Privacy Policy

Thank you for visiting our website. In accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), we explain below which personal data we process when you visit our website, for what purposes, and on what legal basis.

1. Controller and Data Protection Officer

The controller responsible for data processing on this website is:

Heimerle + Meule GmbH
represented by its Managing Directors Georg Steiner and Kevin Butsch
Dennigstrasse 16
75179 Pforzheim
Germany

Phone: +49 7231 9400
E-mail: info@heimerle-meule.com

You can reach our Data Protection Officer at:

Heimerle + Meule GmbH, Data Protection Officer
Dennigstrasse 16, 75179 Pforzheim, Germany
E-mail: datenschutz@heimerle-meule.com

2. General Information on Data Processing

Legal bases. We process personal data only when one of the following legal bases applies:

• Art. 6(1)(a) GDPR: You have given your consent.

• Art. 6(1)(b) GDPR: Processing is necessary to perform a contract or to take steps prior to entering into a contract.

• Art. 6(1)(c) GDPR: We are legally required to process the data.

• Art. 6(1)(f) GDPR: Processing serves our legitimate interests, and your interests do not override them.

Storing information on your device or accessing information stored there (for example, cookies) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We state the applicable legal basis for each processing activity below.

Retention. We delete your data as soon as the purpose for storing it no longer applies. We retain data longer only where statutory retention obligations apply, for example under German commercial or tax law (6 or 10 years). In that case, we restrict access to the data until the retention period expires.

Obligation to provide data. You are under no legal or contractual obligation to provide us with personal data. Without certain information, however, we cannot, for example, respond to your inquiry or send you our newsletter.

Automated decision-making. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

3. Hosting, Content Management, and Server Log Files

Hosting. Our website runs on the Microsoft Azure cloud platform. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes, on our behalf, the data that is technically generated when you access the website. This is governed by Microsoft’s Data Protection Addendum, a data processing agreement under Art. 28 GDPR. The website runs in data centers in Germany (Azure region Germany West Central, Frankfurt am Main). Access by Microsoft Corporation in the United States cannot be completely ruled out (see Section 11).

Content management with Storyblok. We manage the content of our website using the Storyblok content management system provided by Storyblok GmbH, Peter-Behrens-Platz 2, 4020 Linz, Austria. Storyblok acts as our processor. Our server retrieves texts and images from Storyblok and delivers them to your browser itself. Your browser does not connect directly to Storyblok, and your IP address is not transmitted to Storyblok.

Server log files. Each time you access our website, our server automatically records the following data:

• IP address of the requesting device

• Date and time of access

• Page or file accessed and amount of data transferred

• Referrer URL (the previously visited page)

• Browser and operating system used

We need this data to deliver the website, ensure its stability and security, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days unless they are needed longer to investigate a security incident. We do not combine this data with other data sources, and we do not create user profiles.

4. Cookies and Consent Management

Cookies are small text files stored on your device. We use technically necessary cookies on the basis of Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR. They are required for the website to function, for example to store your consent choices.

We use all other cookies and similar technologies, in particular those of embedded third-party services such as YouTube, Google Maps, or the analytics service PostHog, only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). YouTube and Google Maps are not loaded without your consent.

We obtain your consent through our own consent banner integrated into our website. Your choice is stored on your device in a cookie named “cookie_preferences” so that we do not have to ask you again on every visit. No data is transmitted to third parties in this process. Your choice is deleted after six months at the latest, after which we will ask you again.

You can withdraw or change your consent at any time with effect for the future using the “Cookie Preferences” link in the footer of every page. You can also delete or block cookies in your browser settings.

5. Contact Forms

On our website, we offer forms you can use to contact us, for example for general inquiries, product inquiries, or callback requests. We process the information you provide there in order to handle your request. Required fields are marked in each form. Without this information, we cannot process your inquiry; all other information is voluntary.

The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract or to entering into a contract. In all other cases, the legal basis is our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR).

Spam protection with hCaptcha. To protect our forms from abuse by automated programs (spam bots), we use the hCaptcha service provided by Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA, on pages that contain forms. hCaptcha uses characteristics such as your IP address, browser information, and mouse movements to check whether an entry was made by a human, and stores information on your device for this purpose. The legal basis is our legitimate interest in protecting our website from abuse and spam (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG). Intuition Machines, Inc. is certified under the EU-U.S. Data Privacy Framework (see Section 11). For more information, please see the hCaptcha Privacy Policy.

Form data is transmitted in encrypted form (TLS) and forwarded to us. We delete your data once your inquiry has been fully processed and no statutory retention obligations apply. We retain business correspondence for six years in accordance with Section 257 of the German Commercial Code (HGB).

6. Newsletter

Our newsletter keeps you informed about new products, precious metal topics, events, and general company news. To subscribe, we need your email address. You may optionally provide your form of address (e.g., Mr. or Ms.), first name, and last name. We use this information only to address you personally in the newsletter.

