Privacy Policy

The data controller within the meaning of the GDPR is:

BOGE KOMPRESSOREN Otto Boge GmbH & Co. KG

Otto-Boge-Straße 1–7, 33739 Bielefeld, Germany

Telephone: 05206 601-0

Fax: 05206 601-200

Email: datenschutz@boge.de

Representatives of the data controller: Dr Sebastian Göbel, Dr Björn Six

You can contact the Data Protection Officer as follows:

Thomas Otten

Telephone: 05221 87292-08

Fax: 05221 87292-49

Email: datenschutz-boge@audatis.de

You may contact our Data Protection Officer directly at any time with any questions or suggestions regarding data protection.

Your personal data will not be transferred to third parties for purposes other than those listed below.

We will only disclose your personal data to third parties if:

1. you have given us your explicit consent to do so in accordance with Article 6(1)(a) of the GDPR,

2. the disclosure is permitted under Article 6(1)(f) of the GDPR to safeguard our legitimate interests, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data,

3. there is a legal obligation to disclose the data under Article 6(1)(c) of the GDPR, and

4. this is permitted by law and necessary under Article 6(1)(b) of the GDPR for the performance of contractual relationships with you.

As part of the processing operations described in these data protection policies, personal data may be transferred to the USA. Organisations in the USA are deemed to have an adequate level of data protection only if they have obtained certification under the EU-US Data Privacy Framework and the EU Commission’s adequacy decision pursuant to Article 45 of the GDPR therefore applies. We have explicitly stated this in the data protection policies for the service providers concerned. To protect your data in all other cases, we have entered into data processing agreements based on the European Commission’s Standard Contractual Clauses. Where the Standard Contractual Clauses are insufficient to ensure an adequate level of security, your consent pursuant to Article 49(1)(a) of the GDPR may serve as the legal basis for the transfer to non-EU countries. This does not apply, however, to data transfers to non-EU countries for which the European Commission has issued an adequacy decision in accordance with Article 45 of the GDPR.

7. Technology

7.1 SSL/TLS encryption

This website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login details or contact enquiries, which you send to us as the operator. You can recognise an encrypted connection by the fact that the browser’s address bar displays “https://” instead of “http://”, and by the padlock icon in your browser bar.

We use this technology to protect the data you send to us.

7.2 Data collection when visiting the website

When you use our website purely for information purposes – i.e. if you do not register, do not otherwise provide us with information, or do not give your consent to processing operations requiring consent – we collect only those data that are technically essential for the provision of the service. These are typically data that your browser transmits to our server (in so-called server log files). Every time you or an automated system accesses a page on our website, our website collects a range of general data and information. This general data and information is stored in the server’s log files. The following may be collected:

1. browser types and versions used,

2. the operating system used by the accessing system,

3. the website from which an accessing system reaches our website (known as a ‘referrer’),

4. the subpages accessed on our website via an accessing system,

5. the date and time of access to the website,

6. an Internet Protocol address (IP address) and,

7. the internet service provider of the accessing system.

We do not draw any conclusions about your identity from the use of this general data and information. Rather, this information is required in order to

1. deliver the content of our website correctly,

2. optimise the content of our website and the advertising on it,

3. ensure the continued functionality of our IT systems and the technology underpinning our website, and

4. to provide law enforcement agencies with the information necessary for criminal prosecution in the event of a cyber attack.

We therefore analyse this collected data and information, on the one hand, for statistical purposes and, on the other, with the aim of enhancing data protection and data security within our organisation, ultimately to ensure an optimal level of protection for the personal data we process. The data from the server log files is stored separately from any personal data provided by a data subject.

The legal basis for data processing is Article 6(1), first sentence, lit. f of the GDPR. Our legitimate interest arises from the purposes of data collection listed above.

7.3 Hosting by Amazon Web Services – AWS

We host our website with Amazon Web Services (AWS). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg.

When you visit our website, your personal data is processed on AWS’s servers. In doing so, personal data may also be transferred to AWS’s parent company in the USA.

The use of AWS is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible.

We have entered into a data processing agreement with AWS. This is a contract required under data protection law, which ensures that AWS processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

This US company is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred without the need for further safeguards or additional measures.

