Data Protection Notice

1. General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is all data with which you can be personally identified.

1.1 Name and contact details of the person responsible

The Controller according to Art. 4 (7) of the EU General Data Protection Regulation (hereinafter "GDPR") is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

You can obtain information about the Controller via the “Imprint” button on the NORMA Group website that you originally visited.

The Controller responsible for the processing on this website is:

NORMA Group SE
Edisonstr. 4
D-63477 Maintal
Phone: +49 (6181) 6102-740

Email: info@normagroup.com

1.2 Contact Details of the Data Protection Officer

The Controller is part of NORMA Group, we have appointed a Data Protection Officer for NORMA Group.

You can reach our Data Protection Officer at:

Address:

NORMA Group SE
For the attention of the Data Protection Office
Edisonstr. 4
63477 Maintal
Germany

Email: dataprotection@normagroup.com

1.3 Processing of Personal Data

Data collection

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form. Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. information on the Internet browser, operating system or time of the page visit). This data is collected automatically as soon as you access our website.

Use of data

Some of the data is collected to ensure that the website is provided without errors. Other data may be used, for example, to communicate with you or to analyze your usage behavior.

Analysis tools

When you visit our website, your usage behavior may be statistically evaluated. This is mainly done using so-called analysis tools. The analysis tools are only used if you consent to their use. You can revoke your consent at any time with effect for the future without incurring any costs other than the transmission costs according to the basic rates. You can find detailed information on this in the following Data Protection Notice. Further information on this topic can be found at Section 3.4 Analysis Tools and Advertising.

Legal basis

The processing of personal data is only lawful if this is permitted by law, i.e. if there is a legal basis, or if the person has consented. The following legal bases may come into consideration:

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6(1) lit. a GDPR serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6(1) lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6(1) lit. c GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1) lit. d GDPR serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6(1) lit. f GDPR serves as the legal basis.

Data processing for Contractual Purposes

Our services are primarily aimed at tradespersons. Therefore, when processing personal data for Contractual Purposes, the legal basis is (unless otherwise specified in individual cases),

1. if you are a registered merchant or freelancer, Art. 6(1) lit. b GDPR, the data processing is for the purpose of performing the contract or pre-contractual measures with the data subject; or

2. if you act as an employee of a company, e.g. as an employee in purchasing, Art. 6(1) lit. f GDPR, the legitimate interest of the controller, which is defined in section 1.1. The legitimate interest of the controller consists in the sale of its own goods and services, which is based in particular on entrepreneurial freedom and freedom to choose an occupation.

Within the scope of this processing purpose, we summarize data that is stored and processed in our central systems due to interactions of customers or interested parties and their employees with us via the various communication channels and also use the data when contacting you via another communication channel (e.g. our sales employees receive access to data about goods you have searched for in the online store).

For the sake of simplicity, the term "data processing for Contractual Purposes" is used below.

Potential recipients of data

The potential recipients of transferred personal data are

public bodies, insofar as a legal obligation exists,
service providers and other business partners, insofar as this is necessary to fulfill the respective purpose and a legal provision permits or requires this or the data subject has consented.

Transfer to third countries or international organizations

If we transfer your data to a third country (countries that are not member states of the European Economic Area (EEA)) or to an international organization, we will provide you with the information required for this case.

Standard retention periods for the deletion of data

The deletion of personal data is carried out in accordance with the applicable statutory or contractual regulations on data deletion, taking into account statutory or contractual retention obligations. Such legal obligations arise from the German Commercial Code (HGB) and the German Fiscal Code (AO), among others. The retention and documentation periods specified there are up to ten years after the end of the business relationship or the pre-contractual legal relationship.

In addition, other statutory provisions may require a longer retention period, such as the preservation of evidence within the scope of statutory limitation periods. The regular limitation period is three years; in certain cases, however, limitation periods of up to 30 years or, in individual cases, even longer may apply. The deletion of personal data that is not subject to a statutory or contractual retention or deletion obligation takes place after the data is no longer required to fulfill the respective purpose.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the controller. You can recognize an encrypted connection by the fact that the address line of the browser changes from "https://" to "https://" and by the lock symbol in your address bar of your browser. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

1.4 Rights of the Data Subjects

As a data subject, you have a variety of rights regarding data protection. These rights are explained below. The abovementioned contact details can be used to exercise these rights.

1.4.1 Right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), restriction of processing (Art. 18 GDPR) and erasure (Art. 17 GDPR)

You have the right to access your personal data at any time within the framework of the applicable legal provisions:

a right to free information about your personal data stored by the controller, its origin and recipients and the purpose of the data processing (this also includes the right to a one-time copy of your personal data stored by us free of charge). We reserve the right to charge a reasonable administrative fee for the creation of subsequent copies),
a right to rectification (this also includes the right to have incomplete personal data completed),
a right to restriction of processing (processing of this data is then only allowed with your consent or for a few legally defined purposes),
a right to erasure. If we have published your data, this also includes our obligation to forward your deletion request to other controllers responsible for processing this published personal data within the framework of the "right to be forgotten" in accordance with Art. 17(2) GDPR, taking into account available technology and implementation costs.

1.4.2 Right to object (Art. 21 GDPR)

You have the right to object to the processing of your data if the data processing is carried out based on Art. 6(1) lit. f GDPR or for direct marketing purposes. In the event of an objection to the processing of your personal data, we will examine your objection on a case-by-case basis. If we are obliged to delete your personal data due to your objection under data protection law, we will delete your data taking into account statutory retention obligations. The objection does not affect the permissibility of the processing carried out prior to the objection.

1.4.3 Right to data portability (Art. 20 GDPR)

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract transferred to yourself or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place if it is technically feasible.

1.4.4 Information on the obligation to disclose data

You have the right to know whether the provision of personal data is required by law or contract or is necessary for the conclusion of a contract and what the possible consequences of not providing the data would be.

1.4.5 Right to lodge a complaint with the competent supervisory authority

You have the right to lodge a complaint with a supervisory authority if you believe that one of your rights has been violated. For this purpose, you can contact the supervisory authority in the respective country or the respective member state of the European Union or (in the case of Germany) the respective federal state in which our company is based. However, you can also contact, for example, the supervisory authority of your usual place of residence, your place of work or the place of the suspected infringement. A list of data protection supervisory authorities and their contact details can be found under the following links:

EU:

German: https://edpb.europa.eu/about-edpb/about-edpb/members_de

English: https: //edpb.europa.eu/about-edpb/about-edpb/members_en

Brazil: https://www.gov.br/anpd/pt-br

Mexico: https://home.inai.org.mx/

Serbia: https://www.poverenik.rs/en/

Turkey: https://www.kvkk.gov.tr/en/

1.4.6 Revocation of your consent to data processing

Some data processing operations are only possible with your consent. You can withdraw your consent at any time. All you need to do is send a message in any written form, e.g. by email, to one of the abovementioned contact details. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

1.4.7 Use of your data for (direct) marketing purposes

Irrespective of your subscription to our newsletter, we may use your data, in particular your email address, for (direct) marketing purposes. We will only use your data for this purpose if you have not objected to this. We would like to point out that you can object to the use of your data for (direct) marketing purposes at any time, without incurring any costs other than the transmission costs at the basic rates.

