Data protection information

Scope of application

This data protection notice applies in full to LACOS GmbH and LACOS AgSystems GmbH, hereinafter jointly referred to as 'LACOS'.

LACOS GmbH is the operator of this website.

With this data protection notice, LACOS informs you on what basis and for what purposes personal data that we collect from you or that you provide to us is processed. We would also like to inform you about your data protection rights, including your right to object to individual processing operations carried out by LACOS.

Supplementary data protection notices apply to certain categories of data processing. You will find some of them linked below.

We may also provide additional information at the relevant points about certain data processing to the extent that appears necessary, e.g. for certain forms. Please contact us if you have any questions, comments or concerns regarding this statement or our processing of your personal data.

1 General data protection notice

1.1 Who is responsible for data processing and who can I contact?

Responsible within the meaning of the General Data Protection Regulation (GDPR) is

LACOS GmbH
Industriestraße 9
07937 Zeulenroda-Triebes

Phone +49 36628.6 88-0
Fax +49 36628.6 88-17
E-mail info@lacos.de

LACOS AgSystems GmbH
Am Grarock 19
33154 Salzkotten

Phone +49 5258.938 38-0
E-mail agsystems@lacos.de

You can reach our company data protection officer using the above contact details or by e-mail: datenschutz@lacos.de

1.2 What data do we collect?

We typically process the following categories of personal data, among others:

Master data: Name, address
Contact data: e.g. telephone number, e-mail address, any company affiliations
Contact preferences: e.g. preferred contact medium, advertising messages received
Requests: e.g. offers, enquiries, expressions of interest, feedback
Customer data: e.g. correspondence, contracts, services, orders, joint appointments
Product information: such as your product ID, start and end of the subscription and your purchase date and, if applicable, assigned dealer
Financial and payment data: e.g. bank account number, invoice address, payments received
Application data: e.g. CV, certificates, cover letter, previous activities and positions in other organisations, education, professional qualifications, reference contact information, position preferences, salary expectations, interests and wishes, gender, marital status, age, information from publicly available sources, such as professional social media networks
any other information that you provide to us and, where applicable, sensitive data such as origin, religion, health data and degree of disability, criminal convictions, sanctions from regulatory or professional organisations
Device data: e.g. information about the devices you use to visit our websites, such as the operating system used, browser type, language setting, IP address.

1.3 For what purposes do we collect, use and store this personal data?

We collect, use, store and process your personal data:

1.3.1 if you have given us your consent (Art. 6 para. 1 lit. a GDPR)

to receive a newsletter or information about LACOS offers, by post, telephone, messenger or e-mail,
If you give your consent to receive direct advertising, we always offer you the opportunity to revoke your consent or, for example, to unsubscribe directly in the newsletter.

1.3.2 if necessary, for the fulfilment of contractual obligations and pre-contractual measures (Art. 6 para. 1 lit. b GDPR)

Processing of your enquiries and related requests Contacting LACOS, for example for certain contractual offers,
to decide on the establishment of an employment relationship for job applications (the legal basis for this is Section 26 (1) BDSG). In particular, we process the data that you have sent us in connection with your application in order to check your suitability for the position (or any other open positions in our companies) and to carry out the application process,
for example, to fulfil a purchase or service contract and invoicing, or to contact you for these purposes by post, telephone, e-mail, messenger service.

1.3.3 insofar as the legitimate interests of us or third parties require it and no interests of data subjects worthy of protection prevail and you have not objected to the use (Art. 6 para. 1 lit. f GDPR)

for the purposes of maintaining, servicing and improving our IT systems and services, data protection control and data backup,
to respond to other enquiries and complaints,
for internal administrative purposes,
for the purposes of documentation and reporting by photographing or filming events that we attend or organise and, if applicable, publishing the recordings on our website,
to detect, prevent or otherwise combat fraud, security flaws or technical problems,
to provide law enforcement authorities with the information necessary for prosecution in the event of suspicion of a criminal offence,
to protect and safeguard our legitimate business interests, terms and conditions and legal rights and obligations. This includes, but is not limited to, the use of any personal data in connection with compliance, regulatory, audit and legal claims (including the disclosure of such information in connection with legal proceedings or litigation),
for direct advertising outside the existence of consent to the extent permitted by law. In connection with the sale of a service to you or your company, we may process your postal contact details without your specific consent in order to occasionally send you information about new offers (direct advertising). Under the legal requirements of Section 7 (3) UWG, we are also authorised to use your email address, which you provided when purchasing a service, for direct advertising for our own similar goods or services. Please note the objection options under 1.7.1.1.