Further information on AWS’s data protection policies can be found at: https://aws.amazon.com/de/privacy/?nc1=f_pr

8.1 Usercentrics (Consent Management Tool)

We use the ‘Usercentrics’ consent management tool provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany. This service enables us to obtain and manage website users’ consent to data processing.

Usercentrics collects data generated by end users who use our website. When an end user gives their consent, Usercentrics automatically logs the following data:

• Browser information.

• Date and time of access.

• Device information.

• The URL of the page visited.

• Geographical location.

• Page path on the website.

• The end user’s consent status, which serves as proof of consent.

The consent status is also stored in the end user’s browser, enabling the website to automatically read and honour the end user’s consent for all subsequent page requests and future end-user sessions for up to 12 months. The consent data (consent and withdrawal of consent) are stored at for three years. The retention period corresponds to the standard limitation period in accordance with Section 195 of the German Civil Code (BGB). The data are then deleted immediately or, upon request, provided to the data subject in the form of a data export.

The functionality of the website cannot be guaranteed without the processing described. The user has no right to object as long as there is a legal obligation to obtain the user’s consent to certain data processing operations (Article 7(1), Article 6(1), first sentence, point (c) of the GDPR).

Usercentrics is the recipient of your personal data and acts as a processor on our behalf.

Detailed information on the use of Usercentrics can be found at: https://usercentrics.com/privacy-policy/.

9.1 Data processing when opening a customer account and for the performance of a contract

In accordance with Article 6(1)(b) of the GDPR, personal data is collected and processed when you provide it to us for the purpose of performing a contract or when opening a customer account. The data collected is specified in the relevant input forms. You may delete your customer account at any time; this can be done, amongst other ways, by sending a message to the above-mentioned address of the data controller. We store and use the data you provide for the purpose of contract fulfilment. Once the contract has been fully fulfilled or your customer account has been deleted, your data will be blocked in accordance with retention periods under tax and commercial law and deleted once these periods have expired, unless you have expressly consented to the further use of your data or we have reserved the right to further use your data as permitted by law, in which case we will inform you accordingly below.

9.2 Contacting us / Contact form

Personal data is collected when you contact us (e.g. via the contact form or by email). The data collected when using a contact form is specified on the relevant contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or for establishing contact and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) of the GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted once your enquiry has been fully processed; this is the case when it can be inferred from the circumstances that the matter in question has been conclusively resolved and there are no statutory retention obligations preventing deletion.

9.3 Application Management / Job Board

We collect and process the personal data of applicants for the purpose of handling the application process. Processing may also take place electronically. This is particularly the case where an applicant submits the relevant application documents to us electronically, for example by email or via a web form on the website. If we enter into an employment or service contract with an applicant, the data provided will be stored for the purpose of managing the employment relationship in accordance with statutory provisions. If we do not enter into a contract with the applicant, the application documents will be automatically deleted six months after notification of the rejection decision, in such a way that no other legitimate interests on our part preclude such deletion. An example of such a legitimate interest in this context is the burden of proof in proceedings under the General Equal Treatment Act (AGG).

The legal basis for the processing of your data is Article 6(1)(b) and Article 88 of the GDPR in conjunction with Section 26(1) of the Federal Data Protection Act (BDSG).

10.1 CleverReach

This website uses CleverReach to send newsletters. The provider is CleverReach GmbH & Co. KG, (CRASH Building), Schafjückenweg 2, 26180 Rastede. CleverReach is a service that enables the organisation and analysis of newsletter distribution. The data you provide for the purpose of subscribing to the newsletter (e.g. your email address) is stored on CleverReach’s servers in Germany or Ireland.

Our newsletters sent via CleverReach enable us to analyse the behaviour of newsletter recipients. Among other things, this allows us to analyse how many recipients opened the newsletter and how often each link in the newsletter was clicked. With the help of so-called conversion tracking, it is also possible to analyse whether a predefined action (e.g. the purchase of a product on our website) took place after clicking on a link in the newsletter. Further information on data analysis by CleverReach newsletters is available at: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.

