Data Protection

Thank you for visiting our website and for taking an interest in our company. Data protection is an important topic to DMG Chemisch-Pharmazeutische Fabrik GmbH (hereinafter referred to as ‘DMG’) as the controller pursuant to Art. 4 (7) GDPR and the operator of the website www.dmg-dental.com. Protecting your privacy rights is very important to us. This is why we have designed our website in line with the principle of data minimisation.

1. Collection of personal data when visiting our website

If you wish to visit our website, we will only collect the following technically necessary data to display our website and ensure its stability and security. The legal basis for the above is our legitimate interests in accordance with Sentence 1 of Art. 6 (1) (f) GDPR.

The following data is collected:

• IP address,
• date and time of the request,
• the time zone difference from Greenwich Mean Time (GMT),
• the content of the request (specific page),
• the access status / HTTP status code,
• the data volume transferred in each case,
• the website that the request originated from,
• the browser,
• operating system and its interface as well as
• the browser software language and version.

The personal data that we receive when you use our online services is collected and used strictly within the legally permitted framework and solely for the purpose for which you have supplied the data (e.g. requesting information materials, posting comments, subscribing to newsletters). The collected data is subject to extensive security measures that prevent unauthorised access and misuse and protect against the destruction or loss of data. Data is transmitted over the internet using SSL encryption.

When you contact us by email or via a contact form on this website, we will store the data you provide (your email address, your name and telephone number, if applicable, and the content of your message) to reply to your questions. Your data shall be processed in the context of pre-contractual measures or based on your express consent under the first sentence of Article 6 (1) (a) and (b) of the GDPR. We erase the data collected in this context once storage is no longer necessary or restrict processing if legal retention periods exist. We collect the following data when you contact us via our website:

• The IP address of the target email server
• Date and time of the request
• The email address of the sender
• Content of the message

If the content of your email is confidential, we strongly urge you to encrypt it to protect it from unauthorised access or falsification during transfer.

2. Rights of data subjects

You, as a data subject, are entitled to assert the following rights with regard to your personal data at any time and free of charge:

• Right of access
• Right to rectification or erasure
• Right to restriction of processing
• Right to object to processing
• Right to data portability

You also have the right to lodge a complaint with a data protection supervisory authority regarding our handling of your personal data.

3. Revocation of consent and objection to the processing of your data

If you have given consent to the processing of your data, you can withdraw this consent at any time. Such a withdrawal influences whether processing of your personal data is permissible after you have notified us of the revocation.

If processing of your personal data is based on a consideration of interests, you can object to the processing. This is especially the case if the processing is not required for the fulfilment of a contract with you, which we will outline in the following description of functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. If your objection is justified, we shall review the situation and either discontinue or adjust our data processing activities or provide you with our compelling legitimate reasons for continuing the processing.

4. Erasure of personal data

The data we process is erased in accordance with legal requirements if the purpose for processing your data no longer applies or if it is no longer required for the purpose. We will also erase your data if the processing was based on your consent and you have withdrawn it.

It may be that the storage of your data is required for other legally permissible purposes, such as to fulfil a legal obligation, to exercise legal claims or for tax law reasons. In such cases, your personal data will only be processed for these specific purposes.

5. Recipients of personal data

We rely on national and international external service providers to process our business transactions (e.g. for IT, logistics, telecommunications, sales and marketing), who may also have access to your personal data. We have concluded order processing contracts with these providers in accordance with Art. 28 GDPR, which ensure that data processing is carried out in a lawful manner.

If we pass on your personal data to our subsidiaries or if our subsidiaries pass it on to us (e.g. for advertising purposes), this is also done in accordance with existing data processing agreements.

6. Requirements for the transfer of personal data to third countries

For the exceptional cases in which personal data is transferred to countries outside the European Economic Area (EEA), i.e. to third countries, this takes place under the conditions named in Art. 44 GDPR onwards. We will provide you with information on the respective details of transfer at the relevant points below.