1.3.4 to the extent necessary to fulfil a legal obligation (Art. 6 para. 1 lit. c GDPR)

for example, for visitor registration in accordance with current coronavirus regulations,
or to store the data collected for contract processing until the expiry of the statutory retention periods.

1.4 Who receives your data?

1.4.1 Transfers to companies that provide services for us as processors

Your personal data will be disclosed to companies that provide services on our behalf in accordance with our instructions. In particular, these are companies in the categories of IT services, including website hosters, (cloud) software providers, including Microsoft Corp, Google LLC, Atlassian Ltd, data destruction, recruiting, printing and lettershop services.

If you communicate with us by e-mail, these are processed on cloud-based servers of our e-mail service provider Microsoft Corp.

We use so-called standard contractual clauses on data protection, which have been approved by the European Commission.

These standard contractual clauses are intended to guarantee data subjects affected by processing in unsafe third countries an adequate level of data protection, in particular legally binding and enforceable rights. For more information, including to request a copy of the documents used to protect your data, please contact us.

1.4.2 Transfers to third parties

We will pass on your data to third parties if we are legally obliged to disclose your personal data or if we consider this necessary to protect the rights, property or security of us, our customers or third parties.

Transmissions to authorities and/or law enforcement agencies are made to the extent required by law or if it is necessary to protect our legitimate interests in accordance with applicable laws.

We will inform you separately about these transfers to third parties in accordance with Art. 13 - 14 GDPR, for example in the context of consent given to us.

1.5 Do I have an obligation to provide data?

As part of our business relationship, you must provide the personal data that is necessary for the initiation, execution and fulfilment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or will no longer be able to fulfil an existing contract and may have to terminate it.

1.6 How long do we store your data?

We only process and store personal data of data subjects for as long as the purpose pursued requires it or is required by law. For example, retention periods under commercial and tax law may prevent deletion. The retention and documentation periods specified there are up to ten years. If the storage purpose no longer applies or if a legally prescribed storage period expires, the personal data is routinely deleted in accordance with the statutory provisions, unless it is used as evidence.

We process applicant data for the duration of the application process. If your application is unsuccessful, we will store applicant data after notification of the rejection decision for as long as we need the data to clarify enquiries or disputes. As a rule, we delete your application data no later than 5 months after the end of the application process. If you have expressly agreed that we should also consider your application for future job advertisements, your data may also be stored for a correspondingly longer period.

1.7 What data protection rights do you have?

Every person affected by our personal data processing has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right to information and the right to erasure. In addition, you have the right to lodge a complaint with the supervisory authority for data protection, e.g. the data protection authority responsible for your place of residence, your workplace or the location of the data protection breach.

If you have any questions about this data protection notice or would like to contact us for any other reason relating to the processing of personal data, please contact us using the contact details provided at the beginning.

1.7.1 Information about your right to object in accordance with Article 21 GDPR

1.7.1.1 Individual right of objection

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR (data processing on the basis of a legal obligation or balancing of interests); this also applies, where applicable, to profiling based on this provision within the meaning of Article 4(4) GDPR.

In individual cases, we also process your personal data for direct marketing purposes. You also have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes. In the case of direct advertising by e-mail, you can revoke your consent to receive it at any time without incurring any costs other than the transmission costs according to the basic rates. A notification in text form to the aforementioned contact details (e.g. e-mail, fax, letter) is sufficient for this purpose.

1.7.1.2 Revocation of consents granted

You can revoke any consent you have given us at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

1.8 Updates to this data protection notice

This data protection notice may be updated regularly. We will update the date at the top of this website accordingly and recommend that you check it for changes.