Data processing is carried out on the basis of your consent (Article 6(1)(a) of the GDPR). You may withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of any data processing operations that have already taken place remains unaffected by the withdrawal of consent.

If you do not wish your data to be analysed by CleverReach, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message. You can also unsubscribe from the newsletter directly on the website.

You may withdraw the consent you have given at any time. You can also prevent data processing at any time by unsubscribing from the newsletter. You can also prevent the storage of cookies by adjusting the settings in your web browser accordingly. You can also prevent the storage and transmission of personal data by disabling JavaScript in your web browser or by installing a JavaScript blocker (e.g. https://noscript.net or https://www.ghostery.com). Please note that these measures may mean that not all functions of our website are available.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and those of CleverReach once you have unsubscribed. Data stored by us for other purposes (e.g. email addresses for the members’ area) remains unaffected by this.

You can view CleverReach’s privacy policy at: https://www.cleverreach.com/de/datenschutz/.

To enable us to communicate with you on social media and keep you informed about our services, we maintain our own pages on these platforms. When you visit one of our social media pages, we are jointly responsible with the provider of the relevant social media platform for the processing operations triggered thereby, within the meaning of Article 26 of the GDPR.

We are not the original provider of these pages, but merely use them within the scope of the options offered to us by the respective providers.

We therefore wish to point out, as a precaution, that your data may also be processed outside the European Union or the European Economic Area. Using these platforms may therefore entail data protection risks for you, as it may be more difficult to exercise your rights – such as the right to access, erasure, objection, etc. – and processing on social networks is often carried out directly by the providers for advertising purposes or to analyse user behaviour, without us being able to influence this . Where the provider creates user profiles, cookies are often used, or your usage behaviour is linked to the member profile you have created on the social media platforms.

The processing of personal data described above is carried out in accordance with Article 6(1)(lit. f) of the GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider, in order to be able to communicate with you in a modern manner and to inform you about our services. If, as a user, you are required to give your consent to data processing with the respective providers, the legal basis is Article 6(1)(a) of the GDPR in conjunction with Article 7 of the GDPR.

As we do not have access to the providers’ data sets, we would like to point out that the best way to exercise your rights (e.g. the right to access, rectification, erasure, etc.) is directly with the relevant provider. We have provided further information on the processing of your data on social media platforms below, for each social media provider we use:

11.1 Facebook

(Joint) data controller in Europe:

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Meta (Facebook) may, unless an objection is raised, process content from adult users in the EU – e.g. photos, posts or comments – for the purpose of training its own AI models. This is based on a legitimate interest pursuant to Article 6(1)(f) of the GDPR. As a company, we have no influence over this specific data processing carried out by Meta. Users may object to this via an online form on the Meta platforms.

Data Protection Policies:

https://www.facebook.com/about/privacy

11.2 Instagram

(Joint) data controller in Germany:

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Meta (Instagram) may, unless an objection is raised, process content from adult users in the EU – such as photos, posts or comments – for the purpose of training its own AI models. As a company, we have no influence over this specific data processing carried out by Meta. The legal basis is a legitimate interest pursuant to Article 6(1)(f) of the GDPR. Users may object to this via an online form on the Meta platforms.

Data Protection Policies:

https://instagram.com/legal/privacy/

11.3 LinkedIn

(Joint) controller for data processing in Europe:

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

data protection policies:

https://www.linkedin.com/legal/privacy-policy

11.4 YouTube

(Joint) data controller in Europe:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

data protection policies:

https://policies.google.com/privacy

12.1 Google Analytics 4 (GA4)

On our websites, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

In this context, pseudonymised user profiles are created and cookies (see the section on ‘Cookies’) are used. The information generated by the cookie regarding your use of this website may include, amongst other things:

• a temporary recording of the IP address without permanent storage

• location data

• browser type/version

• operating system used

• referrer URL (previously visited page)

• Time of the server request

The pseudonymised data may be transferred by Google to a server in the USA and stored there.

The information is used to analyse the use of the website, to compile reports on website activity and to provide other services relating to website and internet usage for the purposes of market research and the needs-based design of these web pages. This information may also be transferred to third parties where required by law or where third parties process this data on our behalf.