1.4.8 Automated decision-making including profiling

You have the right to obtain information on the existence of automated decision-making, including profiling, in accordance with Art. 22(1) and (4) GDPR and, if applicable, relevant information on the logic involved and the scope and intended effects of such processing for you.

2. Data Collection on our Website

(1) In the following, we provide information about the collection of personal data when using our website.

(2) When you contact us by email or via a contact form, the data you provide (your email address, (if applicable, your name and telephone number), Microsoft Bookings: email address, first name and surname, (if applicable, your telephone number, your address and your comments)) will be stored by us in order to answer your questions. We delete the data arising in this context after storage is no longer required, or restrict processing if there are statutory retention obligations.

(3) When using the website for informational purposes only, i.e. if you do not register or otherwise provide us any information, we only collect the personal data that your browser transmits to our server. When you visit our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis for this is Art. 6(1) sentence 1 lit. f GDPR and § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)):

IP address
Hostname
Date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Access status/HTTP status code
Amount of data transferred in each case
Website from which the request comes (referrer)
The specific pages you visit on our website
Browser: Type, version and set language
Operating system: type and version
In case JavaScript is activated, also:
Screen resolution
Color depth
Size of the browser window
Installed browser plugins

3. Use of Cookies

(1) Also, in addition to the data processing mentioned above, cookies are stored on your computer when you use our website. Cookies are small pieces of text information that can be used by websites to increase user-friendliness.

(2) The use of cookies is permitted without your consent if they are absolutely necessary for the operation of this website. For all other types, we require your consent in advance.

(3) To fulfill these requirements, we use the "Cookiebot" solution from the provider Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark on our website. This gives you the choice of whether to allow cookies from the categories of preferences, statistics and marketing in addition to the cookies required for the operation of our website. You can obtain a detailed overview of the cookies used and how long they are stored by clicking on the "Details" button in the consent banner. You can access the consent banner in the footer area of our website. You can find more information about Cookiebot at the following website Cookiebot .

(4) a) This website uses the following types of cookies, the scope and function of which are explained below:

Transient cookies (see b))
Persistent cookies (see c))
Flash cookies (see f))

b) Transient cookies are automatically deleted when you close the browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. The session cookies are deleted when you log out or close the browser.

c) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies in your browser settings at any time.

d) You can configure the settings of your browser according to your wishes and, for example, refuse to accept third-party cookies ("third party cookies" are cookies that are set by a third party and therefore not by the actual website you are currently visiting) or all cookies. We would like to point out that you may then not be able to use all the functions of this website.

e) We use cookies to identify you for subsequent visits if you have an account with us. Otherwise you would have to log in again for each visit.

f) The Flash cookies used are not recorded by your browser, but by your Flash plug-in. We also use HTML5 storage objects, which are stored on your end device. These objects store the required data independently of the browser you use and do not have an automatic expiration date. You can configure the setting and deletion of Flash cookies via the Adobe Flash Player settings manager. Alternatively, if you do not want Flash cookies to be processed, you can install a corresponding add-on, e.g. for Mozilla Firefox ( Privacy & Security - Firefox Add-ons ) or the Cookie Killer for Google Chrome. You can prevent the use of HTML5 storage objects by setting your browser to private mode.

4. Other Services on our Website

4.1 General information

(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you must generally provide additional personal data that we use to provide the respective service and to which the aforementioned data processing principles apply. Mandatory information is marked with an asterisk. Information in fields not marked in this way is purely voluntary.

(2) In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us and are bound by our instructions. Further details on the respective processing can be found in the individual sections below.

(3) Furthermore, we may pass on your personal data to third parties if we offer participation in promotions, competitions, contracts or similar services together with partners. You will receive more detailed information on this when you provide your personal data as part of your registration or in the description of the respective offer below.

(4) If our service providers or partners are based in a third country (country outside the European Economic Area (EEA)), we will inform you about the consequences of this circumstance in the description of the respective offer.

4.2 Use of the Blog Functions

(1) We publish various articles on topics relating to our activities in our blog ( https://blog.normagroup.com/ ). You have the opportunity to make public comments on our blog. To do so, you must provide a user name and your email address; all other information is voluntary. Your comment will be published with your specified user name in the post. (We recommend using a pseudonym instead of your real name.) We use the service provider COM.lounge GmbH, Hanbrucher Str. 33, 52064 Aachen (hereinafter "COM.lounge") to provide the blog.

(2) The following categories of personal data are processed when using the comment function on our blog (mandatory fields marked with *):

Username*
Email address*
Content of the commentary*
Your website

(3) The processing of personal data in the context of the use of the comment function of our blog is based on our legitimate interests (Art. 6(1) lit. f GDPR). Our legitimate interest in processing is to enable effective and efficient communication between our employees, applicants, interested parties, customers, suppliers, service providers and other business and communication partners. We also process your email address in order to contact you if a third party objects to your comment as unlawful. These interests are derived from our right to entrepreneurial freedom and freedom to choose an occupation. We reserve the right to delete comments if they are objected to as unlawful by third parties.

(4) The data processed in connection with the use of the comment function on our blog will be stored until you inform us of your objection to the publication of the comment or until we delete the blog article or comment.

4.3 Newsletter / Press mailing list

(1) With your consent, you can subscribe to our newsletter, which we use to inform you about current topics from our company. In our newsletter, we inform you about our products, services, offers and campaigns, which also includes sending you invitations to participate in surveys.

(2) The only mandatory information for sending the newsletter is your email address. The provision of further, separately marked data is voluntary and is used to address you personally. Once you have confirmed your registration, we will store your email address for the purpose of sending you the newsletter. The legal basis is Art. 6(1) sentence 1 lit. a GDPR.

(3) We use the so-called double opt-in procedure for subscriptions to our newsletter. This means that after you have registered, we will send you an email to the specified email address in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to inspect any possible misuse of your personal data.

(4) You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter email, without incurring any costs other than the transmission costs according to the basic rates.

4.4 Analysis Tools and Advertising

4.4.1 Google Analytics

(1) This website uses the analysis tool "Google Analytics", a web analysis service of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google Ireland"). Google Analytics uses so-called "cookies", text information that is stored on your computer and enables us to analyze your use of the website. Furthermore, Google Analytics enables a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your use in your Google customer account in the "My data" menu under "Personal data". The information generated by the use of cookies about your use of this website is usually transferred to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter "Google LLC") in the USA and processed there. This website uses Google Analytics with the extension "anonymizeIp()". This means that IP addresses are further processed in abbreviated form. However, if IP anonymization is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Google Ireland will use this information on our behalf to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage.