2 Supplementary data protection notice for users of our websites

This separate data protection notice applies to users of the LACOS websites www.lacos.eu and www.lacos.de and supplements the above general data protection notice of LACOS.

2.1 What additional data is collected, processed and shared when you use this website?

2.1.1 Collection of usage and device data and processing in log files

We collect data about every access to the server on which the website is located (so-called server log files) on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) in the detection and elimination of faults, ensuring the correct delivery of the website, system security and the detection and tracking of unauthorised access or access attempts. The access data includes the address of the website accessed, file, date and time of access, amount of data transferred, URL, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum period of 7 days and then deleted. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

2.1.2 Collection of usage and device data via cookies

When you visit our website, it can retrieve information from your browser and process it using cookies, JavaScript or pixels (hereinafter collectively referred to as "cookies"). This may be information about you or your device. This enables us to distinguish your web browser from those of other users of our website, learn more about your product interests and provide or optimise functions accordingly.

Cookies enable the provision of basic functions and services, e.g. registered users do not have to log in every time they visit a page.

2.1.2.1 Consent management service

We use a consent management tool (also known as a consent management service) that informs you about further consent-based data processing, registers your consent in this regard and stores it on your end device using cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR, the legal obligation.

Further information on data processing, including the purpose, legal basis, recipients and storage period, can be found below. This applies in particular to our optional marketing and analysis services for which we request your consent.

Irrespective of this, you can use the settings in your browser to determine whether cookies should be set and retrieved. For example, you can completely deactivate the storage of cookies in your browser, restrict it to certain websites or configure your browser so that it automatically notifies you as soon as a cookie is to be set and asks you for feedback.

The following information on the cookies used supplements the information in the consent management service,

2.1.2.2 Session cookies

We currently use technically necessary session cookies on the basis of Art. 6 para. 1 lit.f GDPR, our legitimate interest, necessary functions. Session cookies are deleted when you have finished using our online offer and log out or close the browser, for example. On the other hand, some cookies or information remain stored in the so-called localStorage of the browser for a predefined period of time in order to use the information stored therein for repeated visits.

2.1.2.3 Google Analytics

The web analysis service "Google Analytics" from Google Ireland Ltd. is also used with your consent. Google Analytics uses cookies, among other things, to enable us to analyse the use of our websites by users under a pseudonym. The information collected about your use of this website (including your IP address) is transmitted to a Google server in the USA and stored there. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to other recipients if this is legally required or if recipients process this data on behalf of Google. Google may associate this information with other data about you that Google has.

The Google Analytics function only becomes active with your consent.

2.1.2.4 Visableleads.com

We use a business intelligence solution from Visable GmbH (www.visable.com) for analysis and marketing purposes. Pseudonymised user profiles are created using pixel-code technology and cookies, insofar as the system can establish the affiliation to a company based on the user's IP address. The data collected, which may initially still contain personal data, is collected directly by Visable on our behalf and used there to create the above-mentioned data. user profiles are used. Visitors to this website are not directly identified and no other personal data is merged with the user profiles. If IP addresses cannot be assigned to a company, the aggregated usage data will be deleted immediately. Insofar as a company reference could be established, Visable allows us to infer a possible interest in certain LACOS products or services.

The Visable function only becomes active with your consent.

2.1.3 Data processing with the use of our contact form

If you send us enquiries via the contact form, the information and contact details you provide will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We do not pass this data on to third parties without your consent.

We also process your data in our customer relationship management systems (CRM).

This data is processed within the framework of the legal bases listed in sections 1.3.2-1.3.4.

The data you enter in the contact form will be processed until you ask us to delete it and there are no legitimate interests to the contrary, or the purpose for data storage no longer applies (e.g. after your enquiry has been processed) or legal obligations provide for further storage.

2.1.4 Integration of third-party services and content

We use content or service offers from third-party providers on our website on the basis of your consent. In particular, we have embedded videos on Youtube.com (hereinafter also referred to as "content").

