Data protection notice web

This Privacy Notice provides information about how we process your personal data when you use the website gea.com ("Website") and the related services. 

1 Who is responsible?

The entity responsible for processing your personal data is GEA Group Aktiengesellschaft (hereinafter referred to as “GEA” or “us”). 

You can reach us using the following contact information: 

GEA Group Aktiengesellschaft, Ulmenstraße 99, 40476 Düsseldorf, 
Email: GroupDataProtection@gea.com 

You can contact our Data Protection Officer at the address listed above (addition: “Data Protection Officer”) or by email: dpo.dus@gea.com

2 For what purposes do we use your personal data?

2.1 Automated Data Processing

When you access our website, your device automatically transmits data - for technical reasons - that is necessary to establish a connection and retrieve the requested and embedded content. This includes

- the IP address or device ID assigned to the respective device, 
- the type of device, 
- browser type/version, 
- the operating system used, 
- the page accessed, 
- the previously visited page (referrer URL), date and time of the server request, 
- HTTP status code,

The purpose of this processing is to display the content of our website to you, to provide you with the features and services related to our website, and to ensure the security of our IT systems. 
The processing is based on our overriding legitimate interests, Article 6(1)(f) of the General Data Protection Regulation (“GDPR”). We have a legitimate interest in ensuring the security of our IT systems and in ensuring the proper operation of our website and IT systems.

2.2 Contact Inquiries

If you contact us via the contact forms on our website, using the contact information provided on our website, or using the general contact information listed under Section 1 , we will process the data you provide:
- First name, last name,
- Company name,
- Email address,
- Phone number,
- Address,
- other information you provide.

When you contact us, we process your personal data based on our legitimate interests in handling your inquiries effectively and appropriately, pursuant to Article 6(1)(f) of the GDPR. If the processing is necessary for the performance of a contract, the legal basis for the processing is Article 6(1)(b) of the GDPR, provided that you yourself are our contractual partner. Furthermore, the processing is necessary for the performance of the contractual relationship with the respective company or organization for which you work. This also constitutes our legitimate interests, Article 6(1)(f) of the GDPR.

2.3 Cookies; Tracking and Analytics Services; Marketing Services 

2.3.1 General Information

To make your visit to our website more engaging and to enable the use of certain features, we use so-called cookies and similar technologies on our website (collectively: “cookies”). 
Cookies are small text files that are stored on your device (e.g., smartphone or laptop). Some of the cookies we use are deleted at the end of the browser session, i.e., after you close your browser (so-called session cookies). Other cookies remain on your device and allow us to recognize your browser the next time you visit (so-called persistent cookies). A list and description of the cookies we set can be found below.

We also use tracking and analytics services (collectively, “analytics services”) on our website to track your use of our website and the features provided there in detail and to evaluate your usage behavior. These analytics services help us better understand how our website is used and improve our services accordingly. These analytics services also use cookies for this purpose. 
We also use marketing services on our website so that we and third parties can display and personalize our ads on other websites based on your usage behavior, your interests, and the profiles created in this context. In addition, these services allow us to measure the reach and success of our ads. 

You can (partially) change and revoke your consent at any time by clicking on "Cookie settings" at the bottom of every page.

2.3.2 Cookies

2.3.3 Analytics Services

2.3.3.1 Google Tag Manager

We use Google Tag Manager to manage which data is tracked and in what format it is sent to different tracking platforms. The provider of the Google Tag Manager component is Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland. (“Google”). This service enables the management of website tags via an API. Google Tag Manager only implements tags. The Google Tag Manager itself does not set any analysis or marketing cookies and does not create any usage profiles. However, connection data may be processed as part of the technical provision. Google Tag Manager triggers other tags that can be used to collect data, but Google Tag Manager does not access this data. If deactivation has been performed at the domain or cookie level, it remains in effect for all tracking tags implemented with Google Tag Manager.
The legal basis for the processing of your personal data is your consent, Art. 6(1)(a) GDPR. 