(2) The use of Google Analytics for the statistical analysis of the use of our website is based on your consent in accordance with Art. 6(1) lit. a GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act).

(3) The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Google LLC is certified.

(4) Further information on Google Analytics can be found in the data protection notices of Google Ireland and Google LLC at: Google Data Protection Notice .

(5) You can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google Ireland and the processing of this data by Google Ireland by not giving us your consent. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.

You can obtain a detailed overview of the cookies used and how long they are stored by clicking on the "Details" button in the consent banner. You can access the consent banner in the footer area of our website. You can revoke your consent at any time in the Consent Manager. In this case, your decision will be saved in the form of a cookie. If you delete your cookies, this cookie will also be deleted. When you visit our website again, you will be asked again whether cookies may be used for web analysis. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

4.4.2 Inspectlet

(1) This website uses the analysis tool "Inspectlet" from the provider Inspectlet, 7936 Mcclellan Rd Apt 1, 95014 Cupertino, California, USA. Inspectlet uses cookies, text information that is stored on your computer and enables us to analyze your use of the website (e.g. content clicked on the website).

(2) The use of Inspectlet for the statistical evaluation of the use of our website is based on your consent in accordance with Art. 6(1) lit. a GDPR and § 25 (1) TDDDG (German Telecommunications Digital Services Data Protection Act).

(3) Further information about Inspectlet can be found in Inspectlet's data protection notice at Inspectlet Data Protection Notice

(4) You can also prevent the collection, processing and recording of the data generated by Inspectlet by Inspectlet opt-out and clicking on "Opt me out Now".

4.4.3 Pardot Marketing

(1) This website uses the "Pardot Marketing" analysis tool from the provider PARDOT EMEA, Heron Tower, Floor 26, 110 Bishopsgate, London, EC2N 4AY, United Kingdom, Phone: +44 (0) 20 3147 7600 (hereinafter "Pardot"). Pardot is a company of Salesforce.com, Inc, The Landmark at One Market, Suite 300, San Francisco, CA 94105, United States. Pardot uses cookies, text information that is stored on your computer and that enables us to analyze your use of the website (e.g. clicked content on the website).

(2) The use of Partdot Marketing for the statistical evaluation of the use of our website is based on your consent in accordance with Art. 6(1) lit. a GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act).

(3) The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Salesforce.com is certified ( Data Privacy Framework ).

(4) Further information on Pardot Marketing can be found in the Salesforce.com data protection notice under Salesforce Data Protection Notice .

4.4.4 Sistrix

This site uses the "Sistrix" analysis tool from SISTRIX GmbH, Thomas-Mann-Str. 37, 53111 Bonn, Germany. The purpose of its use is to improve the findability of our website in search engines, whereby keyword, domain and search data is collected and stored. Under certain circumstances, Google Analytics data may be included. Further information on use and collection can be found in Sistrix's privacy policy .

4.4.5 Hotjar

This site uses the web analysis service "Hotjar" from the provider Hotjar Ltd.

You can prevent the collection, processing and recording of data by Hotjar by opening the opt-out page and using the options described there to deactivate Hotjar.

4.4.6 Google AdSense

(1) This website uses the online advertising service "Google AdSense" from Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google Ireland"), through which advertising tailored to your interests can be presented to you. We are interested in showing you advertising that may be of interest to you in order to make our website more interesting for you. For this purpose, statistical information about you is collected and processed by our advertising partners. These advertisements can be recognized by the reference "Google ads" in the respective advertisement.

(2) The use of Google AdSense to display advertising is based on your consent in accordance with Art. 6(1) sentence 1 lit. a GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act).

(3) When you visit our website, Google Ireland receives the information that you have accessed our website. For this purpose, Google Ireland uses a web beacon to set a cookie on your computer. The data mentioned at under section 2(3) of this privacy policy will be transmitted. We have no influence on the data collected, nor are we aware of the full extent of the data collection and the storage period. Your data will be transferred to the USA and analyzed there. If you are logged in with your Google account, your data can be directly assigned to it. If you do not wish your data to be associated with your Google profile, you must log out. It is possible that this data may be passed on to Google's contractual partners, third parties and authorities. This website does not place any third-party ads via Google AdSense. The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Google LLC is certified ( Data Privacy Framework ).

(4) You can prevent the installation of Google AdSense cookies in various ways:

a) by setting your browser software accordingly; in particular, the suppression of third-party cookies means that you will not receive any ads from third-party providers,

b) by deactivating interest-based ads on Google via the Settings for advertising link, whereby this setting is deleted when you delete your cookies,

c) by deactivating the interest-based ads of the providers that are part of the "About Ads" self-regulation campaign via the link DAA's WebChoices Tool link, whereby this setting is deleted when you delete your cookies,

d) by permanently deactivating it in your Firefox, Microsoft Edge or Google Chrome browsers by installing browser extensions. We would like to point out that in this case you may not be able to use all the functions of this website to their full extent,

e) by not giving your consent in the consent banner or by revoking any consent you have given. You can obtain a detailed overview of the cookies used and how long they are stored by clicking on the "Details" button in the consent banner. You can access the consent banner in the footer area of our website. You can revoke your consent at any time in the Consent Manager. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

(4) Further information on Google AdSense can be found in the data protection notices of Google Ireland and Google LLC under Google Data Protection Notice and under Information Google Ads .

4.4.7 Google Adwords Conversion / Remarketing

(1) We use the "Google Adwords" service to draw attention to our offers with the help of advertising material (so-called Google Adwords) on external websites. We can determine how successful the individual advertising measures are in relation to the advertising campaign data. In doing so, we pursue the interest of showing you advertising that is of interest to you, increasing the attractiveness of our website for you and achieving a fair calculation of advertising costs. The legal basis for the processing of your data is Art. 6(1) sentence 1 lit. f GDPR.

(2) These advertising materials are delivered by Google via so-called "ad servers". For this purpose, we use ad server cookies, through which certain parameters for measuring success, such as the display of ads or clicks by users, can be measured. If you access our website via a Google ad, Google Adwords will store a cookie on your PC. These cookies generally lose their validity after 30 days and are not intended to identify you personally. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values for this cookie.

(3) These cookies enable Google to recognize your internet browser. If a user visits certain pages of the website of an Adwords customers and the cookie stored on their computer has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to this page. A different cookie is assigned to each Adwords customer. Cookies can therefore not be tracked via the websites of Adwords customers. We ourselves do not collect and process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. Based on these evaluations, we can recognize which of the advertising measures used are particularly effective. We do not receive any further data from the use of advertising material; in particular, we cannot identify users on the basis of this information.

(4) Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our level of knowledge: Through the integration of AdWords Conversion, Google receives the information that you have accessed the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out your IP address and store it.

