Data protection statement
We are very pleased about your interest in our company.
The topic of data protection has a very high priority for the management of Teutoburger Ölmühle GmbH.
A use of the internet pages of Teutoburger Ölmühle GmbH is basically possible without any personal data being used. However, if you wish to make use of a special service of our company via our website, it may be necessary to process your personal data.
If the processing of personal data is required and there is no legal basis for such processing, we generally seek the consent of the the data owner.
The processing of personal data, such as the name, address, email address or telephone number belonging to a data owner, is always carried out in accordance with the General Data Protection Regulation and in accordance with the applicable national data protection provisions.
By means of this data protection statement, our company seeks to inform the public about the nature, scope and purpose of the personal information which we collect, use and process. Furthermore, the data owners are informed of their rights under this data protection statement.
Teutoburger Ölmühle GmbH has, as the data processor, implemented numerous technical and organisational measures in order to ensure the most comprehensive protection possible for the personal data processed via this website. Nevertheless, Internet-based data transmissions may in principle have such basic security gaps that absolute protection cannot be guaranteed. For this reason, every data owner is also free to submit personal data to us in alternative ways, for example by telephone.
1. Definition of terms
The data protection statement of Teutoburger Ölmühle GmbH is based upon the terminology used by the regulatory authorities for the European guidelines and regulations in the adoption of the General Data Protection Regulation (GDPR) and in the “Law on the Adaptation of the Data Protection Act concerning the (EU) Regulation 2016/679 and the implementation of the (EU) Regulation 2016/680 (DSAnpUG-EU)”.
In order to ensure this, we would like to explain the terminology used in advance.
- personal data
Personal data is any information relating to an identified or identifiable natural person (hereinafter the "data owner"). As identifiable is considered a natural person who can be identified, whether directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more special features, or the expression of the physical, physiological, genetic, mental, economic, cultural or social identity of this natural person.
- data owner
The data owner is any identified or identifiable natural person whose personal data is processed by the data processor.
Processing means each operation performed with or without the aid of automated processes or any such process sequence associated with personal data such as collection, capture, organisation, arrangement, storage, adaptation or alteration, retrieval, consultation, usage, disclosure by transmission, dissemination or any other form of provision, reconciliation or linkage, restriction, deletion or destruction.
- Restriction of processing
Restriction of the processing involves the marking of stored personal data with the objective of limiting its future processing.
Profiling is any kind of automated processing of personal data which involves using that personal information to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the job performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or relocation of this natural person.
Pseudonymisation involves the processing of personal data in a way in which the personal data can no longer be assigned to a specific data owner without the need for additional information, provided that such additional information is kept separate and subject to technical and organisational measures which ensure that the personal data is not assigned to any identified or identifiable natural person.
- Data controller or data processor
The data controller or the data processor is the natural or legal person, public authority, agency or other body, who or which, alone or in concert with others, decides upon the purposes and means for processing personal data. Where the purposes and means of such processing are determined by the laws of the Union or the laws of the Member States, the data controller or the specific criteria for his nomination may be provided for under the laws of the Union or under national laws.
The processor is a natural or legal person, public authority, agency or other body, who or which processes personal data on behalf of the data controller.
The recipient is a natural or legal person, agency, body or other entity, to whom or to which personal data is disclosed, irrespective of whether it involves a third party or not. However, authorities which may receive personal data in connection with a particular mandate under the laws of the Union or under national law are not considered to be recipients.
- Third parties
A third party is a natural or legal person, public authority, agency or body other than the data owner, the data controller, the processor and those persons authorised under the direct responsibility of the data controller or the processor, who or which are allowed to process the personal data.
Consent is any expression of will voluntarily and unequivocally made by the data owner in an informed and unambiguous manner for the particular case in the form of a statement or other clear affirmative act where the data owner indicates that their consent to the processing of the personal data concerning them is understood.
2. Name and address of the data processor
The data processor, within the meaning of the General Data Protection Regulation, other data protection laws in the Member States of the European Union and other provisions with a data protection character, is the:
Company:Teutoburger Ölmühle GmbH
Contact data of the data protection officer:EU-CON BeraterForum GmbH Mr R. Nowack Waldfeuchter Str. 266 52525 Heinsberg firstname.lastname@example.org
Each data owner may contact our data protection officer at any time with any questions and suggestions with regard to data protection.
Contact data the competent supervisory authority for data protection:
The State Data Protection and Freedom-of-Information Officer
PO Box 20 04 44
40102 Düsseldorf Tel.: 0211/38424-0
By using cookies, Teutoburger Ölmühle GmbH can provide users of this website with more user-friendly services which would not be possible without the cookie setting.