Click on the video tiles to call up the videos. In this respect, you consent to the associated data processing, including the third-party provider Google Ireland Ltd. becoming aware of your IP address as the recipient of this content, the specific address of the page accessed on our site, the video, system date and time of access, and your browser identifier.

Without this data, the content cannot be transferred to your browser. The IP address is required to display this content.

Our website has integrated YouTube videos in the so-called extended data protection mode. In extended data protection mode, YouTube guarantees that it will not store any cookies with personal data on your end device. In particular, that there is no connection to the DoubleClick ad network when the video is called up.

Simply clicking on an embedded YouTube video can trigger further processing operations over which we, as the operator of this website, have no influence.

Please note that data may also be transferred to the USA, in particular by Google. With your consent, you also agree to such transmissions in accordance with Art. 49 para. 1 sentence 1 lit. a GDPR. In particular, there is a risk that your personal data may be processed by US authorities for control and monitoring purposes, possibly without the possibility of legal recourse.

Please note the Google privacy policy for YouTube.

2.2 Links to third-party websites

Our website may contain links to third parties. LACOS accepts no responsibility for the content of websites linked to its website. If you visit a third party website, it is your responsibility to ensure that you read the privacy policy and terms and conditions that apply to that website.

3 Supplementary data protection notice for the use of our video conferences

This separate data protection notice applies to users who use our video conferencing systems together with us. This supplements the above general data protection notice of LACOS.

We use various video conferencing tools for communication. Data processing takes place as part of your participation in a video conference or online event.

3.1 What additional data is collected, processed and shared when you use our video conferencing software?

3.1.1 Processing of content, usage and device data

In addition to image and sound, the following data is typically processed: Name and IP address of the participant, name of the room, data on the end device used. In addition, depending on usage, content may be generated from shared screens, chats, whiteboard posts or statuses. Where applicable, telephone dialling-in data can be processed: All voice communication and traffic data (telephone number, dialling-in number, PIN, call duration). In the event of technical errors, the error ID and the affected device data are also saved.

The online events are typically not recorded.

During such a video conference, all participants can see, read and hear data from screen shares, chats, videos, audios and whiteboard contributions.

By participating in video conferences and activating your device camera, you consent to the processing of your data.

Please note that Microsoft Corp. may also transfer your data to the USA.

3.2 Who receives your data?

3.2.1 Transfers to companies that provide services for us as processors

Your personal data will be passed on to companies that provide video conferencing systems on our behalf in accordance with our instructions. The provider of our video conferencing system Microsoft Corp. provides us with Microsoft Teams.

3.2.2 Transfers to third countries

If you use our video conferencing services together with us, certain connection data will be processed on cloud-based servers of the US service providers.

The transfer of personal data to so-called unsafe third countries outside the EEA cannot be ruled out. Such third countries do not have a level of data protection comparable to that of the EU.

We have therefore provided suitable guarantees with the aforementioned providers by means of standard contractual clauses issued by the EU Commission, which provide you with enforceable rights and effective legal remedies. We also endeavour to enable you to use such software in a data-saving manner (e.g. participation in a video conference without registering your e-mail address in MS Teams).

4 Supplementary data protection notice for users of our LACOS telematics package (lc-fleetnav-web.lacos.de)

This data protection notice provides information about the processing of personal data when our telematics package is used by subscribers or users of our telemetry portal. Data processing is generally carried out within the framework of order processing for our customers in accordance with Art. 28 GDPR.

4.1 What data do we process for what purposes and on what legal basis?

LACOS offers certain services as a subscription with its telematics package.

The corresponding connected components of the LC:TRACKER and LC:ONE product group collect telemetry data and transmit it to LACOS telemetry portal LC:FLEETNAV-web. The telemetry data can be assigned to individual vehicles or machines or their usage and analysed by the respective customer and their users.

For each tracker / display, GPS data and any other sensor or operating data are collected and transmitted to the LACOS server via radio-based data transmission and logged there.

Notifications about certain status changes or defined deadlines can also be sent by SMS or e-mail to stored users.