(5) You can prevent participation in this tracking process in various ways:

a) by setting your browser software accordingly; in particular, the suppression of third-party cookies means that you will not receive any ads from third-party providers,

b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the domain “https://www.google.com/intl/de_de/ads/ ", settings for advertising , whereby this setting will be deleted if you delete your cookies,

d) by permanently deactivating it in your Firefox, Internet Explorer or Google Chrome browsers by installing browser extensions. We would like to point out that in this case you may not be able to use all the functions of this website to their full extent.

(6) Further information on data protection at Google can be found here: Privacy Policy and Google Website Statistics . Alternatively, you can visit the website of the Network Advertising Initiative (NAI). The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Google LLC is certified ( Data Privacy Framework ).

4.4.8 DoubleClick by Google

(1) This website uses the online marketing tool "DoubleClick" by Google. DoubleClick uses cookies to display ads that are relevant to users, to improve campaign performance reports or to prevent a user from seeing the same ads more than once. Google uses a cookie ID to record which ads are displayed in which browser and can thus prevent them from being displayed more than once. In addition, DoubleClick can use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later visits the advertiser's website with the same browser and makes a purchase there. By using this tool, we pursue the interest of showing you advertising that is of interest to you, increasing the attractiveness of our website for you and achieving a fair calculation of advertising costs. The legal basis for the processing of your data is Art. 6(1) sentence 1 lit. f GDPR.

(2) Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our level of knowledge: Through the integration of DoubleClick, Google receives the information that you have accessed the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will find out your IP address and store it.

(3) You can prevent participation in this tracking process in various ways:

a) by setting your browser software accordingly; in particular, the suppression of third-party cookies means that you will not receive any ads from third-party providers,

b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the domain „https://www.google.com/intl/de_de/ads/ ", settings for advertising , whereby this setting is deleted when you delete your cookies,

(4) Further information on DoubleClick by Google can be found at https://www.doubleclickbygoogle.com/en/ and AdSense Help , as well as on data protection at Google in general: Privacy Policy . Alternatively, you can visit the website of the Network Advertising Initiative (NAI). The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Google LLC is certified ( Data Privacy Framework ).

4.4.9 QBank

(1) We use the "QBank" service of the provider QBNK Company AB, Vasagatan 28, 111 22 Stockholm, Sweden (hereinafter "QBNK"). QBank is a web-based storage and management system for images and other files, which we use to display images on our websites.

(2) The following categories of personal data are processed in the context of the use of QBank:

Log files, log data
Metadata (e.g. IP address)
Content data (content of documents, photos, videos, audio, etc.)

(3) The processing of personal data with QBank is based on our legitimate interests (Art. 6(1) lit. f GDPR). Our legitimate interest in processing is to maintain an appealing and efficient digital company presentation to our employees, applicants, interested parties, customers, suppliers, service providers and other business and communication partners. These interests are derived from our right to entrepreneurial freedom and freedom to choose an occupation.

(4) The data processed in connection with the use of QBank will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

(5) QBNK processes the personal data on our behalf; we have concluded an data processing agreement with QBNK.

4.4.10 EQS Investor Relations Cockpit

(1) We use the "EQS Investor Relations Cockpit" of the provider EQS Group AG, Karlstr. 47, 80333 Munich, Germany (hereinafter "EQS"). The EQS Investor Relations Cockpit enables the publication of news and reporting obligations of our company (by email and on our website), a module for active investor targeting and contact management (CRM) including a mailing tool.

(2) The following categories of personal data are processed in connection with the use of the EQS Investor Relations Cockpit:

a) in the context of sending information by email and investor targeting:

Personal master data (first name, surname)
Communication data (email address)

b) as part of the display of news and reporting obligations on our website:

No additional personal data.

(3) The processing of personal data with the EQS Investor Relations Cockpit takes place on the basis of

a) in the context of sending information by email:

b) as part of the display of news and reporting obligations on our website:

c) in the context of investor targeting:

(4) The data processed in connection with the use of the EQS Investor Relations Cockpit will be deleted as soon as it is no longer required for the purpose for which it was collected.

(5) EQS processes the personal data on our behalf; we have concluded an data processing agreement with EQS.

4.5 Plugins and Tools

4.5.1 Google reCAPTCHA

(1) In order to ensure sufficient data security when submitting forms, we use the "reCAPTCHA" service of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter "Google LLC") on our websites in certain cases. This is primarily used to distinguish whether the input is made by a natural person or abusively by machine and automated processing. The service includes sending the IP address and any other data required by Google for the reCAPTCHA service to Google LLC. The deviating data protection provisions of Google LLC apply here.

Google reCAPTCHA uses Google Fonts, also a service of Google LLC, which provides fonts for websites.

(2) The use of Google reCAPTCHA (incl. Google Fonts) to prevent misuse of our website is based on your consent in accordance with Art. 6 (1) lit. a GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act).

(3) The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Google LLC is certified ( Data Privacy Framework ).

(4) Further information on reCAPTCHA can be found in Google LLC's privacy policy under Google Data Protection Notice .

4.5.2 Google Web Fonts

This site uses so-called web fonts provided by Google for the uniform display of fonts. When you access a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the browser you are using must connect to Google's servers. This informs Google that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6(1) lit. f GDPR. If your browser does not support web fonts, a standard font will be used by your computer. You can find more information about Google Web Fonts at Google Fonts FAQ and in Google's privacy policy: Privacy Policy .

4.5.3 Adobe Typekit Web Fonts

This site uses so-called web fonts provided by Adobe Typekit for the uniform display of fonts. When you access a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the browser you are using must connect to the Adobe Typekit servers. This gives Adobe Typekit knowledge that our website has been accessed via your IP address. The use of Adobe Typekit Web Fonts is in the interest of a uniform and appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6(1) lit. f GDPR. If your browser does not support web fonts, a standard font will be used by your computer. Further information on Adobe Typekit Web Fonts can be found in Adobe's privacy policy .

4.5.4 YouTube

(1) We have integrated YouTube videos into our online offering, which are stored on www.youtube.com and can be played directly from our website. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter "Google Ireland"). When using YouTube, personal data may also be transmitted to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter referred to as "Google LLC") in the USA.

(2) YouTube videos on our website are all integrated in "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Data is only transferred when you play the videos. We have no influence on this data transfer. You will be explicitly informed again before the transfer that your data will be transferred to YouTube when you play the video. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated to your profile at YouTube, you need to log out of your Google account prior playing the video. YouTube will store your data as user profiles and use them for the purposes of advertising, market research and/or the needs-based design of its website. You have the right to object to the creation of these user profiles, whereby you must contact Google Ireland to exercise this right.

(3) The use of YouTube to display videos on our website is based on your consent in accordance with Art. 6(1) lit. a GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). You can obtain an overview of your consent to optional services via the "Details" button in the consent banner. You can access the consent banner in the footer area of our website. You can revoke your consent at any time in the Consent Manager. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

(4) The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Google LLC is certified ( Data Privacy Framework ).

