Hotline +49 (0) 22 04 / 9 25 21 - 0

Privacy Policy

Privacy Policy in accordance with the General Data Protection Regulation (GDPR)

1. Name and address of the controller

The controller in the sense of the GDPR and other national data protection laws by member nations as well as other data protection regulations is:

E. Prang & Co. Apparatebau GmbH & Co. KG
Am Böttcherberg 20-28
51427 Bergisch Gladbach

Phone no: +49 (0) 2204 / 9 25 21 - 0
Fax: +49 (0) 2204 / 2 20 32

E-mail: info@e-prang.de

General partner: Thomas Schölgen GmbH
Managing Director: Thomas Schölgen

2. Name and address of the data protection officer

Heiko Deitz

PersCert External data protection officer (TÜV)
Officer in ISMS according to ISO/IEC 27000 series

Steinenkamp 20
51469 Bergisch Gladbach

Tel. no.: 02202 9275880 
E-mail: info@dedaco.de
Internet: www.dedaco.de

3. General Information about data processing

Scope of the processing of personal data

We essentially collect and use personal data of our users only insofar as it is necessary for the provision of an operational website as well as for our content and services. The collection and use of personal data of our users takes place on a regular basis only with the consent of the user.An exception can be made in cases where it is not possible to obtain prior consent for factual reasons and the processing of data is allowed by statutory regulations.

Legal framework for the processing of personal data


Insofar as we obtain an approval of the concerned person for the processing operations, Art. 6 Para. 1 lit. a EU GDPR serves as the legal framework for the processing of personal data.

Art. 6 Para. 1 lit. b GDPR serves as the legal framework for the processing of personal data that is required for the performance of a contract whose contractual party is the concerned person. This also applies for processing operations that are required for the execution of pre-contractual measures.

If processing of personal data is required for the compliance of a legal obligation that our company is subject to, Art. 6 Para. 1 lit. c GDPR serves as the legal framework.

In the event that the vital interests of the concerned person or another natural person necessitate a processing of personal data, Art. 6 Para. 1 lit. d GDPR serves as the legal framework.

If the processing is required for the safeguarding a legitimate interest of our company or of a third party and if the interests, fundamental rights and fundamental freedoms of the concerned person do not outweigh the above-mentioned interest, Art. 6 Para. 1 lit. f GDPR serves as the legal framework for the processing.

Data erasure and storage period


The personal data of the concerned person is erased or locked as soon as the purpose of the storage ceases to exist. A storage can also be carried out if this has been intended by European or national lawmakers in the provisions, laws or other regulations of the European Union, which the controller is subject to. A blocking or erasure of data also takes place when a period of retention stipulated by the designated standards expires, unless a necessity for further storage of the data for a conclusion of contract or a performance of a contract exists.

4. Provision of the website and creation of log files

Description and scope of data processing

During each access to our Internet site, our system automatically records data and information from the computer system of the computer accessing our website.
The following data is collected here:
(1) Information about the browser type and the version used
(2) The operating system of the user
(3) The Internet service provider of the user
(4) The IP address of the user
(5) Date and time of access
(6) Websites from where the system of the user accessed our Internet site
(7) Websites that were accessed by the system of the user via our website
The data is stored in the log files of our system as well. The IP addresses of the user or other data that enables the assignment of data to a user remain unaffected by this. A storage of this data together with other personal data of the user does not take place.

Legal framework for data processing

Legal framework for the temporary storage of the data is Art. 6 Para.1 lit. f GDPR.

The purpose of data processing

The temporary storage of the IP address by the system is necessary in order to enable the access of the website to the computer of the user. For this purpose, the IP address of the user must be stored for the duration of the session.
In these purposes also lies our legitimate interest in data processing as per Art. 6 Para.1 lit. f GDPR.

Duration of the storage

The data is erased as soon as it ceases to be necessary for the fulfilment of the purpose of its collection. In the event of the collection of data for the provision of the website, this is carried out when the respective session has ended.

Possibility to object and possibility of elimination

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the Internet site. Consequently, a possibility to object does not exist on the part of the user.

5. Use of cookies

Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or from the Internet browser on the computer system of the user. If a user accesses a website, a cookie can be stored on the operating system of the user. 

This cookie contains a characteristic string that enabled a clear identification of the browser when the website is accessed again.

Legal framework for data processing

The legal framework for the processing of personal data with the use of cookies is Art. 6 Para. 1 lit. f GDPR.