The following personal data ("telemetry data") may be processed to fulfil the subscription:

Master, contact and customer data or inventory data
Product information and usage data
Company data: e.g. company name, location, contact details for notification
Vehicle or machine information: e.g. make, model or type, working width, stored maintenance interval data
GPS-based working time data: e.g. parking, transport, field and standing times and, if applicable, distance travelled, mapped tracks, location data for each vehicle or machine
GPS-based field data: e.g. uploaded fields of the customer as GPS polygons, field designation, area size, mapping of fields in map, other assigned properties, defined geofence areas for certain vehicles or machines
User profile data: e.g. user name, name and e-mail address of the created user and assigned role
Telemetry device data: e.g. serial number, eSIM number, assigned machine type, signal strength and status data of the telemetry unit, LC:TRACKER configuration or modes

LACOS may use the telemetry data collected and provided in LC:FLEETNAV for its own purposes for research and analysis purposes within the scope of the legitimate interest Art. 6 para. 1 lit. f GDPR in order to improve LACOS products and services and to develop new functions. Where possible, the telemetry data is pseudonymised or anonymised for these statistical evaluations.

As part of the provision of the LACOS telematics package, LACOS processes inventory data for the calculation of fees for the Internet connection of the trackers (Art. 6 para. 1 lit. f GDPR).

4.2 Recipients of this data

The Openstreetmaps service is used to map the telemetry data. The IP address and GPS coordinate logs are transmitted to display the geolocalisation data on a map.

Further information on data protection at the OSM Foundation can be found here:
https://wiki.osmfoundation.org/wiki/Privacy_Policy#Third_party_provided_services_and_data

Traffic data is processed by the telecommunications service provider in connection with the provision of the tracker's internet connection.

4.3 How long do we store your data?

We process your data for the duration of the contract.

If you (i) cancel your subscription, (ii) deregister all of your tracked vehicles or machines, or (iii) we terminate your account for breach of the Terms, we will delete or anonymise your telemetry data shortly thereafter.

We anonymise telemetry data for our own purposes on a rolling basis 90 days after collection in each case.

We retain the data required for contract processing and, in particular, billing until the expiry of the periods stipulated by law in accordance with commercial and tax law within the meaning of Art. 17 para. 3 lit. b GDPR. For this period (usually ten years from the conclusion of the contract), the data is processed again solely in the event of a review by the tax authorities.

This also extends to e-mails that were used as commercial or business letters for the initiation, conclusion, execution or cancellation of a commercial transaction and must be kept for six years.

5 Supplementary data protection notice for users of our LACOS track planner (LC:FIELDPLANNER)

This data protection notice provides information about the processing of personal data when our track planner is used by subscribers or users of our LC:FIELDPLANNER. This supplements the general data protection notice of LACOS.

5.1 What data do we process for what purposes and on what legal basis?

LACOS offers certain services as a subscription with its LC:FIELDPLANNER.

We also process personal data, including the following, in order to carry out a track calculation:

Master, contact and customer data
Product information and usage data
Company data: e.g. company name, location, contact details for notification
Vehicle or machine information: e.g. designation, type, working width, geometry, turning radius
GPS-based field data: e.g. uploaded fields of the customer as GPS polygons, field designation, area size, mapping of the fields in the map, field access roads, other assigned properties, defined geofence areas for certain vehicles or machines
User profile data: e.g. user name, name and e-mail address of the created user and assigned role

LACOS may use the data collected and provided in the LC:FIELDPLANNER for its own purposes for research and analysis purposes within the scope of the legitimate interest Art. 6 para. 1 lit. f GDPR in order to improve LACOS products and services and to develop new functions. Where possible, the plans are pseudonymised or anonymised for these statistical evaluations.

5.2 Recipients of this data

The Openstreetmaps, GoogleMaps and HereMaps services are used to map the fields and the plans. The IP address is transmitted to the external service providers to display the geolocalisation data on a map.

In the case of GoogleMaps, the processing of personal data in the so-called third country USA, i.e. outside the EEA, cannot be ruled out.

The EU Commission recognised the level of data protection for certain companies from the USA (as part of the so-called EU-US Data Privacy Framework) as appropriate in its decision on 10.07.2023 in accordance with Art. 45 GDPR. Google Corp. has also been certified under the so-called EU-US Data Privacy Framework.