These processing operations take place exclusively upon the granting of express consent in accordance with Article 6(1)(a) of the GDPR.

The default data retention period set by Google is 14 months. Otherwise, personal data is retained for as long as is necessary to fulfil the purpose of processing. The data is deleted as soon as it is no longer required to achieve that purpose.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision in accordance with Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

Further information on data protection when using GA4 can be found at: https://support.google.com/analytics/answer/12017362?hl=de.

12.2 Hotjar

We use the Hotjar analytics service on our website, a service provided by Contentsquare. We use Hotjar to gain a better understanding of how our website is used and to optimise our online offering in terms of content, structure and user-friendliness.

To this end, so-called heatmaps can be generated. In particular, these analyse

which areas of a web page visitors click on,

how the mouse pointer moves within a page,

how far visitors scroll on a page,

which pages or sections of a page are used particularly frequently, and

what type of device, e.g. desktop, tablet or mobile device, is being used.

In particular, these analyses enable us to improve the design of product and landing pages, as well as the placement of content and interactive elements. The data is not used to monitor or evaluate individual persons.

Hotjar is integrated into our website via a JavaScript script for this purpose. The behavioural data collected during use is processed by Hotjar or Contentsquare and used to generate aggregated usage analyses.

 Provider: Contentsquare / Hotjar

Purpose of processing: Analysis of usage behaviour and optimisation of the content, structure and user-friendliness of our website

Data processed: in particular, usage and interaction data such as clicks, mouse movements, scroll depth, pages or URLs visited, device type, and the time or period of use

Legal basis: Your consent in accordance with Article 6(1)(a) of the GDPR. Insofar as information is stored on or read from your device for the use of Hotjar, this is also carried out on the basis of your consent in accordance with Section 25(1) of the TDDDG.

Recipients: Contentsquare or Hotjar as the service provider used

Storage location: According to the information available to us, the data collected for heatmap analysis is stored on Contentsquare’s servers within the European Union.

Retention period: By default, heatmap data is stored for 365 days and then automatically deleted. We can customize the retention period in the account settings.

Processing by Hotjar only takes place if you have previously consented to the use of the service via our consent management system. You may withdraw any consent given at any time with future effect via the settings of our consent management system.

These processing operations take place exclusively where explicit consent has been given in accordance with Article 6(1)(a) of the GDPR.

Further information on Hotjar can be found at: https://help.hotjar.com/hc/en-us/categories/115001323967-About-Hotjar

12.3 SalesViewer

Our website uses the analytics service SalesViewer. The provider is SalesViewer GmbH, Hueststr. 30, 44787 Bochum.

SalesViewer enables us to analyse how businesses use our website and to evaluate business visits in order to gain insights for marketing, market research and optimisation purposes. When our website is accessed, the website visitor’s online identifier is technically recorded and immediately pseudonymised using a non-reversible one-way function (hashing). This pseudonymised information is then compared with a SalesViewer company database to check whether the access to our website can be attributed to a company. Visits for which no company attribution is possible (in particular visits by private individuals) are discarded after the comparison and are not processed further. If a company link is established, the associated company-related information and usage data are made available to us in a secure login area.

To enable a company-related reach analysis, the following personal data of the website visitor is processed:

• Technical characteristics of the web browser

• Referrer URL

• URL of the previously visited website

• Interaction with the website

• IP address

Data processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.

Personal data will be retained in such a way that it is retained for as long as is necessary to fulfil the purpose of processing. Your data will be deleted as soon as it is no longer required to fulfil that purpose or you withdraw your consent.

Further information on SalesViewer’s privacy policy can be found at: https://www.salesviewer.com/de/plattform/datenschutz/.

13.1 Google Ads (AdWords) Remarketing/Retargeting

We have integrated Google Ads into this website. The operator of the Google Ads services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

We use this to advertise this website in Google search results and on third-party websites. To this end, Google places a cookie in your device’s browser, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited.

