In this case, all personal data stored while establishing contact will be deleted.

Contact form

1. Description and scope of data processing

A contact form is available on our website, which can be used for electronic contact. If you make use of this option, the data entered in the contact form will be transmitted to us and stored.

When sending the message the following data is transmitted:

• First and last name
• Business email address
• Telephone number
• Your message to us
• Your confirmation that you have taken note of this privacy policy
• IP address of the user’s device
• Date and time of transmission

The details are delivered by email to our mailbox and stored there while we handle your enquiry. No storage beyond that takes place on the web server.

2. Purpose of data processing

The processing of the personal data from the form as well as if you contact us by mail serves us exclusively for the purpose of establishing contact.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

3. Legal basis for data processing

The legal basis for the processing of data transmitted while sending an email is Art. 6 (1) (f) GDPR. Our legitimate interest is to provide you with the best possible response to the request you send to us via the contact form. If the purpose of the email contact is to conclude a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR.

4. Duration of storage

The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. For the personal data from the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation ends when it can be inferred from the circumstances that the facts in question have been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5. Exercising your rights

If you contact us via the the contact form or via e-mail, you can object to the storage of your personal data at any time, by the following means:

Nimmt der Nutzer per Kontaktformular Kontakt mit uns auf, so kann er der Speicherung seiner personenbezogenen Daten jederzeit per E-Mail an info@slichemicals.com widersprechen. In einem solchen Fall kann die Konversation nicht fortgeführt werden. Alle personenbezogenen Daten, die im Zuge der Kontaktaufnahme gespeichert wurden, werden in diesem Fall gelöscht.

In this case, all personal data stored while establishing contact will be deleted.

Application via Email

1. Description and scope of data processing

You can send us your application via email. We process your email address and the information you provide in the email.

After sending your application, you will receive confirmation of receipt of your application documents from us by email.

2. Purpose of data processing

The processing of personal data from the application form serves us solely to process your application.

3. Legal basis for data processing

The legal basis for the processing of the data is the initiation of the contractual relationship at the request of the data subject, Art. 6 (1) (b) Alt. 1 GDPR and § 26 (1) BDSG (Federal Act of Dataprotection).

4. Duration of storage

After completion of the application procedure, the data will be stored for up to 6 months. Your data will be deleted after 6 months at the latest. In the event of a legal obligation, the data will be stored within the framework of the applicable provisions.

Hosting

The website is hosted on servers of a service provider commissioned by us.

Our service provider is:Hostinger, UAB, Švitrigailos str. 34, LT-03230 Vilnius, Lithuania

A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

For further information on the processing of personal data by Hostinger please see:

https://www.hostinger.com/legal/privacy-policy

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information is:

• The IP address of the calling device
• Information about the browser type and the version used
• The user’s operating system
• The Internet service provider of the user
• Date and time of access
• The page requested and the page visited before it (referrer)

This data will not be merged with other data sources. The data is collected on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of his website – and server log files are therefore recorded.

The server this website runs on is located in France and therefore within the European Union.

Integrated third-party services

We use various service providers in order to provide the service offered through the website.

Where such services are indispensable for providing the basic functions of the website, we generally have a legitimate interest in passing your data on to the respective service providers in order to be able to provide the service in question.

Where such services are required for additional services, extended functions or further purposes, your personal data is only transmitted to service providers if you have consented.

You can manage your consent preferences at any time through the “Cookie settings” link in the footer of every page.

Typefaces

The typefaces used on this website are held locally on our server and delivered from there. When the page is loaded, no connection is established to servers of Google or other font providers, and no data is transmitted to them.

Use of Sanity

1. Scope of the processing of personal data

We maintain the content of this website in Sanity, a content management system of Sanity AS (Norway) and Sanity US Inc. (USA) (“Sanity”). Text and images are retrieved by our server and delivered from there to your browser. Your IP address is not transmitted to Sanity in the process.

The files offered on the “Downloads” page are an exception. They are held in Sanity’s content delivery network (cdn.sanity.io). When you request one of these files, your browser retrieves it directly from there, transmitting your IP address as well as technical details about your browser and operating system to Sanity.

2. Purpose of data processing

Sanity is used to maintain and reliably deliver the content of our website, in particular the documents offered for download.

3. Legal basis for the processing of personal data

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically reliable and fast provision of our content. A data processing agreement pursuant to Art. 28 GDPR is in place with Sanity.

Norway is a contracting state of the Agreement on the European Economic Area, so the level of data protection of the GDPR applies there. Where personal data is transferred to the United States, we base the transfer on the standard contractual clauses of the European Commission.

4. Duration of storage

The data arising when a file is retrieved is processed by Sanity for delivery and to prevent misuse, and is deleted after a short period. For details please refer to the provider’s privacy policy.

5. Exercising your rights

You can avoid the retrieval by not downloading the files in question. Sanity provides the address dpo@sanity.io for data protection enquiries.

Further information on the collection and storage of data by Sanity can be found at: https://www.sanity.io/legal/privacy

Whistleblowing system

For reports of possible violations we operate an external whistleblowing system, reachable through a link on our website. It is operated by a third party at https://slichemicals.integrityline.com/. Following that link takes you off our website; the operator’s privacy policy applies to the processing that takes place there.

This privacy policy has been created with the assistance of DataGuard.