2.3.3.2 Google Analytics

We use Google Analytics, a web analytics service provided by Google. The processing of your infor-mation serves to analyze this website and its visitors, as well as for marketing and advertising purposes. For this purpose, Google uses the information to evaluate your use of the website, to compile re-ports on website activity, and to provide other services related to website and internet usage to the website operator.

The following data is collected during your visit to our website: browser type/version, 
- operating system used,
- referrer URL (the website from which you reached our website),
- Hostname of the accessing device (IP address, advertising ID),
- time of the server request,

We use Google Analytics only in conjunction with the “IP anonymization” (IP masking) feature enabled by Google. This means that IP addresses are truncated by Google within the member states of the EU or the EEA. Only in exceptional cases (e.g., in the event of a technical malfunction within the EU) is the IP address sent to a U.S. server and truncated there. In these exceptional cases, your personal data is processed in the United States. There is an adequacy decision by the European Commission pursuant to Art. 45(1) of the GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the United States. Google is a company certified under the Data Privacy Framework.
We receive aggregated reports as well as pseudonymized information about the use of our website.

Your personal data is processed in connection with Google Analytics only if you have consented to the processing of personal data, Article 6(1)(a) of the GDPR. 
We store the data collected by Google Analytics in pseudonymized profiles that cannot be attributed to any individual for a period of 14 months in order to prevent misuse and optimize our websites. This data is automatically deleted after 14 months.
Personal data collected via the Google Analytics tool is transferred to Google Ireland Limited.

2.3.3.3 Microsoft Clarity

2.3.4 Marketing Services

2.3.4.1 LinkedIn Pixel Tracker

This website uses the LinkedIn Pixel Tracker, a service provided by LinkedIn. This tool enables us to analyze and personalize our ads based on your use of our website and ads in order to display advertising tailored specifically to you. 

To do this, the LinkedIn Pixel Tracker sets a cookie when you visit our website. The cookie collects information related to your LinkedIn profile. The following data is collected for this purpose: 
- IP address, 
- LinkedIn member IDs, 
- Device and browser characteristics, 
- Timestamps, 
- page views, 
- demographic information (e.g., job title, career level, industry, location, country), 
- previously visited websites, and 
- your interaction with our ads.

The legal basis for processing your personal data is your consent, Article 6(1)(a) of the GDPR. 
For more information on how LinkedIn processes your data, please see LinkedIn’s Privacy Policy: https://de.linkedin.com/legal/privacy-policy.

2.3.4.2 Google Ads

This website uses Google Ads, a service provided by Google Ireland Limited. 
When you visit our website, Google Ads stores a cookie on your device. Google uses this cookie to process information generated by your device regarding your use of our website, your interactions with our website, and advertising activities, as well as your IP address, browser information, websites you have previously visited, and the date and time of your visit, for the purpose of analyzing and visualizing the reach of our advertisements and displaying personalized ads. 
The legal basis for the processing of your personal data is your consent, Article 6(1)(a) of the GDPR. 

2.4 Newsletter Registration

You can register for the GEA newsletter on our website to stay up to date on the latest announcements, special offers, or other information about GEA’s products, technologies, and services, as well as GEA events and projects.

We use the so-called double opt-in procedure to send the newsletter; that is, we will only send you the newsletter via email once you have expressly confirmed that you would like us to activate the newsletter service. We will then send you a confirmation email and ask you to confirm that you wish to receive our newsletter by clicking on a link contained in that email.

The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR. The legal basis for the processing of your personal data for the purpose of the double opt-in or to document your consent is Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR. We are legally required to maintain proof of your consent.

If you no longer wish to receive newsletters from us, you may revoke your consent at any time with future effect by contacting us using the contact information provided in Section 1 of this Privacy Policy. Each newsletter also contains an unsubscribe link.

2.5 Event Registrations

You can register for events and webinars via our website. To do so, you must provide us with the follow-ing information:
- First name, last name,
- the company you work for,
- position and role,
- Address,
- email address,
- Phone number,

In addition, we will process the relevant data related to your registration for this purpose. This includes, in particular, billing, product, and booking data. The legal basis for the processing is Article 6(1)(b) of the GDPR. Processing is necessary for the performance of the contract.

