Privacy Policy

 

We hereby inform you about the processing of your personal data (“data“) when you visit our websites (A.) or are in business contact with us (B.). Under (C.) we inform you about your rights, which you are entitled to in all aforementioned cases of data processing by us.

The DL Hudson group company that is responsible for your data processing (i.e. the “Controller”) will be the relevant group company you are dealing with, or whose website you are visiting. Details are as follows:

CountryController DetailsWebsite controlledEmail contact
UK

DL Hudson Limited

120 New Cavendish Street

London W1W 6XX

England, UK

https://dl-hudson.com/info@dl-hudson.com
Germany

DL Hudson Germany GmbH

Ludwig-Erhard-Allee 10

76131 Karlsruhe

Germany

https://www.dl-hudson.de/info@dl-hudson.com
ItalyDLH Petroli Italiahttps://www.dlh-petroli.com/info@dl-hudson.com

 

 

In this Privacy Policy, “GDPR” means General Data Protection Regulation (EU) 2016/679 under EU law,
and the same as it forms part of UK domestic law by virtue of the European Union (Withdrawal) Act
2018, with adjustments as provided in the Data Protection, Privacy and Electronic Communications
(Amendments etc.) (EU Exit) Regulations 2019.

 

A. Data processing on our websites
In this section we inform you about the processing of your data when you visit our websites.

I. Use of our websites Scope of data processing
When you call up our websites, the following data is transferred to our web server and stored in a
log file:
• IP address
• date and time of the respective access to a page of the website
• amount of data transferred to your device
• files accessed via the homepage
• URL of the page/homepage from which you reached our website
• the browser you use (type and version)
• the operating system you use (type and version)

Purposes of data processing

The processing of this data is necessary to display the contents of the website on your device in
the best possible way. We also process this data to investigate and track attacks on our IT.
Legal basis of data processing
This data is processed in accordance with Art. 6 para. 1 letter f GDPR due to our legitimate
interest in being able to show you the website and track attacks on our IT.
Recipient of the data
Only those persons have access to your data who need it for the purposes described above.
Storage duration
The log data is stored for a period of 7 days and then deleted, unless it is exceptionally
necessary to keep it longer to follow up an identified attack.

II. Use of cookies

When you visit our websites, so-called cookies are placed by us. These are small text files that
are stored on your terminal device. Cookies usually contain a characteristic sequence of
characters, the so-called cookie ID, with which your browser can be identified when you visit our
websites again.
The cookies of our websites contain personal data. Cookies save you from having to enter data
multiple times, facilitate the transmission of specific content and help us identify
particularly popular areas of our websites. They thus enable us to continuously improve the
structure and content of our internet presence.
For web statistics, we work with permanent cookies that allow identification even beyond the
browser session.
In the following, the data processing when using cookies is described in more detail.
1. Functional cookies
Functional cookies may be used on our websites, these cookies store e.g. your language selection.
Purpose and legal basis of data processing
Your personal data is processed for the purpose of user-friendliness on the basis of a
legitimate interest pursuant to Art. 6 para. 1 letter f GDPR.
Recipient of the data
Your data will only be processed internally and for the above-mentioned purposes.
Storage duration
The functional cookies are deleted as soon as you close the browser (session cookie).

2. Analysis cookies (statistics)

Google Analytics
Scope of data processing

 In order to tailor our websites to your needs and to optimise it on an ongoing basis, we use Google
Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow St
Dublin 4, Ireland; “Google”). The use includes the “Universal Analytics” mode of operation. This
makes it possible to assign data, sessions and interactions across multiple devices to a
pseudonymous user ID and thus to analyse a user’s activities across devices. Cookies are used for
this purpose. Through them, the following information is transmitted to Google’s servers and
stored:

• Browser type/ version
• Operating system used
• Referrer URL (the previously visited page)
• Host name of the accessing computer (IP address)
• Time of the server request
• IP address

This information is used to evaluate the use of the websites, to compile reports on platform
activities and to provide other services associated with the use of the platform and the internet
for the purposes of market research and the needs-based design of the websites. Under no
circumstances will your IP address be merged with other Google data. The IP addresses are
anonymised so that an assignment is not possible (IP masking).
The following cookies are used for this purpose:
_gat: Persistent third-party cookie for the purpose of throttling the request rate in the context
of tracking with Google Analytics.
_ga: Persistent third-party cookie for the purpose of distinguishing users in the context of
tracking by Google Analytics.
_gid: Persistent third-party cookie for the purpose of distinguishing users in the context of
tracking by Google Analytics.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however
please note that if you do this you may not be able to use the full functionality of our websites.
You can also prevent the collection of data generated by the cookie and related to your use of our
websites (including your IP address) and the processing of this data by Google by downloading and
installing a browser add-on.
Purposes of data processing
The processing of users’ personal data enables us to analyse the surfing behaviour of our users. By
evaluating the data obtained, we are able to compile information about the use of the individual
components of our websites. This helps us to continuously improve our websites and their
user-friendliness.
Legal basis of data processing
The tracking measures listed and used by us are carried out on the basis of the consent given by
you on a voluntary basis in the cookie banner in accordance with Art. 6 para. 1 letter. a GDPR.
You can withdraw your consent at any time and without giving reasons. You can do this via the
contact details provided in this privacy policy or directly via our cookie tool.
Recipient of the data
The data is transferred to Google Ireland Limited, Gordon House, Barrow St Dublin 4, Ireland
and stored there.
Transfer of your data to a third country or international organisation including the guarantees of
processing
The data might be transferred to the USA. In order to ensure sufficient guarantees for the transfer
of data to the USA, standard contractual clauses pursuant to Art. 46 para. 2 letter c GDPR apply.
Storage duration
_gat: The storage duration is one minute.
_ga: The storage duration is two years.
_gid: The storage duration is one day.