The European Commission recognises some third countries as having an equivalent level of data protection to the EEA through what are known as adequacy decisions. However, there are other third countries to which personal data may be transferred that may not have a consistently high level of data protection due to a lack of legal provisions. In such cases, we ensure that data protection is sufficiently guaranteed. This is achieved through binding company rules, standard contractual clauses of the European Commission for the protection of personal data according to Art. 46 (1) (2) (c) GDPR, certifications and recognised codes of conduct.

7. Additional functions and services on our website

In addition to the purely informational use of our website, we offer various services that you can access if they are of interest. To this end, you typically need to provide further personal data, which we use to provide the service in question and to which the aforementioned data processing principles apply.

In some cases, we use external service providers to process your data. We have carefully chosen and engaged these service providers, who are bound by our instructions and undergo regular monitoring.

Where our service providers or partners are based in a country outside the European Union (EU) or the European Economic Area (EEA), we will advise you of the consequences thereof at the appropriate point in this privacy policy.

8. Cookies

Cookies are small text files transmitted to your computer together with the online data actually requested. This data is saved on your computer in readiness for subsequent visits.

We use the consent management platform (CMP) of Cookiebot, a service provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany. The tool allows you to conveniently manage your consent to the setting of technically non-essential cookies and to make changes in this respect using the tool (e.g. revoking granted consent or making objections).

The information required under Art. 13 GDPR on the processing of your personal data by the Cookiebot CMP and by technically non-essential cookies can also be found in the tool.

How to disable or enable cookies: Click on the blue-and-white cookie icon on the right edge of the page. A pop-up window will appear, showing the cookies used by the website, which are divided into the following categories: ‘Necessary’, ‘Preferences’, ‘Statistics’ and ‘Marketing’. Clicking on the ‘Show Details’ tab will expand the window to show more information about the cookies, such as the name, provider, purpose, expiry and type. You can disable or enable the cookies by clearing / selecting the check boxes next to the categories.

9. Newsletter

If you wish to receive the newsletter offered on our website, please be advised that any data entered into the newsletter registration screen will be used exclusively for the purpose of delivering our newsletter, which contains information on all of our services.

We use your personal data such as your name, postal address, phone number, email address or signature (collected using the likes of forms on this website, or your digital signature when you receive a visit from our external sales team) solely for the intended purpose (e.g. to process your request).

We need your explicit consent pursuant to the Sentence 1 of Art. 6 (1) (a) GDPR to send you our newsletter. You can revoke the consent you have given at any time. Once your registration is complete, we will send you a confirmation email containing a link you must click on to finalise the order (‘double opt-in’). The registration may be undone at any time by clicking on the ‘Unsubscribe’ link. If, for example, you have asked us for information on products or services, we will use your data to provide you with the relevant information. To this end it may be necessary for DMG to forward your data to affiliated companies as well as partner companies for the fulfilment of contracts. You may also revoke this consent at any time with effect for the future.

You can send your revocation of consent in text form to privacy(at)dmg-dental.com or by post to DMG Chemisch-Pharmazeutische Fabrik GmbH, FAO Data Protection Officer, Elbgaustr. 248, 22547 Hamburg, Germany.

10. Processing of personal data for marketing purposes

We use the external marketing automation tool Evalanche, which is operated by SC-Networks GmbH (Würmstr. 4, 82319 Starnberg, Germany), for marketing purposes. Amongst other things, we also use Evalanche for creating and tracking marketing campaigns. The legal basis for processing the data associated with these is your consent in accordance with Art. 6 (1) (a) GDPR, which you can withdraw at any time, with future effect. We have entered into an order processing contract with Evalanche in accordance with Art. 28 GDPR with the aim of ensuring that Evalanche processes all data in a lawful manner.

11. Processing of job applicant data

Data required for establishing contact and for the purposes of the application process will be collected and stored in compliance with the data protection regulations. Its legal basis is our pre-contractual relationship in accordance with Sentence 1 of Art. 6 (1) (b) GDPR and Section 26 (1) in conjunction with para. 8 (2) BDSG (German Federal Data Protection Act). 