2.6 Social Media Presence

If you interact with us via our social media pages or our posts, we will collect and process the data you provide in this context, including, where applicable, your username and any profile photo, for example, when you “like” or share a post, comment on it, or provide other content. This data is collected via the platform on which we maintain our social media presence. The related processing is based on our legitimate interest in making the corresponding functions available on our social media pages, in accordance with Article 6(1)(f) of the GDPR. Please also note that such content may be published on our social media pages in accordance with your account settings and may be accessible worldwide.

We may also process data in order to receive and handle inquiries or messages via our social media pages, pursuant to Article 6(1)(f) of the GDPR. For inquiries related to contracts, processing is carried out for the purpose of initiating or fulfilling the respective contractual relationship with you, pursuant to Article 6(1)(b) of the GDPR.
In addition, the respective operators of the social media channels collect and process your personal data under their own data protection responsibility when you visit our social media pages and/or interact with them or our posts. This applies in particular if you are registered with or logged into the relevant social media network. Even if you are not registered with or logged into a social media network, the operators collect certain personal data when you visit the page. For more information, please refer to the privacy policies of the respective operators, to which we provide links below.

- Facebook: You can find our Facebook page at https://www.facebook.com/geagroup/. Facebook is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). 

- LinkedIn: You can find our LinkedIn page at https://de.linkedin.com/company/geagroup. LinkedIn is provided by LinkedIn Ireland Un-limited Company, Wilton Place, Dublin 2, Ireland. 

- YouTube: You can find our YouTube channel at https://www.youtube.com/geagroup. YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Please note that the operators may also process your data in countries outside the EU or the EEA that do not offer an adequate level of data protection, including the United States, if the recipient does not participate in the EU-U.S. Data Privacy Framework.

For more information on data collection and use by the operators mentioned above, in particular regard-ing the measures taken for the transfer of personal data outside the EU/EEA, as well as the rights and options available to you under these circumstances to protect your privacy - please refer to the privacy policy:

- https://de-de.facebook.com/privacy/policy
- https://policies.google.com/privacy?hl=de
- https://de.linkedin.com/legal/privacy-policy

2.7 Compliance with Legal Obligations

2.8 Processing for Marketing Purposes / Marketing to Existing Customers

2.9 Legal Disputes

We process personal data where necessary to resolve disputes, enforce contractual rights and obligations, or establish, exercise, or defend legal claims.

Processing is based on our legitimate interests in maintaining our business operations, performing our duties, and establishing, exercising, or defending legal claims, pursuant to Article 6(1)(f) of the GDPR, or on a legal obligation pursuant to Article 6(1)(c) of the GDPR.

3 How do we collect your personal data?

We may collect this personal data in various ways; in particular:

- As a rule, we collect your personal data directly from you (e.g., when you voluntarily provide us with information on our website, send us an email or other written correspondence, or otherwise provide us with information in the course of our business relationship).

- We do not receive personal data from third parties unless specifically stated in this Privacy Notice (e.g., information from publicly available sources, integrity databases, and credit bureaus, or from a counterparty who typically acts with your consent and who is in possession of the data).

- Through automated collection tools (e.g., cookies and other analytics or tracking technologies, as described above, when you visit our website, view our newsletters or other electronic communications, or use our online products and services). Provided you have given us your explicit consent, we may obtain your personal data from third parties for marketing purposes. In such cases, we will inform you in accordance with the relevant legal provisions.

4 With whom do we share your personal data?

To fulfill the purposes described above, it may be necessary in individual cases for us to transfer your personal data in whole or in part to third parties, who assist us in providing our services or processing our business operations within the limits permitted by law. In particular, we share your personal data as follows:

- To affiliated companies within the GEA Group worldwide, to the extent necessary for the permitted purposes and permitted by law. In such cases, these companies will use the personal data for the same purposes and under the same conditions as set forth in this Privacy Notice. A list of companies affiliated with GEA Group Aktiengesellschaft and their contact information is available here. The legal basis for the processing of your personal data is Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring efficient internal business processes and, for this purpose, in sharing business processes within the GEA Group.