(5) Further information about YouTube can be found in the privacy policies of Google Ireland and Google LLC under Google Data Protection Notice and the YouTube Terms of Service .

4.5.5 Google Maps

(1) On this website we use the tool "Google Maps" for displaying interactive maps. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter "Google Ireland"). As part of the use of Google Maps, personal data may also be transmitted to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter "Google LLC") in the USA.

(2) When you visit the website, Google Ireland receives the information that you have accessed the corresponding subpage of our website. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out of your Google account before accessing a map. Google stores your data as user profiles and use them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising. You have the right to object to the creation of these user profiles, whereby you must contact Google Ireland to exercise this right.

(3) The use of Google Maps to display interactive maps on our website is based on your consent in accordance with Art. 6(1) lit. a GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). You can obtain an overview of the consents for optional services via the "Details" button in the consent banner. You can access the consent banner in the footer area of our website. You can revoke your consent at any time in the Consent Manager. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

(4) The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which Google LLC is certified ( Data Privacy Framework ).

(5) Further information on Google Maps can be found in the data protection notices of Google Ireland and Google LLC under Google Data Protection Notice .

4.5.6 Typeform

(1) We use the services of Typeform on this website. In doing so, we are pursuing our interest in increasing the attractiveness of our website by offering you interactive forms on our website. The legal basis for the use of the plug-in is Art. 6(1) sentence 1 lit. f GDPR.

(2) By visiting our website and participating in surveys, ratings & competitions and forms, data entered there will be stored and processed by Typeform on our behalf. The user's IP address, information on the time and duration of use and the information provided by the user in the forms are transmitted.

(3) Further information can be found in the privacy policy of the provider Typeform, Carrer Bac de Roda, 163, 08018 Barcelona, Spain, available at Typeform Terms and at What happens to my data?

4.5.7 A/B testing

(1) This website uses the Kissmetrics tool to analyze user behavior as part of so-called A/B testing. This allows us to show you our websites with slightly different content, depending on the profile assignment made. In this way, we pursue our interest in analyzing our offer, regularly improving it and making it more interesting for you as a user. Cookies (see section 3 Cookies for more details) are stored on your end device for this analysis. The information collected in this way is stored exclusively on our servers in Germany. The IP addresses are shortened before the analyses are carried out. You can prevent the analysis by deleting existing cookies and not accepting the storage of cookies. If you prevent the storage of cookies, we would like to point out that you may not be able to use our website to its full extent. You can prevent the storage of cookies by changing the settings in your browser.

(2) The legal basis for A/B testing is Art. 6(1) sentence 1 lit. a GDPR.

(3) Further information about Kissmetrics can be found in Kissmetrics' data protection information under Kissmetrics Data Protection Notice .

4.5.8 Google Tag Manager

(1) This website uses Google Tag Manager. Google Tag Manager is a solution that allows marketers to manage website tags via an interface. The Google Tag Manager only implements tags. The Tag Manager is a cookie-less domain. This means that no cookies are used and no personal data is collected. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager. Privacy policy: Usage guidelines for Google Tag Manager .

(2) You may block the use of cookies by selecting the appropriate settings in your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie related to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the Google Analytics Opt-out Browser Add-on .

More information about Google Tag Manager can be found at the following link: https://www.google.en/analytics/terms/tag-manager/ .

5. Social Networks

5.1 General information

(1) We operate profiles on social networks to present our company and to communicate with customers and interested parties. In the following, we will inform you about the associated processing activities.

(2) Social networks enable us to present our company to people who have an account with the social network (hereinafter "user") and to all visitors to our profiles without an account with the social network (hereinafter "guest"). Furthermore, customers and interested parties can contact us via this profile. Our profiles and posts can generally be viewed by users and guests (hereinafter users and guests are referred to collectively as "visitors"). If you comment on our posts or send us a message, this data is stored by the social network and can be viewed by us. We can reply to your comment or message. In the case of posts, your comment and our reply may be visible to all users of the social network or even to all visitors.

(3) When you access our profile, the social network can save and evaluate your access and all other interactions you have on the social network's website. This data is made available to the profile owners as statistics and further processed by the social networks for advertising purposes, among other things.

If you have an account with the social network and are logged in when you visit our profile, the provider of the social network can link your interactions with our profile to your account data and process them further. However, it is also possible that data about your interactions with our profile may be stored by the social network for the duration of your visit and processed for further purposes if you are not logged in there or do not have an account. In this case, an assignment can be made, for example, through the use of cookies, small text files that are stored on your device, or in connection with your IP address.

(4) The purpose of data processing is generally to create a profile of the visitor's interests and to use these profiles for advertising purposes. If a person visits certain websites, information about this visit is analyzed and the provider assigns interests to the visitor. Based on the assigned interests, the visitor is shown advertisements. Interest-based advertisements can be displayed by the provider both within and outside the websites of the social network.

(5) Assertion of your rights as a data subject

For requests for information or to assert your other rights as a data subject, we recommend that you contact the provider directly, as only the provider has full access to the data that is processed in connection with accessing our profile or interacting with us on the social network. You can find the social networks' contact information for exercising your rights as a data subject under "Information on the social networks we use". In the case of data processing where the provider of the social network and we are jointly responsible, you also have the right to assert your rights as a data subject against us. In such a case, we will forward your request to the social network insofar as the request concerns data or processing activities that are processed by the social network.

(6) Below you will find further information on the processing activities of the individual social networks we use and the existing objection options:

5.2 Information about Facebook and Instagram:

(1) Facebook:

Provider

Meta Platforms Ireland Limited , 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter "Meta")

Website

https://www.facebook.com/

Form for contacting the Facebook data protection officer

https://www.facebook.com/help/contact/540977946302970

Facebook privacy policy

https://www.facebook.com/privacy/policy/

Profile of NORMA Group SE

https://www.facebook.com/normagroup

Instagram:

Provider

Meta Platforms Ireland Limited , 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Website

https://www.instagram.com

Instagram privacy policy

https://privacycenter.instagram.com/policy/

Profile of NORMA Group SE

https://www.instagram.com/norma.group/

(2) The following categories of personal data are processed in the context of the use of Facebook and Instagram:

Technical information about your device: operating system, information about the browser used, IP address, further information about the device and the Internet connection;
Contact details: if applicable, information about the user's account;
Data about interactions: Information about visited profiles, clicked links, date and time of interaction, further interactions of the visitor.
Further information on the processed data can be found at: https://www.facebook.com/legal/terms/page_controller_addendum

(3) The processing of personal data in the context of our corporate presence on Meta's platforms is based on our legitimate interests (Art. 6(1) lit. f GDPR). Specifically, the interest in maintaining the corporate culture and public relations of the company. These interests are derived from our right to entrepreneurial freedom and professional freedom.

The processing of data in the case of messages or comments on Meta's platforms is based on our legitimate interests in offering customers and interested parties a simple means of contact and improving the quality of our advice. These interests are derived from our right to entrepreneurial freedom and freedom to choose an occupation.