If their application is rejected, applicants’ data will in any case be stored for evidence purposes for up to six months after the end of the application process for the purpose of asserting, exercising or defending legal claims. The legal basis for this is Sentence 1 of Art. 6 (1) (f) GDPR. If you have consented to further storage of your personal data pursuant to Sentence 1 of Art. 6 (1) (a) GDPR, we will transfer your data to our applicant pool until you revoke this consent. In any case, the data will be erased after one year unless you revoke your consent beforehand. If you have been offered a position during the application process, the data from the applicant data system will be transferred to our HR management system. Information on the storage period can be found in the data protection information for our employees.

The provision of the data is not required by law or contractually prescribed. You are not obligated to provide the data. However, if the data is not provided, it will be impossible to process the application and, if applicable, to recruit the applicant.

If you became aware of DMG through an employee recommendation, we will process the employee’s first name and surname, the date they joined the company and their employment status. A bonus for the DMG employee recommending you is tied to your commencement of employment and length of service beyond 6 months. The respective employee who has recommended you via a personal link will therefore be informed as to whether the bonus conditions have been met. Details about the exact start or the duration of the employment relationship will not be shared with the employee recommending you. The legitimate interest according to Sentence 1 of Art. 6 (1) (f) GDPR for this processing is the fulfilment of the contract with the recommending employee, the carrying out of the “Employees recruit employees” program - DMG Connect, expanding the potential group of candidates and increasing DMG’s recognition as an employer for a number of job opportunities. Participation in the programme is voluntary. If you do not wish to participate, you can also apply for open positions in the normal way.

12. Processing of customer data

In the context of processing customer data, we collect and store data to the extent necessary for the intended purpose (e.g. first and last name, postal address, email address, telephone number/fax number, goods ordered/service provided, customer enquiry information and date of enquiry).
 
We process this data (with the exception of your IP address) for the purpose of performing and processing contracts with you (including payment processing), for customer requests, and for our own advertising purposes in accordance with the applicable regulations under data protection law.
 
The legal basis for the processing of customer data is Art. 6 (1) (b), (c) and (f) GDPR. Your data is deleted once it is no longer required for its intended purpose as far as this does not conflict with statutory retention requirements (esp. HGB/German Commercial Code and AO/German Tax Code requirements).

Photography and filming events

We would like to inform you that we take photos and film recordings involving identifiable people as part of events. The purposes of data processing will be specified clearly for each event and always relate to corporate communication and documentation. These corporate purposes are pursued, for example, in the form of social media posts, by posting photos and videos online on the company’s website, and by archiving recordings internally. In this respect, the legal basis of consent according to Art. 6 (1) (a) GDPR and, in the case of overriding business interests, legitimate interest according to Art. 6 (1) (f) GDPR apply. The photographs and video recordings shall be erased once the purpose no longer applies, if previously granted consent is withdrawn, or if an objection is submitted.

14. Use of social media plugins

This website makes use of ‘social plugins’ of the social networks Facebook, Instagram, YouTube, X and Xing, which are operated by

• Meta Platforms, Inc. 1601 Willow Road, Menlo Park, CA 94025, USA (Facebook & Instagram),
• LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085, USA (LinkedIn),
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (YouTube),
• Twitter International Unlimited Company, 1355 Market Street, Suite 900, San Francisco, CA 94103 USA (X),
• New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany (Xing)

The Website uses what is known as the ‘two-click solution’. This means that, when you visit our site, generally speaking, no personal data are initially passed on to the providers of the plugins. You can recognise the provider of the plugin by means of the logo. We offer you the opportunity to communicate directly with the provider of the plugin using the button. Only if you click on and thereby activate the marked field will the plugin provider receive the notification that you have accessed the corresponding website on which we have an online presence. The data mentioned under Section 4.1 of this policy will be transferred too. In the case of Facebook, the IP address is anonymised immediately after collection, as declared by the respective provider in Germany. Activating the plugin transfers your personal data to the plugin provider in question and stores it on their servers (in the case of US providers, in the USA).