Purpose of data processing

The purpose of the use of technically necessary cookies is to simplify the use of websites for the user. Some functions of our Internet site cannot be offered without the use of cookies. For this purpose, it is necessary that the browser is recognised even after sites a switched.
The user data collected by technically necessary cookies is not used for the creation of user profiles.
In these purposes also lies our legitimate interest in the processing of personal data as per Art. 6 Para. 1 lit. f GDPR. 

The duration of the storage, possibility to object and possibility of elimination

Cookies are stored on the computer of the user and transmitted from there to our site. As a user, you therefore also have complete control over the use of cookies. You can deactivate or limit the transmission of cookies by modifying the settings in your Internet browser. Already stored cookies can be erased at any time. This can also take place automatically. If cookies for our website are deactivated, the user might perhaps no longer be able to use all the functions of the website completely.

6. E-mail contact


Description and scope of data processing

The user can contact us via the e-mail address provided on our Internet site. In that case, the personal data of the user transmitted with the e-mail will be stored. 

In this context, the data is not transmitted to a third party. The data is used exclusively for the processing of the conversation.

Legal framework for data processing

Art. 6 Para. 1 lit. f GDPR forms the legal framework for the processing of data that is transmitted in the course of transmitting an e-mail. If the e-mail contact is aimed at the conclusion of a contract, the Art. 6 Para. 1 lit. b GDPR forms the additional legal framework for the processing.

The purpose of data processing

The processing of personal data during the transmission of an e-mail helps us to process the establishment of contact. During the establishment of contact, the necessary legitimate interest is accounted for by the processing of data.

Duration of the storage

The data is erased as soon as it ceases to be necessary for the fulfilment of the purpose of its collection. For the personal data that is transmitted via e-mail, this is the case when the respective conversation with the user has ended. The conversation ends when the circumstances indicate that the concerned situation has been conclusively clarified.

Possibility to object and possibility of elimination

The user has the possibility to, at any time, withdraw his consent for the processing of personal data. If the user establishes contact with us via e-mail, he can, at any time, object to the storage of his personal data. In such a case, the conversation cannot be continued.

The withdrawal can be submitted by mail or via e-mail.

In such an event, all personal data that has been stored in the course of the communication will be erased.

7. Rights of the concerned person


If your personal data is processed, you are the aggrieved party in the sense of the GDPR and you have the following rights against the controller:

Right to information

You can demand a confirmation from the controller regarding whether personal data that concerns you will be processed by us.
If such a processing is being carried out, you can demand details about the following information:
(1) the purposes for which the personal data is processed;
(2) the categories of personal data that are processed;
(3) the recipients or the categories of recipients towards whom the personal data concerning you has been disclosed or is still being disclosed;
(4) the planned duration of the storage of the personal data concerning you or, in case it is not possible to provide concrete information here, criteria for the determination of the storage duration;
(5) the existence of a right to rectification or erasure of the personal data concerning you, a right to restricting the processing by the controller or a right to object against this processing;
(6) the existence of a right to appeal to a regulatory authority;
(7) all available information about the origin of the data in the event that the personal data was not collected from the concerned person;
(8) the existence of automated decision-making including profiling as per Art. 22. Para. 1 and 4 GDPR and – at least in these cases – significant information about the involved logic as well as the scope and the pursued impact of a processing of this sort for the concerned person.
You have the right to demand information about whether the personal data concerning you is transmitted to a third country or to an international organisation. 

In this context, you can demand to be informed about the appropriate guarantees as per Art. 46 GDPR in the context of the transmission.

Right to rectification

You have a right to rectification and/or completion of data against the controller, if the processed personal data concerning you is incorrect or incomplete. The controller must carry out the rectification without delay.

Right to limitation of processing

Under the following circumstances, you can demand the limitation of the processing of the personal data concerning you:
(1) if you dispute the correctness of the personal data concerning you for a duration that enables the controller to verify the correctness of the personal data;
(2) the processing is unlawful and you refuse the erasure of the personal data and demand the limitation of the use of the personal data instead;
(3) the controller no longer requires the personal data in relation to the purposes of processing, but you still require the data for the establishment, exercising or defence of legal claims, or
(4) if you have appealed against the processing as per Art. 21 Para. 1 GDPR and it is not yet determined whether the legitimate reasons of the controller prevail over your reasons.
If the processing of the personal data concerning you has been limited, this data – apart from its storage – may only be processed with your consent or for the establishment, exercising or defence of legal claims or for the protection of right of a natural or legal person or on grounds of an important public interest or the Union or of a member nation.
If the limitation of the processing has been restricted as per the aforementioned conditions, you will be informed by the controller before the limitation is repealed.