Any further data processing will only take place if you have given Google your consent to link your web and app browsing history to your Google Account and to use information from your Google Account to personalise the adverts you see on the web. In this case, if you are logged in to Google whilst visiting our website, Google will use your data in conjunction with Google Analytics data to create and define audience lists for cross-device remarketing. To this end, your personal data will be temporarily linked by Google with Google Analytics data in order to form audiences.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

You can view the Google Ads privacy policy and further information at: https://www.google.com/policies/technologies/ads/

13.2 Google AdSense

We have integrated Google AdSense into this website. The operator of the Google AdSense component is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google AdSense is an online service that facilitates the placement of advertisements on third-party websites. Google AdSense is based on an algorithm that selects the advertisements displayed on third-party websites to match the content of the respective third-party site. Google AdSense enables interest-based targeting of internet users, which is implemented by generating individual user profiles.

The purpose of the Google AdSense component is to integrate advertisements onto our website. Google AdSense places a cookie on your IT system. The placement of this cookie enables Alphabet Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA, to analyse the use of our website. Each time you access one of the individual pages of this website, which is operated by us and on which a Google AdSense component has been integrated, the web browser on your IT system is automatically prompted by the respective Google AdSense component to transmit data to Alphabet Inc. at for the purposes of online advertising and the settlement of commissions. As part of this technical process, Alphabet Inc. obtains personal data, such as your IP address, which Alphabet Inc. uses, amongst other things, to track the origin of visitors and clicks and, consequently, to enable commission settlements.

Google AdSense also uses so-called tracking pixels. A tracking pixel is a miniature graphic embedded in web pages to enable log file recording and analysis, thereby allowing statistical evaluation to be carried out. Using the embedded tracking pixel, Alphabet Inc. can determine whether and when a web page was opened by your IT system and which links you clicked on. Tracking pixels are used, amongst other things, to analyse the visitor traffic on a website.

Via Google AdSense, personal data and information – including the IP address, which is necessary for the tracking and billing of the advertisements displayed – are transferred to Alphabet Inc. in the United States of America. This personal data is stored and processed in the United States of America. Alphabet Inc. may, under certain circumstances, pass on this personal data, collected via the technical process, to third parties.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision in accordance with Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

You can view Google AdSense’s privacy policy and further information at: https://www.google.de/intl/de/adsense/start/ and at https://www.google.com/policies/technologies/ads/

14.1 Google infrastructure – csp.withgoogle.com

We have integrated components from Google services into this website. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) is responsible for data processing within the EU.

The following services, amongst others, may be integrated into our pages:

• YouTube (video portal),

• Google Maps (map display),

• Google Tag Manager (script management),

• Google Ads / Google Publisher Services (online advertising),

• Sign in with Google’ (login function),

• Time of the server request.

Please refer to the data protection policies for details of which Google services are integrated.

When you access a subpage that contains a Google service (e.g. an embedded YouTube video or a Google Maps map), the relevant service causes your browser to load further content from Google’s servers. In this context, other supporting services such as Google WebFonts, Google Video, Google Photos, Google Static, Google Ads Services or Google Maps Tiles may also be automatically activated.

In addition, many of these integrations establish a connection to https://csp.withgoogle.com. This domain forms part of Google’s infrastructure and is used for the transmission of so-called Content Security Policy (CSP) reports. These reports are automatically generated by modern browsers to detect breaches of defined security policies, in particular those designed to protect against cross-site scripting (XSS) or data manipulation.

The data protection assessment of the connection to https://csp.withgoogle.comrichtet depends on which specific Google service technically triggers this security check. The connection is to be regarded as a technical component of the integrated service and does not take place independently of it. Accordingly, the data protection lawfulness of this connection is also determined by the legal basis for the respective service:

l If a Google service, such as YouTube, is integrated only with your explicit consent in accordance with Article 6(1)(a) of the GDPR, this consent is applied in such a way to the security check via csp.withgoogle.com associated with the service.

l If a service is integrated on the basis of another legal ground, e.g. Article 6(1)(b) of the GDPR (performance of a contract) or Article 6(1)(lit. f) of the GDPR (legitimate interests), the connection to csp.withgoogle.com may be established in such a way, provided that no additional personal data (such as user identifiers or tracking IDs) is processed.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

Further information on data protection can be found at: https://www.google.de/intl/de/policies/privacy/.