The processing of data for statistical purposes in connection with Page Insights is based, insofar as we are jointly responsible for the processing with Meta, on our legitimate interest in improving the quality of our advice. This interest is derived from our right to freedom to conduct a business and freedom to choose an occupation.

If Meta carries out further processing activities or processes data for statistical or advertising purposes, Meta is the controller for the processing and the processing may be based on other legal bases. For more information, please refer to Meta's Privacy Policy.

(4) We have entered into a joint controllership agreement with Meta that applies to the processing of data in connection with our profile on Facebook (the "Page") for the provision of the profile and the statistical analysis of the interactions of visitors to our profile. This agreement specifies which obligations in connection with data processing are to be fulfilled either by Meta or by us and which party is responsible for the individual processing activities.

The agreement pursuant to Art. 26 GDPR on joint responsibility for data processing for Page Insights between Meta and us as the owner of a Facebook profile can be found here: https://www.facebook.com/legal/terms/page_controller_addendum

You can find more information about the processing of Page Insights data here: https://www.facebook.com/legal/terms/information_about_page_insights_data

(5) When using Facebook, personal data may also be transferred to Meta Platforms Inc, 1 Hacker Way, Menlo Park, CA 94025, USA in the USA. For the transfer of personal data to Meta Platforms Inc. based in the USA, Platforms Ireland Limited uses so-called standard contractual clauses of the Commission of the European Union. A copy of the standard contractual clauses used can be requested here: https://www.facebook.com/help/566994660333381?ref=dp&cms_id=566994660333381

(6) If you wish to object to processing by Meta, you will find options for objecting to different processing activities under this link: https://www.facebook.com/help/contact/367438723733209?no_redirect

You can manage the advertising settings for your Facebook account yourself and deactivate interest-based advertising, for example, at the following link: https://www.facebook.com/settings?tab=ads

If you do not have a Facebook account, you can deactivate interest-based online advertising for the participating websites at the following link:
https://www.youronlinechoices.com/uk/

(7) You have the right to lodge a complaint with the competent supervisory authority. With regard to the processing on Meta's platforms, you can contact the Irish Data Protection Commission, among others. The contact details of the Irish Data Protection Commission can be found at: https://www.dataprotection.ie/en/contact/how-contact-us#

5.3 Information about other social networks we use:

LinkedIn:

Provider

LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland

Website

https://www.linkedin.com/

Privacy policy

https://www.linkedin.com/legal/privacy-policy

Profile of NORMA Group SE

https://www.linkedin.com/company/norma-group-se/

5.4 Integration of X

Functions and content of the “X” platform, offered by X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, may be integrated into our online offering. This may include, for example, content such as images, videos or texts and buttons with which users can share content from this online service within X.

If the users are members of the X platform, X Corp. can assign access to the above-mentioned content and functions to the users' profiles there. The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which X Corp. is certified.

Further information on X can be found in the data protection notice of X Corp. at: https://x.com/en/privacy .

You can change your privacy settings for X at https://x.com/settings/account/personalization .

5.5 integration of LinkedIn

Functions and content of the LinkedIn network, offered by LinkedIn Corporation, 2029 Stierlin Cout, Mountain View, CA 94043, USA, may be integrated into our online offering.

If you click on the LinkedIn "Recommend" button while you are logged into your LinkedIn account, the content of our pages will be linked to your LinkedIn profile. This enables LinkedIn to associate your visit to our pages with your LinkedIn user account. The transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework, according to which LinkedIn is certified.

Further information on Linkedin can be found in the data protection notice of Linkedin Corporation at: https://www.linkedin.com/legal/privacy-policy?.

6. Applications

6.1 Unsolicited Applications by Email

(1) You have the opportunity to send us an unsolicited application by email. As part of this email application, you provide us with personal data. It is particularly important to us to handle your personal data confidentially during the application process. It is therefore a matter of course for us to treat all personal data that you entrust to us in strict confidence and responsibly in compliance with the applicable statutory data protection regulations. As a precaution, we would like to point out that communication by email may be unencrypted over the Internet. Your data would then not be protected against access by third parties. We therefore recommend that you apply via our applicant portal .

We use technical and organizational security measures to protect your personal data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. The legal basis for the processing of personal data that you send us as part of your application is generally the implementation of pre-contractual measures initiated by your application in accordance with Art. 6(1) sentence 1 lit. b GDPR. If the data transmitted by you for the purposes of the application also contains particularly sensitive data of a special category pursuant to Art. 9(1) GDPR, we process this data on the legal basis of your consent pursuant to Art. 6(1) sentence 1 lit. a, which we obtain from you for this reason in a binding manner as explained in more detail under para. 2.

(2) When applying by email, you provide us with personal data such as your first and last name, postal address and email address. To make it easier for us to contact you, you can also voluntarily enter further contact details, in particular your landline and cell phone number. To enable us to better meet your application requirements, you also have the option of voluntarily sending us additional data and files, e.g. a personal message, details of your professional qualifications and experience and files containing your application documents, such as your personal cover letter, CV, application photo, certificates, etc. Please note that CVs, certificates or other data you submit for the purposes of your application may also contain particularly sensitive data, such as information on racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union or political party, physical or mental health or sex life. We therefore recommend that, if possible, you do not provide any information relating to such sensitive data of a special category.

(3) It cannot be ruled out and in individual cases it may be necessary for you to provide us with special category data as listed in paragraph 2 as part of your application. We are prohibited by law from processing such data without your consent. By sending us your application documents, you give us your consent to process this sensitive data of special categories in accordance with this Data Protection Notice.

(4) The data and files transmitted by you will be stored and used exclusively for purposes related to the recording and processing of your interest in employment or training with us and the processing of your application, including the necessary contact with you. Your application will be treated confidentially and will only be disclosed to authorized NORMA Group employees. If your application is successful, the data and files you submit may be used in the context of the employment relationship with you. If your application for a job offer is not successful, we will store the data and files you have submitted in our applicant database for six months in order to be able to answer any questions in connection with your application. After this period, the data and files will be deleted automatically.

(5) Your data and files submitted as part of your application will not be passed on to third parties unless we have your express consent or an official order to do so.

(6) You have the option to withdraw your application in whole or in part at any time. You can also request at any time that all or some of the data and files you have submitted be deleted or amended from our applicant database. You are also entitled to withdraw your consent to the processing of the personal data and files you have submitted as part of your application at any time with effect for the future. All you need to do is send an email to career.de@normagroup.com. However, certain data relating to your application must be stored for a limited period of time in order to comply with legal provisions and obligations to provide evidence. Once the legal basis no longer applies, the data will be blocked and/or deleted. With regard to your basic rights, we would also like to refer you to section 1.4 of this Data Protection Notice.