Another example is the cookie of a shopping basket in the online shop. The online shop remembers the items which a customer has placed in the virtual shopping cart by using a cookie.
The data owner can prevent the setting of cookies by our website at any time by means of a corresponding setting of the Internet browser used and thus permanently blocking the setting of any cookies. Furthermore, cookies which have already been set can be deleted at any time by using an internet browser or other software programs. This is possible with all common internet browsers. If the data owner deactivates the setting of cookies in the Internet browser used, not all the functions of our website may be fully available.
4. Collection of general data and information
The website of Teutoburger Ölmühle GmbH collects a series of general data and information every time that the website is accessed by the data owner or by an automated system. This general data and information is stored in the log files of the server.
The following information can be collected:
- the browser type and versions used,
- the operating system used by the accessing system,
- the website from which an accessing system comes to our website (so-called Referrer),
- the sub-sites which are controlled by using an accessing system on our website,
- the date and time of any access to the website,
- the Internet service provider of the accessing system and
- other similar data and information, which serve as security in case of attacks on our information technology system.
In using this general data and information our company draws no conclusions regarding the data owner.
Rather, this information is needed in order to
- deliver the contents of our website correctly,
- optimise the content of our website as well as the advertising for it,
- ensure the permanent functioning of our information technology systems and the technology of our website, and
- provide police services with the necessary information for prosecution in the event of a cyberattack.
This anonymously collected data and information is evaluated by our company, on the one hand statistically and then with the aim of increasing the data protection and data security in our company, in order to ensure an optimal level of protection for the personal data processed by us. The anonymous data held in the server log files is stored separately from all personal data provided by the data owner.
5. Contact options via the website
Due to legal regulations, the Internet site of Teutoburger Ölmühle GmbH includes information which enables quick electronic contact with our company as well as direct communication with us, which also includes a general address for the so-called electronic mail (email address). If a data owner contacts the data processor by email, the personal data provided by the data owner will be automatically saved. Such personal data, provided on a voluntary basis by a data owner to the data processor, is stored for the purpose of processing or contacting the data owner. No disclosure of this personal data to third parties takes place.
6. Routine deletion and blocking of personal data
The data processor processes and stores the personal data of the data owner only for the period required to achieve the purpose of storage, or if so stipulated in the guidelines or regulations set by the European regulatory authorities or other regulatory authorities to which the data processor is subject.
If the purpose for the storage is omitted or if a storage period stipulated by the regulatory authorities for the European guidelines and regulations or those of any other relevant regulatory authorities expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.
7. Rights of the data owner
- Right to confirmation
Each data owner has the right to ask the data processor for confirmation whether the personal data concerning them is being processed.
Right to information
Any data owner involved with the processing of personal data has the right at any time to obtain from the data processor any information free of charge concerning the personal data stored about them and a copy of that information. Furthermore, the regulatory authorities for the European guidelines and regulations have provided the data owner with the following information:
- the purposes of the processing
- the categories of personal data being processed
- the recipients or categories of recipients to whom the personal data has been disclosed or is still to be disclosed, in particular recipients in third countries or belonging to international organisations
- if possible, the planned duration for which the personal data will be stored or, if that is not possible, the criteria for determining that duration
- the existence of a right to rectification or deletion of the personal data concerning them, or of a restriction of the processing by the data controller, or of a right to object to such processing
- the existence of a right of appeal to a supervisory authority
- if the personal data is not collected from the data owner: all available information about the origin of the data
- the existence of automated decision-making, including profiling, in accordance with Article 22, paras. 1 and 4 of the GDPR and, in these cases at least, meaningful information regarding the logic involved and the scope and intended impact of such processing on the data owner.
In addition, the data owner has a right to information as to whether personal data has been transmitted to a third country or to an international organisation. If that is the case, then the data owner has otherwise the right to obtain information about the appropriate guarantees in connection with the transfer.
- Right to rectification
Any data owner affected by the processing of personal data has the right to demand the immediate correction of incorrect personal data concerning them. Furthermore, the data owner has the right to request the completion of incomplete personal data, including by means of a supplementary statement, taking into account the purposes of the processing.
- Right to deletion (right to be forgotten)
Any data owner affected by the processing of personal data has the right to require the data controller to delete the personal data concerning him or her without delay, provided that one of the following reasons is satisfied and the processing is no longer required:
- The personal data has been collected for such purposes or otherwise processed for which it is no longer necessary.
- The data owner revokes their consent, upon which the processing was based in accordance with Article 6, para. 1 (a) of the GDPR, or Article 9, para. 2 (a) of the GDPR, and there is no other legal basis for processing.