The European Commission issued its adequacy decision for the USA on 10 July 2023. It states that the USA guarantees an appropriate level of data protection for transfers within this context. Google LLC, LinkedIn and Meta are certified under the EU-US Data Privacy Framework, which means that associated data transfers will be adequately protected.

To the best of our knowledge, the plugin provider stores the data collected about you as user profiles and uses this data for the purposes of advertising, market research and/or needs-based website design. In particular, such an evaluation is carried out for the display of needs-based advertising and to inform other users of the social network of your activities on our website (even in the case of users who are not logged in). You have the right to object to the creation of these user profiles, whereby you must contact the plugin provider in question to exercise this right. By means of the plugins, we offer you the opportunity to interact with social networks and other users so that we can improve our online presence and make it more interesting for you as a user. The legal basis for use of the plugins is Art. 6 (1) (a) GDPR.

The data transfer takes place regardless of whether you have an account with the plugin provider and are logged in it. If you are logged into the plugin provider’s website, the data we collect is directly assigned to your account with the plugin provider. If you click the activated button and link to the page, for example, the plugin provider also saves this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, since this will help you to avoid assignment to your profile with the plugin provider.

For further information on the purpose and scope of data collection and data processing by the plugin provider, please refer to the privacy policies of these providers. You will also find further information there about your rights in this regard and potential settings you can make to protect your privacy.

Addresses of the plugin providers in question and URLs with their privacy policies:

• http://www.facebook.com/policy.php
• https://de.linkedin.com/legal/privacy-policy
• https://policies.google.com/privacy?hl=de
• https://privacy.xing.com/en/privacy-policy
• https://help.instagram.com/155833707900388

15. Using Google services

Our website makes use of various services provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Personal data about you may be processed in this context. To ensure that our use of your data is lawful, we obtain your consent to this effect by means of our cookie banner.
 
The legal basis for such processing is therefore Article 6 (1) (a) GDPR. Google is a US company, so it is very likely that data shall also be processed in the USA. As Google is certified under the EU-US Data Privacy Framework, any associated data transfers will be adequately protected. We have provided information below about the Google services we use:

Google Tag Manager

The activation of Google Analytics as well as other marketing tags is systematically controlled via Google Tag Manager to ensure that the website does not slow down when using various tags (code units, tracking tools, etc.). The Tag Manager triggers events related to marketing analysis or optimises them without using cookies itself or processing personal data. For more detailed information about Google Tag Manager, please visit support.google.com/tagmanager/answer/9323295. The legal basis is Article 6 (1) (f) of the GDPR and our legitimate interest in a quick and uncomplicated management of various tools on our website. If you have given your consent, the legal basis is Art. 6 (1) (a) GDPR. This consent can be withdrawn at any time.

16. Competition Participation Terms and Conditions

Our Competition Participation Terms and Conditions can be viewed here.

When you take part in a competition or promotion, we process your personal data in accordance with the statutory provisions and only for the purposes of implementing and running the competition. This usually consists of an individual competition entry, as well as your name and contact details. Your personal data will be processed for the purpose of administering the competition or promotion, and in particular for the selection and notification of winners. We may subsequently collect and process additional data, e.g. your postal address, for the purpose of sending and delivering prizes. The legal basis for this is Art. 6 (1) (b) GDPR.

Questions relating to data protection

The ongoing evolution of the internet has an impact on DMG’s data protection strategy. Hence, if you have any questions, suggestions or feedback regarding DMG’s data protection, you can forward them to us at any time at the following email address: privacy(at)dmg-dental.com. This privacy policy will be adapted and further developed in line with data protection and security technology developments. We therefore reserve the right to modify and amend this policy as appropriate.

Postal address:

DMG Chemisch-Pharmazeutische Fabrik GmbH
Data Protection Officer
Elbgaustr. 248
22547 Hamburg