Right to erasure

a) Obligation to erasure
You can demand for the controller to erase your personal data without undue delay, and the controller is obliged to erase this data immediately, provided that one of the following reasons applies.
(1) The personal data concerning you is no longer necessary in relation to the purposes for which they were collected or otherwise processed.

(2) You withdraw your consent on which the processing is based according to Art. 6 Para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR, and there is no other legal ground for the processing.
(3) You object to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21 Para. 2 GDPR.
(4) The personal data concerning you has been unlawfully processed.
(5) The personal data concerning you has to be erased for compliance with a legal obligation in accordance with the European Union law or the law of the member state to which the controller is subject. 

(6) The personal data concerning you has been collected in relation to the offer of information society services referred to in Article 8 Para. 1 GDPR.

b) Information to third parties
If the controller has made the personal data concerning you public and is obliged to its erasure as per Art. 17 Para. 1 GDPR, the controller will, taking into account the available technology and the implementation costs, take the appropriate measures, including those of a technical nature, in order to inform the party responsible for the data processing, which processes personal data, that you, as an affected person, have demanded that it erase all links to this personal data or of copies or replications of this personal data.

c) Exemptions
The right to erasure does not exist insofar as the processing is necessary
(1) for exercising the right to freedom of expression and information;
(2) for the fulfilment of a legal obligation, which for the processing as per the European Union law or the law of the member states that the controller is subject to, or for carrying out a task in the public interest or in the exercise of official authority, which has been transferred to the controller;
(3) on grounds of public interest in the area of public health as per Art. 9 Para. 2 lit. h and i as well as Art. 9 Para. 3 GDPR;
(4) archiving purposes, scientific or historical research purposes or for statistical purposes in the public interest as per Art. 89 Para. 1 GDPR, insofar as the law mentioned under Section a) probably makes the realisation of the objectives of this processing impossible or seriously affects them, or
(5) for the establishment, exercising or defence of legal claims.

Right to information

If you have exercised the right to rectification, erasure or limitation of the processing towards the controller, it is obliged to inform all recipients to whom the personal data concerning you has been disclosed about this rectification or erasure of data or limitation of the processing, unless this proves to be impossible or is associated with a disproportionate effort.
You have the right to be informed by the controller about these recipients.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, common and machine-readable format. In addition, you have the right to transfer this data to another controller without hindrance by the controller for providing the personal data, if:
(1) the processing is based on consent in accordance with Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract according to Art. 6 Para. 1 lit. b GDPR and
(2) the processing is carried out using automated procedures.
While exercising this right, you further have the right to demand that the personal data concerning you be directly transferred by an controller to on of the other controllers, insofar as this is technically feasible. Freedoms and rights of other persons may not be affected by this.
The right to data portability does not apply to a processing of personal data that is required for carrying out a task, which is in the public interest or in the exercise of official authority vested in the controller.

.Right to object

You have the right to object, on grounds relating to your particular situation, at any time against the processing of personal data concerning you, which is based on Art. 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on those provisions. 

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
If personal data is processed for direct marketing purposes, you shall have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the chance to exercise your to object by automated means using technical specifications.

Right to withdrawal of declaration of consent as regards data protection law

You have the right to, at any time, withdraw your declaration of consent regarding the data protection law. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar manner. This does not apply if the decision
(1) is necessary for entering into, or performance of, a contract between you and the controller;
(2) is authorised by the regulations of the European Union or member states to which the controller is subject, and which also lays down suitable measures to safeguard the your rights and freedoms and legitimate interests; or
(3) is based on your explicit consent.
However, these decisions shall not be based on special categories of personal data referred to in Article 9 Para. 1 GDPR, unless Art. 9 Para. 2 lit. a or g applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
With regard to the cases referred to in points (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, which at least includes the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement if you are of the view that the processing of personal data relating to you infringes the GDPR. 

The supervisory authority with which the complaint has been lodged shall inform the complainant on the status and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

The contact details of the responsible supervisory authority are:

Postal address:
State Representative for the Protection of Data and Freedom of Information
North Rhine Westphalia
PO box 20 04 44
40102 Düsseldorf
Tel. no: 0211/38424-0
Fax: 0211/38424-10
E-mail: poststelle@ldi.nrw.de

8. Update of this data privacy statement

We reserve the right to adopt the data privacy statement according to the modifications in legislation or jurisdictions. This includes changing security and privacy measures where necessary due to technical development. In these cases, we will also adopt our privacy policy accordingly. Hence, please observe the latest version of our privacy policy. 

Effective: May 2018

© E. Prang & Co. Apparatebau GmbH & Co. KG | updated 2024-02-05