- The data owner objects to the processing in accordance with Art. 21 para. 1 of the GDPR, and there are no legitimate reasons for the processing, or the data owner objects to the processing in accordance with Art. 21 para. 2 of the GDPR.
- The personal data was processed unlawfully.
- The deletion of personal data is necessary to fulfil a legal obligation under the laws of the Union or under national laws to which the data controller is subject.
- The personal data was collected in relation to information society services offered in accordance with Art. 8 para. 1 of the GDPR.
If any of the above reasons apply and a data owner wishes to request the deletion of their personal information, they may contact our data protection officer or another employee working for the data processor at any time.
The data protection officer or another employee will arrange for the deletion request to be carried out.
If the personal data has been made public by Teutoburger Ölmühle GmbH and if our company is responsible for deleting personal data as the data controller in accordance with Art. 17 para. 1 of the GDPR, we will take the appropriate measures, including technical ones, taking into account the available technology and the implementation costs, to inform other data processors who process the published personal data that the data owner has demanded that any other data processors delete all links to such personal data and copies made or replications of such personal data, in as much as the processing is not necessary. The data protection officer or another employee will arrange for the necessary action to be taken in individual cases.
- Right to a restriction of processing
Any data owner affected by the processing of personal data has the right to require the data controller to restrict the processing if any of the following conditions exist:
- the accuracy of the personal data is contested by the data owner for a period of time which enables the data controller to verify the accuracy of the personal data.
- the processing is unlawful, the data owner refuses any deletion of the personal data, and instead requests the restriction of the use of the personal data.
- the data controller no longer needs the personal data for processing purposes, but the data owner requires them to assert, exercise or defend their rights.
- the data owner makes an objection to the processing in accordance with Art. 21 para. 1 of the GDPR and it is not yet clear whether the legitimate reasons of the data controller outweigh those of the data owner.
Insofar as one of the above-mentioned conditions exists and a data owner wishes to request the restriction of personal data stored by Teutoburger Ölmühle GmbH, they may contact our data protection officer or another employee working for the data processor at any time. The data protection officer or another employee will arrange for the restriction of processing.
- Right to data portability
Any data owner affected by the processing of personal data has the right to receive in a structured, common and machine-readable format any personal data relating to them which was provided to a data controller by the data owner. They will also have the right to transfer this data to another data controller without any hindrance by the data controller to whom the personal data was provided, insofar as the processing is based upon consent in accordance with Article 6 para. 1 (a) of the GDPR or Article 9 para. 2 (a) of the GDPR, or is based upon a contract in accordance with Article para. 1 (b) of the GDPR and the processing is carried out using automated procedures, unless the processing is not required for the performance of a task which is in the public interest or in the exercise of the public authority which has been delegated to the data controller.
Furthermore, in exercising their right to data portability under Article 20 para. 1 of the GDPR, the data owner has the right to ensure that their personal data is transmitted directly from one data controller to another, insofar as this is technically feasible and, if so, this does not affect the rights and freedoms of other persons.
In order to assert the right to data portability, the data owner may at any time contact the appointed data protection officer or another employee.
- Right to objection
Any data owner affected by the processing of personal data has the right, at any time and for reasons arising from his or her particular situation, to raise objections to the processing of personal data relating to them in accordance with Article 6, para. 1 (e) or (f) of the GDPR. This will also apply to profiling based on these provisions.
Teutoburger Ölmühle GmbH will not process personal data in the event of an objection, unless we can demonstrate compelling legitimate reasons for the processing which outweigh the interests, rights and freedoms of the data owner, or processing for the purposes of asserting, exercising or defending legal claims.
If Teutoburger Ölmühle GmbH processes personal data in order to operate direct mail, the data owner will have the right to object at any time to the processing (with effect for the future) of the personal data for the purpose of such advertising. This will also apply to profiling insofar as it relates to such direct mail. If the data owner objects to processing for direct marketing purposes, Teutoburger Ölmühle GmbH will no longer process this personal data for these purposes.
In addition, the data owner has the right, for reasons arising from their particular situation, to raise an objection to the processing of personal data concerning them, which is used at Teutoburger Ölmühle GmbH for scientific or historical research purposes or for statistical purposes in accordance with Article 89, para. 1 of the GDPR, unless such processing is necessary to fulfil a task in the public interest.
In order to exercise their right to opposition, the data owner may directly contact the data protection officer or another employee. The data owner is also free, in connection with the use of information society services, notwithstanding Regulation 2002/58/EC, to exercise their right of opposition by means of automated procedures using technical specifications.