- We may also engage service providers (so-called data processors), Art. 4(8), 28 GDPR. These data processors process personal data on our behalf and in accordance with our instructions. We use the following data processors or categories of data processors: 
- Platform/hosting service providers, including Microsoft Deutschland GmbH, TwentyThree ApS, Bright Interactive Ltd., Combell bv,
- Analytics service providers; for more information, see section 2.3,
- IT support service providers, including ACTUM Digital GmbH.

-  In addition, we also disclose the data to other third parties to the extent necessary to establish, exercise, or defend legal claims. The legal basis for the processing of your personal data is Ar-ticle 6(1)(f) of the GDPR. We have a legitimate interest in protecting our rights. 

- To courts, law enforcement agencies, regulatory authorities, or other government organizations, or to attorneys or other private parties, to the extent necessary to comply with a legal obligation. The legal basis for the processing is Article 6(1)(c) of the GDPR.

- To potential sellers or buyers and their professional advisors in connection with the sale or acquisition of companies or assets. The legal basis for the processing of personal data is Article 6(1)(f) of the GDPR. We have a legitimate interest in adapting our internal corporate structures.

Should your personal data be disclosed to other third parties not listed here in individual cases, we will inform you of this separately.

5 Where is your personal data processed?

6.6 Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(f) of the GDPR, in accordance with Article 21 of the GDPR. We will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
To the extent that we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for these purposes, including profiling. Upon your objection, we will cease processing.

6.7 Right to Withdraw Consent

Pursuant to Article 7(3), first sentence, of the GDPR, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on your consent prior to withdrawal.

6.8 Right to File a Complaint

You have the right to contact a supervisory authority of your choice if you believe that the processing of your personal data violates applicable data protection law.

6.9 Data Processing When Exercising Your Rights

Finally, we would like to point out that we process the personal data you provide when exercising your rights pursuant to Article 7(3), first sentence, of the GDPR and Articles 15 through 22 of the GDPR for the purpose of implementing these rights, to be able to provide evidence thereof, and, if necessary, to defend our legal positions.
In this context, we store your data for three years from the date your data subject rights have been fully processed. Data will only be stored for a longer period if we continue to need it for the defense of legal claims. In this case, the data will be deleted upon conclusion of the proceedings, plus the statutory limitation periods.
This processing for the purpose of implementing these rights and providing evidence of their lawful im-plementation is based on the legal basis of Article 6(1)(c) of the GDPR in conjunction with Article 7(3), first sentence of the GDPR and Articles 15 through 22 of the GDPR, as well as Section 34(2) of the BDSG. To the extent that we process personal data for the purpose of legal defense, this also consti-tutes our legitimate interest under Article 6(1)(f) of the GDPR.

7 Are you required to provide personal data?

8 Automated Decision-Making, Including Profiling

We do not carry out automated decision-making, including profiling. 

9 Retention of your Personal Data

Unless otherwise specified in this Privacy Notice, we will delete your personal data immediately once it is no longer necessary for the purposes mentioned above or if you have withdrawn your consent. 

Storage beyond this period occurs only in the following cases:

- If we are legally or otherwise obligated or authorized to continue storing the data, pursuant to Article 6(1)(c) of the GDPR. To the extent that we are legally required to retain data, we will store your data for the period prescribed by law. Legal requirements for storage may arise, in particular, from the retention periods set forth in the German Commercial Code or the German Fiscal Code. The retention period under these regulations is generally between 6 and 10 years from the end of the year in which the relevant transaction was completed. The data stored consists of information subject to retention requirements such as records within the meaning of Section 146 of the German Fiscal Code (AO) and documents within the meaning of Section 257 of the German Commercial Code (HGB). These typically include documents and communications necessary for understanding the agreement and the exchange of commercial services. In addition to the data mentioned above, we then store information, for example, regarding orders, payments, and other aspects of the exchange of services between us and you or the company for which you work.

- If we need your personal data to assert or defend legal claims. This also constitutes our legitimate interest under Article 6(1)(f) of the GDPR. In this case, the data will be retained until the end of the relevant proceedings, plus the statutory statute of limitations period. 

10 Updates to this Privacy Notice