By using GoogleMaps, you as a user enter into a direct user relationship with the service providers.

Further information on the data protection of service providers can be found here:

OSM-Foundation wiki.osmfoundation.org/wiki/Privacy_Policy
Google LLC https://policies.google.com/privacy?hl=de
HERE Global B.V https://legal.here.com/en-gb/privacy

5.3 How long do we store your data?

We process your data for the duration of the contract.

If you (i) cancel your subscription or (ii) we terminate your account for breach of the Terms, we will delete or anonymise your shortly thereafter.

This does not include the data required for contract processing and, in particular, billing, which we retain until the expiry of the periods stipulated by law in accordance with commercial and tax law within the meaning of Art. 17 para. 3 lit. b GDPR. For this period (usually ten years from the end of the contract), the data is processed again solely in the event of a review by the tax authorities.

This also applies to e-mails that were used as commercial or business letters for the initiation, conclusion, execution or cancellation of a commercial transaction and must be kept for six years.

6 Supplementary data protection notice for our online shop customers

This data protection notice supplements the above General Data Protection Notice and applies to customers of our online shop.

6.1 What data do we process from customers of our online shop?

6.1.1 Data processing with the creation of a mandatory customer account

Registration and use of a customer account is required to use our online shop. This enables us to legitimise the customer as an entrepreneur, as our offer is aimed exclusively at entrepreneurs.

To set up a customer account, a self-chosen password must be entered, together with an e-mail address to access the customer account. Personal access data must be treated confidentially and in particular must not be made accessible to unauthorised third parties. We cannot accept any liability for misused passwords unless we are responsible for the misuse. The legal basis for the data processing associated with the customer account, insofar as personal data is stored, is Art. 6 para. 1 lit. b GDPR.

6.1.2 Data processing upon conclusion of a contract

When using our online shop, we process the data required for the conclusion, execution or termination of a contract. These include in particular

Master data (e.g. name, addresses, telephone number, e-mail address)
Contact details (e.g. telephone number, e-mail address, company affiliation)
Customer account data (e.g. customer number, user name, password (hashed))
Customer data: (e.g. correspondence, contracts, services, orders, archived correspondence)
Product data: (e.g. product ID and your purchase date)
Payment data (e.g. order total, payments received, receivables)
Product data (e.g. data on purchased products and deliveries)

The legal basis for this is Art. 6 para. 1 lit. b GDPR, i.e. we need this data to fulfil contractual obligations. We are also obliged to process your e-mail address due to a requirement in the German Civil Code (BGB) to send an electronic order confirmation (Art. 6 para. 1 lit. c GDPR).

If we do not use your contact data for advertising purposes, we store the data collected for contract processing until the expiry of any contractual warranty rights. After expiry of this period, we shall retain the information on the contractual relationship required under commercial and tax law for the periods specified by law. For this period (usually ten years from the conclusion of the contract), the data is processed again solely in the event of a review by the tax authorities.

The following data processing is also required to process the purchase contract:

If you have selected the payment method PayPal, we will forward the required payment data to the payment service provider you have selected. We pass on details of your delivery address to a logistics company commissioned by us for the purpose of processing the purchase contract.

We use an external IT service provider (recipient) to operate the web shop.

6.2 Data processing after conclusion of the contract

If you have concluded a contract with us, we will treat you as an existing customer. Under the legal requirements of Section 7 (3) UWG and, if applicable, in conjunction with Art. Art. 6 para. 1 lit. f GDPR, we are authorised to use the email address you provided when placing a binding order for a product or service for direct advertising for our own similar goods or services.

6.3 How long do we store your data?

We process and store any personal data collected within the scope of the statutory retention periods and our legitimate interest for internal administrative purposes for a maximum period of 10 years.

7 Supplementary data protection notice for users of the LACOS fan page on Facebook.com (www.facebook.com/lacosgmbh)

This data protection notice applies to users of the LACOS fan page at www.facebook.com/lacosgmbh/ and supplements the above General Data Protection Notice.