- Automated decisions in individual cases including profiling
Any data owner affected by the processing of personal data has the right conferred by the regulatory authorities for the European guidelines and regulations not to be subjected to a decision based solely upon automated processing, including profiling, which could have a legal impact, or could similarly appreciably affect their performance, provided that the decision
(1) is not required for the conclusion or performance of a contract between the data owner and the data controller, or
(2) is permitted by the laws of the Union or of a member state to which the data controller is subject, and where such legislation contains appropriate measures to safeguard the rights, freedoms and legitimate interests of the data owner, or
(3) is carried out with the express consent of the data owner.
If the decision:
(1) is required for the conclusion or performance of a contract between the data owner and the data controller, or
(2) takes place with the express consent of the data owner,
Teutoburger Ölmühle GmbH will take the appropriate steps to safeguard the rights and freedoms as well as the legitimate interests of the data owner, including at least the right to obtain the intervention of a person on behalf of the data controller, to express their own position and to challenge the decision.
If the data owner wishes to claim automated decision-making rights, they may contact the data protection officer or another employee working for the data processor in this respect at any time.
- Right to revoke a data protection approval
Any data owner affected by the processing of personal data has the right, granted by the regulatory authorities for the European guidelines and regulations, to revoke any approval of the processing of personal data at any time.
If the data owner wishes to assert their right to withdraw their approval, they may at any time contact our data protection officer or another employee working for the data processor.
8. Data protection with regard to applications and the application process
The data processor collects and processes the personal data of applicants for the execution of the application procedure. The processing can also be performed electronically. This is particularly the case if an applicant submits corresponding application documents to the data processor by electronic means, for example by email or via a web form available on the website.
If the data processor concludes a contract of employment with an applicant, the data transmitted will be stored for the purposes of the employment relationship in accordance with the legal provisions. If no employment contract is concluded with the applicant by the data processor, the application documents will accordingly be automatically deleted within 2 weeks following notification of the rejection decision, provided that deletion does not conflict with any other legitimate interests of the data processor.
Other legitimate interest in this sense would be, for example, a burden of proof in a procedure under the General Equal Treatment Act (AGG).
9. Data protection provisions with regard to the use and application of Facebook
The data processor has integrated components of the Facebook company on this website. Facebook is a social network.
A social network is an Internet operated social meeting place, an online community which typically allows users to communicate with each other and interact in virtual space. A social network may serve as a platform for exchanging views and experiences, or allowing the Internet community to provide personal or business information. Facebook allows users of the social network to create private profiles, upload photos and socialise using friendship requests.
The Facebook operator is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The data processor for personal data, when the data owner lives outside the US or Canada, is, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
As a result of each retrieval of one of the pages of this website which are operated for it by the data processor and upon which a Facebook component (Facebook plug-in) has been integrated, the Internet browser on the information technology system of the data owner is automatically prompted by the respective Facebook component to download a representation of the corresponding Facebook component from Facebook. An overview of all Facebook plug-ins can be found at: developers.facebook.com/docs/plugins/. As part of this technical process, Facebook receives information about which specific sub-site of our website is visited by the data owner.
If the data owner is simultaneously logged into Facebook, Facebook recognises with each visit to our website by the data owner, and during the entire duration of the respective stay on our website, which specific sub-site of our website the data owner visits. This information is collected using the Facebook component and assigned by Facebook to the respective Facebook account of the data owner. If the data owner activates one of the Facebook buttons integrated on our website, for example the "Like" button, or if the data owner makes a comment, Facebook assigns this information to the personal Facebook user account of the data owner and saves this personal data.
Facebook always receives information via the Facebook component that the data owner has visited our website if the data owner is logged onto Facebook at same time as they access our website; this happens regardless of whether the person clicks on the Facebook component or not. If such a transfer of this information to Facebook is not wanted by the data owner, the latter may prevent the transfer by logging out of their Facebook account before calling our website.
The data protection guidelines published by Facebook, which are available at: de-de.facebook.com/about/privacy/, provide information regarding the collection, processing and use of personal data by Facebook. It also explains which setting options Facebook offers to protect the privacy of the data owner. Furthermore, different applications are available which make it possible to suppress any data transmission to Facebook. Such applications may be used by the data owner to suppress data transmission to Facebook.