6.2 Applicant Portal

(1) For applications, we also collect and process applicants' personal data via our applicant portal. Following registration, the access data for creating an applicant profile is sent to the applicant by email. The information provided by the applicant in the applicant profile is processed by us in order to handle the application process.

(2) The following categories of personal data are processed when using the applicant portal:

Name and email address (registration for the applicant portal)
Data provided in:
- Cover letter
- Curriculum vitae
- Certificates
- Other documents relevant for the respective application

(3) The legal basis for the processing of applicant data is Art. 6(1) lit. b in conjunction with Art. 88 GDPR. If you transmit special categories of personal data, your consent pursuant to Art. 6(1) lit. a GDPR.

(4) If the application is not considered as part of the application procedure, the application documents will be automatically deleted no later than six months after notification of the rejection decision, provided that no other legitimate interests of the data controller conflict with deletion.

(5) Applicants have the option of withdrawing their applications at any time. In this case, the application documents will be deleted immediately. However, certain data relating to your application must be stored for a limited period of time in order to comply with legal requirements and obligations to provide evidence. Once the legal basis no longer applies, the data will be blocked and/or deleted. With regard to your basic rights, we would also like to refer you to section 1.4 of this data protection notice.

(6) Further use of the applicant profile: If the applicant profile is also to be considered for future job advertisements, this will only take place with the consent of the applicant. In this case, the legal basis for the further storage and processing of the applicant data is the consent of the applicant in accordance with Art. 6(1) lit. a GDPR. This consent can be revoked at any time. To do so, please contact career.de@normagroup.com

7. Processing outside our Website

7.1 Microsoft 365

(1) We use the productivity, collaboration and exchange platform Microsoft 365, which is provided by Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown Dublin 18, D18 P521, Ireland (hereinafter "Microsoft"). Microsoft 365 is a service that connects various platforms, including for (the planning of) online meetings, as a telephony solution, for surveys, document exchange, editing and translation and for email communication, and enables simple exchange between the platforms.

(2) The following categories of personal data are processed in the context of the use of Microsoft 365:

Contact details (company, name, telephone, email (if personal), address)
Contract master data (contractual relationship, product or contractual interest)
Log files, log data
Metadata (e.g. IP address, duration of participation in a meeting)
Content data (content of documents, photos, videos, audio, etc.)

(3) The processing of personal data with Microsoft 365 is carried out for Contractual Purposes (in the case of processing for the purpose of implementing the contract or pre-contractual measures) or, insofar as personal data is processed in the context of an employment relationship or application procedure, on the basis of Art. 6(1) lit. b GDPR. Furthermore, we process the personal data on the basis of our legitimate interests (Art. 6(1) lit. f GDPR). Our legitimate interest in processing is to enable effective and efficient communication and collaboration between our employees, applicants, interested parties, customers, suppliers, service providers and other business and communication partners. These interests are derived from our right to freedom to conduct a business and freedom to choose an occupation.

(4) As part of the use of Microsoft 365, personal data may also be transferred to Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA (hereinafter "Microsoft Corp.") in the USA. The transfer of personal data to the USA is based on the standard contractual clauses of the EU Commission (Commission Implementing Decision (EU) 2021/914 of 04.06.2021 - Ref. C(2021) 3972, OJ EU No. L 199/31 of 07.06.2021). Microsoft Corp. is also certified under the EU-U.S. Data Privacy Framework.

(5) The data processed in connection with the use of Microsoft 365 is stored for as long as is necessary for the stated purposes.

(6) Microsoft processes the personal data on our behalf. We have concluded a data processing agreement with Microsoft. The latest version can be found at the following link:
https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Da ta-Protection-Addendum-DPA?lang=1

7.2 Creditreform

(1) We use the debt collection services of "Verband der Vereine Creditreform e.V." (hereinafter "Creditreform"), Hammfelddamm 13, 41460 Neuss, Germany, for the management of receivables that have exceeded the agreed payment term.

(2) The following personal data is processed as part of this processing:

Address data of the customer,
Contact person of the creditor,
Details of the respective outstanding receivable,
Number of days the agreed payment target has been exceeded.

(3) The processing is carried out for Contractual Purposes.

(4) The data that we process as part of the processing of outstanding claims will be stored by us for 10 years after the conclusion of the respective case.

(5) Further information on Creditreform's data protection information can be found at: https://www.creditreform.de/datenschutz

8. Special Notices for Countries outside the European Union

8.1 USA

In the US, your rights may vary by state. Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we provide our users in California with enhanced control and transparency over their personal information. You have the right to request detailed information from us about the personal data we collect and the purposes for which we use it. You also have the right to have your personal data deleted. Under the CPRA, we are also required to notify any third parties to whom we have disclosed your information of your request for erasure. In addition, the CCPA gives you the right to object to the sale of your information for marketing purposes. The CPRA extends this right by giving you the ability to opt out of any sharing of your information for contextual advertising purposes. In addition, the CPRA introduces specific rights when dealing with your sensitive personal data, including restricting its use and disclosure. We are committed to respecting these rights and ensuring you have full control over the processing of your personal information.

8.2 Australia

Under the Australian Privacy Act 1988, you have the right to access and correct your personal information. You also have the right to lodge a complaint with the Australian Information Commissioner if you believe your privacy rights have been infringed.

8.3 China

English Version

Addendum: Additional Privacy Terms for Chinese Residents

This Addendum applies to the processing of personal information of residents of the People's Republic of China ("China", excluding, for the purposes of this Addendum, Hong Kong, Macau, and Taiwan). NORMA Group and its subsidiaries ("NORMA," "NORMA Group," or "we") are committed to processing and protecting your personal data in accordance with Chinese laws and regulations, including the Personal Information Protection Law of China ("PIPL").

For Chinese residents, this Addendum supplements NORMA Group's Data Protection Notice. In the event of any inconsistency between the terms of this Addendum and those in NORMA Group's Data Protection Notice, the terms of this Addendum shall prevail in the context of processing personal information of Chinese residents.

This Addendum is intended to inform you, prior to or at the time of providing us with your personal information, about why and how we process your personal information.

The term "personal information" as used in this Addendum refers to any information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymized information. Unless otherwise specified, the definitions of terms in this Addendum are consistent with the meanings in NORMA Group's Data Protection Notice.

On What Basis Do We Process Your Information?

We process your personal information for the purposes stated based on one or more of the following legal bases:

Your consent;
Processing is necessary for the conclusion or performance of a contract to which you are an interested party, or for human resource management according to lawfully formulated labor rules and structures and lawfully concluded collective contracts;
Processing is necessary for compliance with legal or regulatory obligations to which we may be subject;
Processing is necessary to respond to sudden public health incidents or protect natural persons' lives and health, or the security of their property, under emergency conditions;
Processing is necessary within a reasonable scope to implement news reporting, public opinion supervision, and other such activities for the public interest.

Where Do We Process Your Personal Information?