3. Disabling of Cookies
You have full control over the use of cookies and can delete cookies in your browser, disable the
storage of cookies altogether, selectively accept certain cookies and, if necessary, set your
browser to notify you if a cookie is to be set. Please use the help functions of your browser to
learn how to change these settings. This may limit the functionality of our websites.
Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox Chrome:
https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl= en-GB
Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
Edge: https://support.microsoft.com/en-gb/windows/delete-and-manage-cookies-
168dab11-0753-043d-7c16-ede5947fc64d
Internet Explorer: https://support.microsoft.com/en-gb/topic/how-to-delete-cookie-
files-in-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc

 

III. Google Maps

Type and scope of data processing
Our websites use Google Places API, a mapping service provided by Google Inc, 1600 Amphitheatre
Parkway, Mountain View, CA 94043 (“Google”), to visualise locations. Using Google Maps on our
websites will require a connection to Google’s server. As a result, Google may also process data
about the use of the Maps functions (including the IP address) by visitors to the website. Further
information can be found in Google’s privacy policy at
https://policies.google.com/privacy?hl=en-GB&gl=de.
Purpose and legal basis of data processing
Your personal data is processed for the visualisation of our locations in accordance with Art. 6
para. 1 letter f GDPR. Our legitimate interest is to make our websites as user-friendly as
possible.
Recipient or categories of recipients
The aforementioned data will be transmitted to Google. Google may transfer the information obtained
through Google Maps to third parties if this is required by law or if companies process this data
on behalf of Google. It cannot be ruled out that Google will associate your IP address with other
data held by Google. It is technically possible that Google could identify at least individual
users on the basis of the data received. We have no influence on the fact that personal data and
personality profiles of users of the website are processed by Google for other purposes.
Transfer of your data to a third country or international organisation including the guarantees of
processing
In order to ensure sufficient guarantees for the transfer of data to the USA, standard contractual
clauses pursuant to Art. 46 para. 2 letter c GDPR apply.
Possibility of objection and removal
If you do not agree with this processing of your data, you have the option to deactivate Google
Maps and in this way prevent the transfer of data to Google. To do this, you must deactivate the
Java Script function in your browser. However, we would like to point out that in this case you
will not be able to use the map display. You also have the right to object to the creation of these
user profiles, in which case you must contact Google to exercise this right.
For more information on the purpose and scope of data collection and processing by
Google, please refer to Google’s privacy policy. There you will also find further information about
your rights in this regard and settings options for protecting your privacy:
https://policies.google.com/privacy?hl=en.

 

IV. Contact form

Scope of data processing
You can contact us via a contact form. In doing so, we collect the following data:
• Name
• E-Mail address
• (optional) Phone number
• (optional) Website
• Message
Purpose of data processing
We process your data for the purpose of being able to answer your inquiry to us in the best
possible way.
Legal basis of data processing
We process your data on the basis of Art. 6 para. 1 letter f GDPR. Our legitimate interest lies in
responding to your inquiry directed to us.
Recipient of the data
The data will only be processed by the contact persons internally responsible for the contact
requests.
Storage duration
The storage duration depends on the content of your contact request. In principle, the data is
deleted as soon as it is no longer required to achieve the purpose for which it was collected
and any statutory retention obligations have expired.