7.1 Who is responsible for data processing and who can I contact?

We are jointly responsible with Facebook Ireland Ltd. for the collection (but not the further processing) of data of visitors to our Facebook page (so-called "fan page"). This data includes information about the types of content users view or interact with, or the actions they take (see under "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see under "Device information"). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, known as "Page Insights", for page operators to help them understand how people interact with their pages and the content associated with them. We have concluded a special agreement with Facebook ("Information on Page Insights", www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfil the rights of data subjects (i.e. users of our fan page can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information on Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data).

Jointly responsible within the meaning of Art. 26 General Data Protection Regulation (GDPR) are the following controllers.

Operator of the Facebook platform:
Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2 Ireland

You can contact the company data protection officer of Meta Plattform Ireland Ltd. via this form.

Editorially responsible for this fan page on Facebook is:
LACOS GmbH
Precision in Software

Industriestraße 9
07937 Zeulenroda-Triebes

7.2 What data do we process?

7.2.1 Data that you provide to us for general enquiries via the message form

For messages sent to us, we process your Facebook user name and all other information that you provide when using the message form on the fan page or that we take from your public profile. We process your enquiry or contributions in order to process and, if necessary, respond to them. This includes, for example, information that you provide when you contact us:

submit an enquiry about a specific service;
ask a question or give us feedback.

This processing is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to be able to contact you in response to your enquiries or contributions, as well as to assert legal claims and defence in legal disputes, support the authorities in the prosecution of criminal offences, provide you with information about our services (direct marketing) that you request from us as our customer or that we believe may be of interest to you, insofar as this is permitted by law.

7.2.2 Statistical data that we analyse

If you interact with our fan page or our content on Facebook, the operator of the Facebook platform collects usage data. We do not have direct access to this usage data, but we do have access to statistical information based on it.

We use the Insights analysis service of the operator of the Facebook platform in order to

page statistics, including how many users we reached with which posts, how many reacted to them and how our fan page is interacted with;
Gain insight into the demographic characteristics of the target group we reach;
measure the effectiveness and distribution of our adverts on Facebook.

This processing is also based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR to recognise acceptance and usage preferences (e.g. number of followers, number of views of individual page areas, user statistics by age, geography and language) and to be able to improve and align the offer on our fan page as closely as possible to the target group.

7.2.3 Data that Facebook collects when you visit this website

When you visit our fan page, the operator of the Facebook platform, as the other responsible party, collects various directly personal information about you and your device and processes it for various purposes, including Facebook's own purposes.

Facebook Ireland Limited ("Facebook") is responsible for the collection and further processing of personal user data on Facebook websites. Please note that Facebook collects and processes certain information about your visit to our fan page even if you do not have a Facebook user account or are not logged in to Facebook.

For information on the processing of personal data by Facebook, please refer to Facebook's data policy (Privacy Policy) https://www.facebook.com/privacy/explanation

If you "share" one of our posts, "comment", mark with "Like" or "reply" to our comments, data processing takes place which can be assigned to you or the platform operator Facebook. We are not responsible for this data processing within the meaning of Art. 4 No. 7 GDPR.

We are not obliged to check the contributions, comments or content uploaded, posted or sent in by users. However, LACOS GmbH reserves the right to immediately reject, block or remove any contributions, comments or content from blogs and forums - insofar as these are publicly accessible on the fan page - without prior notice as soon as it becomes aware of their illegality.

7.2.4 Where do we store your personal data?

When using this fan page, data is also transferred to countries outside the European Economic Area ("EEA"). There is no adequacy decision by the EU Commission for these countries, as there are no data protection provisions comparable to those of the EU (so-called third countries).
Please refer to further information in Facebook's privacy policy regarding additional legal bases for this third country transfer.

7.3 Your rights as a data subject

Every person affected by our personal data processing has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right to information and the right to erasure. In addition, there is a right of appeal to a data protection supervisory authority in accordance with Article 77 GDPR in conjunction with Section 19 BDSG.

These rights can be exercised vis-à-vis both of the aforementioned responsible bodies.