14.2 Google Photos

We use the Google Photos service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to store images embedded on our website.

Embedding refers to the integration of specific third-party content (text, video or image data) provided by another website (Google Photos) which then appears on our own website. An ‘embed code’ is used for embedding. If we have integrated an embed code, the external content from Google Photos is displayed in such a way as soon as one of our web pages is visited.

Through the technical implementation of the embed code, which enables images from Google Photos to be displayed, your IP address is transmitted to Google Photos. Furthermore, Google Photos records our website, the type of browser used, the browser language, the time and duration of the visit. In addition, Google Photos may collect information about which of our subpages you have visited and which links you have clicked on, as well as other interactions you have carried out whilst visiting our site. This data may be stored and analysed by Google Photos.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

This US company is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is in place, meaning that personal data may be transferred even without further safeguards or additional measures.

You can view Google’s privacy policy at: https://www.google.com/policies/privacy/.

14.3 Google Tag Manager

We use the Google Tag Manager service on this website. The operator of Google Tag Manager is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies, headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This tool enables ‘website tags’ (i.e. keywords embedded in HTML elements) to be implemented and managed via a user interface. By using Google Tag Manager, we can automatically track which button, link or personalised image you have actively clicked on and can then record which content on our website is of particular interest to you.

The tool also triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If you have disabled tracking at domain or cookie level, this setting will apply to all tracking tags implemented using Google Tag Manager.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision in accordance with Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

Further information on Google Tag Manager and Google’s data protection policies can be found at: https://www.google.com/intl/de/policies/privacy/.

14.4 Google WebFonts

Our website uses so-called web fonts to ensure a consistent display of typefaces. Google WebFonts are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies, headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is in place, meaning that personal data may be transferred even without further safeguards or additional measures.

Further information on Google WebFonts and Google’s data protection policies can be found at: https://developers.google.com/fonts/faq ; https://www.google.com/policies/privacy/.

14.5 OpenStreetMap

We have integrated map sections from the online mapping tool “OpenStreetMap” into our website. This is a so-called open-source mapping service, which we can access via an API (application programming interface). This service is provided by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. By using this service, we can, for example, display our location to you and make it easier for you to find your way here.

When you access the subpages on which OpenStreetMap is integrated, information about your use of our website (such as your IP address, browser details, device type and operating system) is transmitted to OpenStreetMap and stored there.

To speed up the service, OpenStreetMap uses the Content Delivery Network (CDN) provided by Fastly, Inc., PO Box 78266, San Francisco, CA 94107, USA (fastly). A CDN is a service that enables the content of our online offering – in particular large media files such as graphics or scripts – to be delivered more quickly via regionally distributed servers connected via the internet. Your data is processed exclusively for the aforementioned purposes and to maintain the security and functionality of the CDN.

Fastly, as a US company, is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

For each instance of data processing, Fastly transfers personal data from the log files (e.g. IP addresses) to the USA, as certain servers used to process the log files are located exclusively in the USA. Fastly has therefore committed to complying with the standards and regulations of European data protection law. Fastly’s current Privacy Policy can be found at: https://www.fastly.com/de/privacy/.

Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR.

Detailed information on OpenStreetMap can be found at: https://wiki.osmfoundation.org/wiki/Privacy_Policy.

14.6 YouTube (videos)

We have integrated YouTube components into this website. YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube is an online video portal that enables video publishers to upload video clips free of charge and allows other users to view, rate and comment on them, also free of charge. YouTube permits the publication of all types of videos, which is why complete films and television programmes, as well as music videos, trailers and user-generated videos, are available via the portal. Each time you access one of the individual pages of this website, which is operated by us and on which a YouTube component (YouTube video) has been integrated, the web browser on your IT system is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. In addition, the services Google WebFonts, Google Video and Google Photos may be loaded from YouTube. Further information about YouTube can be found at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google are informed of which specific subpage of our website you are visiting.