10. Collection and processing of data through the use of additional tracking and analysis tools
(a) Use of the MATOMO web analysis tools
This website uses the open source software Matomo, http://de.matomo.org, for analysing the website. Matomo uses so-called cookies, text files which are stored on your computer and which allow an analysis of the use of the website. To this end, the usage information generated by the cookies (including your shortened IP address) is transmitted to the server and stored for usage analysis purposes. Your IP address will be immediately anonymised during this process so that you will remain anonymous to us as a user. The information generated by the cookies about your use of the site will not be disclosed to third parties. The server on which the statistical data is stored, comes from a German provider, and is also physically located in Germany. You can prevent the installation of cookies by setting your browser software accordingly.
Opposing the use of the MATOMO web analysis tools
If you do not agree with the storage and evaluation of your data when visiting our website, then you may object below to the storage and usage at any time with a click of the mouse. In this case, a so-called opt-out cookie is stored on your browser. As a result, Matomo is not able to capture any session data whatsoever. If you delete your cookies, this also means that the opt-out cookie is also deleted and must be reactivated by you.
Below you have the option to disable the use of Matomo.
Instructions in German regarding the DNT browser functionality can be found here: http://www.akademie.de/wissen/do-not-track-datenschutz
11. Legal basis of processing
Art. 6 I (a) of the GDPR serves our company as a legal basis for processing operations where we obtain consent for a specific processing purpose. If the processing of personal data is necessary in order to fulfil a contract to which the data owner is a party, as is the case, for example, with processing operations necessary for the supply of goods or the provision of any other service or consideration, the processing will accordingly be based upon Art. 6 I (b) of the GDPR. The same will apply to any processing operations which are necessary to carry out pre-contractual measures, for example in cases of enquiries regarding our products or services.
If our company is subject to a legal obligation which requires the processing of personal data, such as the fulfilment of tax obligations, the processing will accordingly be based upon Art. 6 I (c) of the GDPR. In rare cases, the processing of personal data may be required to protect the vital interests of the data owner or another natural person.
This would be the case, for example, if a visitor to our premises were injured and their name, age, health insurance or other vital information would have to be passed on to a doctor, hospital or other third party. The processing would then be based upon Art. 6 I (d) of the GDPR. Eventually processing operations could be based upon Art. 6 I (f) of the GDPR. This legal basis rests upon processing operations which are not covered by any of the above mentioned legal bases if the processing is necessary to safeguard the legitimate interests of our company or of a third party, provided that the interests, basic rights and basic freedoms of the data owner do not prevail. Such processing operations are permitted to us especially because they have been specifically mentioned by the European regulatory authorities. In that regard, it is considered that a legitimate interest could be assumed if the data owner is a customer of the data controller (grounds for consideration 47 sentence 2 of the GDPR).
12. Authorised interests in the processing which are being pursued by the data controller or a third party
If the processing of personal data is based upon Article 6 I (f) of the GDPR, our legitimate interest is accordingly the execution of our business activities in all its forms.
13. Duration for which personal data is stored
The criterion for the duration of the storage of personal data is the respective statutory retention period. After the deadline has expired, the corresponding data will be routinely deleted, if it is no longer required to fulfil or to initiate a contract.
14. Statutory or contractual provisions for the provision of personal data; necessity for the conclusion of the contract; obligation of the data owner to provide the personal data; possible consequences of non-provision
We wish to clarify for you the fact that the provision of personal information is in part required by law (such as tax regulations) or may result from contractual arrangements (such as data regarding the contract partner). Occasionally it may be necessary that, for a contract to be concluded, a data owner provides us with personal data which must subsequently be processed by us. For example, the data owner is required to provide us with personal information when our company enters into a contract with them. Failure to provide the personal data would mean that the contract with the data owner could not be concluded.
Before any provision of the personal data by the data owner, the data owner may contact our data protection officer. Our data protection officer will then inform the individual on a case-by-case basis whether the provision of the personal data is required by law or by contract, or is required for the conclusion of the contract, whether there is an obligation to provide the personal data, and which consequences the non-provision of personal data would have.
15. Involvement of YouTube
16. Requests for an offer function
On the product detail pages, you have the option of requesting an individual offer for certain larger purchase quantities. The data entered by you is used only to check and, if necessary, to calculate an individual offer, as well as to establish contact and provide the offer through our offer management.
17. Transfer of personal data to third parties
For the processing of your order it is sometimes necessary to transfer your personal data to third parties (e.g. suppliers or forwarding agents). The data disclosed to third parties will be used by them exclusively for the fulfilment of the obligations or duties incumbent upon them. Transfers to state institutions or authorities are carried out only in accordance with mandatory national legislation.
Protecting the privacy of children is an important issue. For this reason, we do not collect, process and use any information on our website regarding any persons we know to be under the age of 13, without having obtained the verifiable consent of a legal representative. Upon request, the legal representatives may view the information provided by their child or request that it be deleted.