B. Business contacts

Scope of data processing
Within the scope of our business relationship with you as a business partner or employee of
business partners, we process the data that we receive from you or your employer.
In particular, this concerns data that we receive when you or your colleagues have contact with our
employees.
We process the following categories of data in this context:
• professional contact and organisation information: e.g., last name, first name,
title, degree, gender, name of the company you work for, department, professional e-mail address,
postal address, telephone number
• data on professional circumstances: e.g. job title, tasks, activity, qualifications
• other: In addition, we may process other data that you provide in the course of your
interaction with our employees.
Purpose of data processing
Your data will be processed by us for the purpose of establishing and implementing the contractual
relationship with our business partner as well as for fulfilling the legal requirements.
Legal basis of data processing
• If you are our business partner in person, the processing is carried out on the
basis of Art. 6 para. 1 letter b GDPR for the purpose of implementing or initiating a contract.
• For the purpose of fulfilling legal obligations, the processing is carried out on
the basis of Art. 6 para. 1 letter c GDPR in connection with legal and official requirements (e.g.
tax and commercial law).
• If you are an employee of one of our business partners, your data will be processed
on the basis of our overriding legitimate interests in accordance with Art. 6 para. 1 letter f
GDPR. Our legitimate interest lies in the functioning and practicable cooperation with our business
partners and the employees of our business partners.
Recipient of the data
Within our firm, only those persons who need your data for the purposes described have access to
it.
On the basis of contracts in accordance with Art. 28 GDPR, personal data may be processed by
external service providers (e.g. support, hosting or analysis service providers). The external
service providers have been carefully selected and commissioned by us. They are contractually bound
to our instructions, have appropriate technical and organisational measures in place to protect the
rights of the data subjects, and are regularly monitored by us.
As part of our corporate structure, your data may be transferred to DL Hudson Limited, the parent
company of the DL Hudson group. There is a joint controllership among the DL Hudson group companies
with respect to the processing of your data. Therefore, an agreement has been concluded in
accordance with Art. 26 GDPR, which specifies the distribution of obligations within the joint
controllership. Upon request, the essence of this arrangement will be made available to you. You
may exercise your rights as a data subject against each of the controllers.

Transfer of your data to a third country
Your data will generally be processed in the European Union or the European Economic Area or in a
country which has been decided by the EU Commission to have adequate level of protection of
personal data (“Adequate Country”). If we transfer your data to a third country, i.e. outside the
European Union (EU) or the European Economic Area (EEA) or is not an Adequate Country, this will
only be done in accordance with the legal requirements.

Storage duration
Your data will be stored by us for as long as we need it for the specific processing purpose. We
regularly store your data at least for the duration of our business relationship with you or the
business partner for whom you work.
In addition, we store certain data for the duration of statutory limitation periods (usually three
years, in individual cases up to thirty years) and for as long as statutory retention periods (e.g.
from the German Commercial Code, the German Fiscal Code in respect of our German group companies)
require it (but generally for a maximum of ten years).
Under certain circumstances, we may have to keep your data for a longer period of time. This is the
case, for example, if in connection with an official or judicial procedure a ban on data deletion
is ordered for the duration of the procedure.

C. Your rights as a data subject

As a data subject, you have the following rights:

1. Right of access to information
You have the right to obtain free information on request about whether data concerning you are
being processed and, if so, what data we process about you (Art. 15 GDPR). You may re-apply within
a reasonable period of time. You also have the right to receive a copy of your data that is the
subject of our processing.

2. Right of rectification
You may also request the correction of incorrect data concerning you in accordance with Art. 16
GDPR. You also have the right to request the completion of incomplete data concerning
you, taking into account the purposes of the processing.

3. Right of deletion
Under the conditions of Art. 17 GDPR, you can request the deletion of your data.

4. Right to limitation
You have the right to demand that we restrict processing if the requirements of Art. 18 GDPR are
met. This is the case, for example, if the processing of your data is no longer necessary for our
purposes, but you need it to assert, exercise or defend legal claims. If the processing of your
data is restricted, these data – apart from being stored – may only be processed by us with your
consent or in the special cases mentioned in Art. 18 para. 2 GDPR.

5. Right to data portability
Insofar as data provided by you is processed by us on the basis of Art. 6 para. 1 letter b or
letter a GDPR (for contract initiation or fulfilment or on the basis of your consent) by means of
automated procedures, you may, under the conditions of Art. 20 GDPR, request the surrender of this
data in a structured, common and machine-readable format. In this case, you can also request that
we transfer this data to another controller.

6. Right of withdrawal
If we process your data on the basis of your consent, you have the right to withdraw your consent
at any time with effect for the future (Art. 7 para. 3 GDPR).

7. Right of objection
You have the option to object to data processing for direct marketing purposes at any time. In
addition, you can object at any time to data processing based on a legitimate interest if there are
particular grounds for doing so, Art. 21 GDPR.

8. Assertion of your data subject rights
To assert your rights as a data subject, please contact our data protection officer by e- mail or
letter (contact details below).

9. Contact methods
You can exercise your rights by contacting the relevant DL Hudson group company using the details
set out in the table at the top of this Privacy Policy.

10. Right of appeal to a data protection supervisory authority
If you suspect that your personal data are being processed unlawfully by one of our DL Hudson group
companies in the EU, you can lodge a complaint with a data protection supervisory authority, in
particular in the member state where you are resident, your place of work or the place where the
alleged infringement is taking place (Art. 77 GDPR). If you suspect that your personal data are
being processed unlawfully by DL Hudson Limited you can lodge a complaint with the UK Information
Commissioner’s Office.

Date: November 2021