If you would like to exercise your rights against Facebook, please follow Facebook's instructions: https://www.facebook.com/privacy/explanation

Perception of objection or revocation of granted consent

Your objection can be made informally and can also be addressed to us by telephone.

Meta Platforms Ireland Limited ("Facebook") is responsible for the collection and further processing of personal user data on Facebook websites.

8 Supplementary data protection notice for business partners of LACOS

This data protection notice applies to suppliers of LACOS GmbH and customers of our system house services and supplements the above General Data Protection Notice.

We hereby inform you about the processing of your personal data in connection with your employer's contractual relationship with us, or with regard to our joint contractual relationship, should you be our direct contractual partner, e.g. as a sole trader.

8.1 What data do we process, for what purposes and on what legal basis?

8.1.1 Processing of your data due to contractual obligations or pre-contractual measures (Art. 6 para. 1 lit. b GDPR)

We process your data in order to conclude, execute or terminate a contract with you or your employer. These data are in particular

Your name,
Your business address,
Your business contact details such as telephone number and e-mail address as well as correspondence and contractual agreements with us,
Performance metrics of our suppliers: e.g. information that enables us to assess the performance of the supplier, including the supplier's personnel,
Support enquiries from customers of our system house services, but also offers for related products.

If we have not received the aforementioned data from you, it comes from publicly accessible sources. We will neither sell your personal data to third parties nor market it in any other way.

8.1.2 Processing of your data based on a balancing of interests (Art. 6 para. 1 lit. f GDPR), insofar as your interests worthy of protection do not outweigh our legitimate business interests

If you yourself are our contractual partner, we will carry out a prequalification procedure under certain conditions when establishing contractual relationships. In doing so, we determine whether we are authorised to enter into a business relationship with you, taking into account the provisions of the Money Laundering Act and the EU sanctions lists in accordance with EU Regulations 2580/2001 and 881/2002.

In addition, we process your data to protect our legitimate interests or those of third parties, for or in order to

Protecting our legitimate business interests and legal rights. This includes, but is not limited to, use in connection with legal claims, regulatory, audit, investigative purposes (including disclosure of such information in connection with litigation, insurance claims, or legal disputes) and compliance reporting obligations
Transmission of supplier data to our business partners as part of the preparation of offers and compliance checks of third parties
Business management
Providing you with information about our products, services, offers or technical developments (direct marketing) that you request from us as our business partner or that we believe may be of interest to you, to the extent permitted by law
if you have indicated a preference in relation to marketing communications, or to process follow-up requests to improve our service,
or other correspondence.

8.2 Who receives your data?

We pass on your data to third parties if we are legally obliged to disclose your personal data or if we consider this necessary to protect the rights, property or security of us, our customers or third parties or if we have a legitimate interest.

Recipients can be:

Public bodies and institutions (e.g. tax authorities, law enforcement authorities) in the event of a legal or official obligation
Creditors or insolvency administrators who make enquiries in the context of enforcement proceedings
Auditor
Service providers that we use in the context of order processing relationships,
Suppliers to whom we disclose data about our other suppliers or distribution partners as part of standards reviews, sanctions list reviews and certifications
other business partners.

If you contact us via forms on our social media presences on Facebook, but also via our contact form, we process your data in our customer management systems (CRM) or ticket system (Jira). The provider of the Jira software, Atlassian Ltd., cannot rule out the processing of personal data in so-called unsafe third countries outside the EEA. Such third countries do not have a level of data protection comparable to that of the EU.

With the aforementioned provider, we have therefore provided suitable guarantees by means of standard contractual clauses issued by the EU Commission, which provide you with enforceable rights and effective legal remedies.

8.3 Do I have an obligation to provide data?

8.4 How long do we store your data?

We only process and store personal data of data subjects for as long as the purpose pursued requires it or is required by law.

In addition to the retention periods under commercial and tax law, we process contact data of our business partners' contact persons, corresponding business and communication processes for the duration of our business relationship. After the end of the collaboration, we retain the data for up to 15 years for internal administrative purposes, for example to be able to follow up on a previous collaboration.