Please understand that NORMA Group is a global company headquartered in Germany. Within the scope permitted by the PIPL, we may transfer your personal information to our affiliates and subsidiaries in Germany and other countries for business operations, corporate governance, and other purposes. We will obtain your separate consent for such transfers.

We may also transfer your personal information to third-party service providers and business partners in different countries to improve operational efficiency and performance, and to create backups for business continuity and disaster recovery purposes. We will ensure that the recipient is subject to applicable laws within its jurisdiction that provide protection standards equivalent to those under this Addendum.

We will notify you, in accordance with applicable laws and regulations, of the name, contact information, processing purpose, processing methods, the type of personal information being transferred, and the methods and procedures for exercising your rights under the PIPL against the overseas recipient, and obtain your separate consent before transferring your personal information abroad. You may withdraw your consent at any time.

Additionally, we will take all reasonable measures to ensure that the cross-border transfer of your personal information complies with applicable legal and regulatory requirements, including but not limited to completing a personal information protection impact assessment, passing security assessments, and signing standard contracts where necessary.

Your Privacy Rights

If you wish to exercise your rights under the PIPL within the limits allowed by law (including but not limited to the right to access and copy, the right to rectification, the right to deletion, and the right to data portability), or if you have any questions about this Addendum or how we use your personal information, you may refer to NORMA Group's Data Protection Notice or contact us at:

dataprotection@normagroup.com .

You have the right to lodge a complaint with the Cyberspace Administration of China or other applicable data protection authorities.

Minors Under the Age of 14

Our website is not intended for children under the age of 14, and we do not knowingly collect personal information from children under 14. If we are informed that we have collected or received personal information from a child under the age of 14, we will delete that information.

Changes to This Addendum

NORMA Group reserves the right to amend this PIPL Privacy Addendum at any time. If we make changes to this PIPL Privacy Addendum, we will post the updated Addendum on our website and update the effective date of the Addendum. Your continued use of our website after the changes have been posted signifies your acceptance of such changes.

Chinese Version

附录：针对中国居民的隐私声明附加条款

本附录适用于中华人民共和国（"中国"，仅就本附录而言，不包括香港、澳门和台湾）居民个人信息的处理。NORMA Group及其子公司（"NORMA"、"NORMA Group "或 "我们"）致力于根据包括《中华人民共和国个人信息保护法》（"PIPL"）在内的中国法律法规处理并保护您的个人数据。

对于中国居民，本附录补充了NORMA Group的Data Protection Notice。如果本附录中的任何条款与 NORMA Group的Data Protection Notice的任何条款不一致，则在处理中国居民个人信息的范围内，以本附录为准。

本附录旨在当您向我们提供您的个人信息时或在此之前告知您我们为何以及如何处理您的个人信息。

本附录所称 "个人信息"，是指以电子或其他方式记录的与已识别或可识别的自然人有关的各类信息，不包括匿名信息。除非另有说明，否则本附录中的术语定义与NORMA Group的Data Protection Notice中的含义相同。

我们依据什么处理您的信息？

我们依据以下一个或多个法律基础为所述目的处理您的个人信息：

- 您的同意；

- 处理对于与您签订或履行合同是必需的，或对于根据依法制定的劳动规章制度和依法签订的合同进行人力资源管理是必需的；

- 处理对于遵守我们可能要履行的法律或监管义务是必需的；

- 处理对于在紧急情况下应对突发公共卫生事件或保护个人生命和健康或财产安全是必需的；

- 处理对予进行新闻报道、舆论监督以及开展其他符合公众利益的工作是必需的。

我们在哪里处理您的个人信息？

请理解，NORMA Group是一家总部位于德国的全球性公司。在PIPL允许的范围内，我们可能会将您的个人信息传输至德国以及我们在其他国家的关联公司和子公司，用于业务运营、公司治理等。我们将就此获得您的单独同意。

我们还可能将您的个人信息传输给我们在不同国家的第三方服务提供商和第三方合作伙伴，以提高运营效率和性能，并为业务连续性和灾难恢复目的创建副本。我们将确保接收方受其司法管辖范围内适用法律的约束，以便为您的个人数据提供与此附录下的标准相当的保护标准。

我们将视具体情况，依照适用的法律、行政法规的规定，告知您境外接收方的姓名、联系方式、处理目的和方式、转移的个人信息类型以及您对海外接收人行使您在PIPL下的权利的方式和程序，并在将您的个人信息转移到国外之前获得您的单独同意。您可以随时撤回您的同意。

此外，我们将采取一切合理措施确保您的个人信息跨境符合适用的法律法规要求，包括但不限于完成个人信息保护影响评估、通过安全评估、必要时签订标准合同。

您的隐私权

如果您想在法律允许的范围内行使 PIPL 规定的权利（包括但不限于访问和复制权；更正权；删除权；数据可移植性权），或者如果您对本附录或我们如何使用您的个人信息有疑问，您可以参考 Norma Group的Data Protection Notice T或通过

dataprotection@normagroup.com

联系我们。

您有权向中华人民共和国国家互联网信息办公室或其他适用的数据保护机构提出投诉。

14岁以下的未成年人

我们的网站不适用于 14 岁以下儿童，我们也不会有意收集其个人信息。如果我们被告知我们已收集或收到 14 岁以下儿童的个人信息，我们将删除该信息。

此PIPL隐私附录的变更

NORMA Group保留随时修改此PIPL隐私附录的权利。若我们对此PIPL隐私附录进行更改，我们将在网站上发布更新后的附录，并更新附录的生效日期。您在变更发布后继续使用我们的网站，即表示您接受此类变更。

9. Disclaimer/Version

This Data Protection Notice does not apply to applications, products, services, websites or social media functions of third-party providers that are accessible via links that we provide for informational purposes. When you use these links, you leave our websites, so there is a possibility that information about you may be collected or passed on by third parties. We have no influence whatsoever on third-party websites and make no recommendations or assurances about these websites or their data protection practices. We therefore encourage you to carefully read and review the data protection notices of any websites you interact with before allowing them to collect, process and use your personal data.

We ask you to inform yourself regularly about the content of our Data Protection Notice. We will adapt the Data Protection Notice as soon as changes to the data processing we carry out make this necessary. If we provide addresses and contact information of companies and organizations in this Data Protection Notice, we would like to point out that the addresses may change over time and ask you to check the information before contacting them.

Last update: 10.10.2024

Contact

Questions?

Get in touch with us for more support.

Solutions

Products

Quality

R&D Engineering

Purchasing

Supply Chain

Downloads

Uncompromising quality and safety

Superior technical and innovative solutions

Absolute functionality and quality

Regional brands

Corporate profile

Share

Publications & Events

Online Reports

Financial Figures

Creditor Relations

Services

Consider the possibilities

We believe in you

Let’s build your future

Job portal

Newsroom

Management and Supervisory Board

Corporate Responsibility

Compliance

NORMA Group in Americas

NORMA Group in EMEA

NORMA Group in APAC

Webshops

Data Protection Notice