Double opt-in. After subscribing, you will receive an email with a confirmation link. Your subscription becomes active only after you click this link. We store the time and IP address of your subscription and confirmation so that we can demonstrate your consent.

Legal basis. The legal basis is your consent (Art. 6(1)(a) GDPR). Storing your subscription data as proof of consent is based on Art. 6(1)(c) and (f) GDPR.

Email service provider. Our newsletter is sent via Mailjet, a service of Mailjet SAS, 13-13 bis rue de l’Aubrac, 75012 Paris, France. Mailjet acts as our processor; we have entered into a data processing agreement with Mailjet under Art. 28 GDPR. According to Mailjet, data is stored exclusively in the EU, on Google Cloud servers in Frankfurt am Main (Germany) and Saint-Ghislain (Belgium). Where Mailjet uses subprocessors outside the EU in individual cases, it does so on the basis of the European Commission’s Standard Contractual Clauses. Our newsletters contain an invisible tracking pixel and links routed through Mailjet. This tells us whether and when a newsletter was opened and which links were clicked. We associate this analysis with your email address in order to better tailor our newsletters to our readers’ interests. It is part of the consent you give when subscribing. If you do not want this analysis, you can unsubscribe from the newsletter at any time.

Unsubscribing. You can unsubscribe at any time using the link at the end of each issue or by emailing info@heimerle-meule.com. After you unsubscribe, we remove your email address from our mailing list. We may keep it on a suppression list to ensure that you do not receive any further newsletters (Art. 6(1)(f) GDPR).

7. Web Analytics with PostHog

With your consent, we use the analytics service PostHog to understand how our website is used and to improve it. The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog Cloud EU; the data is stored on servers in Frankfurt am Main, Germany.

PostHog records, among other things, pages viewed, clicks and other interactions, technical errors, page load times, device type, browser, referrer URL, and approximate location (country). PostHog does not store your IP address. To recognize you on subsequent visits, PostHog sets a cookie named “ph_analytics” containing a randomly generated identifier. This cookie is deleted after 12 months.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time using the “Cookie Preferences” link in the footer of every page.

PostHog acts as our processor. PostHog, Inc. is certified under the EU-U.S. Data Privacy Framework. Because it is a U.S. company, access from the United States cannot be completely ruled out (see Section 11).

8. YouTube Videos

We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Videos are loaded only after you have consented via our consent banner or actively clicked on the respective video. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com). As soon as a video loads, your browser connects to YouTube’s servers. This transmits, among other things, your IP address and the page you are visiting. If you are signed in to your Google account, YouTube can associate your visit with your account.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time. Data may be transferred to Google LLC in the United States (see Section 11). For more information, please see Google’s Privacy Policy.

9. Google Maps

To show you our location and directions, we embed maps from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is loaded only after you have consented via our consent banner. Until then, you will see only a placeholder. When the map loads, your IP address and the page you are visiting, among other things, are transmitted to Google, and cookies may be set.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time. Data may be transferred to Google LLC in the United States (see Section 11). For more information, please see Google’s Privacy Policy.

10. Social Media

On our website, we link to our profiles on Facebook, Instagram, LinkedIn, YouTube, and Xing. These are simple links, not plug-ins. Visiting our website therefore does not transmit any data to these networks. Only when you click a link are you taken to the respective provider’s page, where that provider’s privacy policy applies.

11. Recipients and Transfers to Third Countries

Recipients. Your data is disclosed only to parties that need it for the purposes described. These are our service providers acting as processors (hosting, content management, newsletter delivery, web analytics, spam protection) and, for embedded services, their providers. Beyond that, we disclose data only if we are legally required to do so or if you have given your consent.

Transfers to the United States. For some services (Microsoft Azure, Google/YouTube, PostHog, hCaptcha), data may be transferred to the United States. On July 10, 2023, the European Commission adopted an adequacy decision for the United States (EU-U.S. Data Privacy Framework, Art. 45 GDPR). It applies to companies certified under this framework. In addition, we have agreed on the European Commission’s Standard Contractual Clauses with these providers (Art. 46(2)(c) GDPR) where offered.

12. Your Rights

You have the following rights with respect to your personal data:

• Right of access (Art. 15 GDPR)

• Right to rectification (Art. 16 GDPR)

• Right to erasure (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply send a message to datenschutz@heimerle-meule.com or write to the address in Section 1.

Right to object under Art. 21 GDPR. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing or the processing serves to establish, exercise, or defend legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstrasse 20, 70173 Stuttgart, Germany.

13. Data Security

Our website uses TLS encryption for security reasons. You can recognize an encrypted connection by “https://” in your browser’s address bar. We implement technical and organizational measures under Art. 32 GDPR to protect your data against loss, manipulation, and unauthorized access. We continuously update these measures to reflect the state of the art.