If you are logged in to YouTube at the same time, YouTube will recognise which specific subpage of our website you are visiting when you access a subpage containing a YouTube video. This information is collected by YouTube and Google and linked to your YouTube account.

YouTube and Google always receive information via the YouTube component that you have visited our website if you are logged into YouTube at the same time as you access our website; this occurs regardless of whether you click on a YouTube video or not. If you do not wish for this information to be transmitted to YouTube and Google, you can prevent this by logging out of your YouTube account before accessing our website.

These processing operations take place exclusively where explicit consent has been given in accordance with Article 6(1)(a) of the GDPR.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision in accordance with Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

You can view YouTube’s privacy policy at https://www.google.de/intl/de/policies/privacy/.

14.7 YouTube videos in enhanced privacy mode (YouTube NoCookies)

Some subpages of our website contain links to YouTube’s services. As a general rule, we are not responsible for the content of websites to which links are provided. However, should you follow a link to YouTube, please note that YouTube stores its users’ data (e.g. personal information, IP address) in accordance with its own data usage policies and uses it for commercial purposes.

YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

We also embed videos stored on YouTube directly on some subpages of our website. When this is done, content from the YouTube website is displayed in sections of a browser window. When you access a (sub)page of our website that contains embedded YouTube videos, a connection is established with the YouTube servers and the content is displayed on the website via a request sent to your browser.

YouTube content is embedded only in ‘enhanced privacy mode’. YouTube provides this mode itself and thereby ensures that YouTube does not initially store any cookies on your device. However, when you access the relevant pages, your IP address and, where applicable, other data are transmitted in such a way as to indicate, in particular, which of our web pages you have visited. This information cannot, however, be linked to you unless you have logged in to YouTube or another Google service before accessing the page, or are permanently logged in. As soon as you start playing an embedded video by clicking on it, YouTube, through the enhanced privacy mode, will only store cookies on your device that do not contain any personally identifiable data, unless you are currently logged in to a Google service. These cookies can be prevented by adjusting your browser settings and using browser extensions.

Requesting the video also constitutes your consent to the placement of the relevant cookie (Article 6(1), first sentence, lit. a of the GDPR).

This US company is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

You can view YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy/.

14.8 Location Finder / Search by postcode

On our website, we provide a Location Finder which you can use to find regional contacts, retailers, advice centres and service centres.

Search by postcode

You can enter your postcode to carry out a search. The postcode you enter is transmitted to our web server and processed within our IT infrastructure to identify suitable regional contacts. Your IP address is not passed on to the internal search system.

Processing is carried out on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in enabling you to carry out a simple and targeted search for relevant regional contacts.

The postcode you enter is used solely for the purpose of carrying out the relevant search query and is not used to create user profiles.

14.9 Map display using OpenStreetMap

We use map data from OpenStreetMap to display search results on a map. The provider is the OpenStreetMap Foundation (OSMF).

The map is only loaded once you have expressly consented to the display of external map content. Only then does your browser establish a connection to the OpenStreetMap servers or the services used to deliver the maps.

In particular, your IP address, browser and device information, the time and content of the request, and, where applicable, the previously visited website may be transmitted to OpenStreetMap and processed there.

The legal basis for embedding the map is your consent in accordance with Article 6(1)(a) of the GDPR. Insofar as access to information on your device is required for the embedding, this is also based on your consent in accordance with Section 25(1) of the TDDDG.

You can also use the Location Finder and the results list without activating the map. You may withdraw any consent you have given at any time via the settings of our consent management tool, with effect for the future.

15.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

15.2 Right of access (Article 15 of the GDPR)

You have the right to receive, at any time and free of charge, information from us regarding the personal data we hold about you, as well as a copy of this data, in accordance with the statutory provisions.

15.3 Right to rectification (Article 16 of the GDPR)

You have the right to request the rectification of any inaccurate personal data concerning you. Furthermore, you have the right to request the completion of any incomplete personal data, taking into account the purposes of the processing.

15.4 Erasure (Article 17 of the GDPR)

You have the right to request that we erase personal data concerning you without undue delay, provided that one of the grounds laid down by law applies and insofar as the processing or storage is not necessary.

15.5 Restriction of processing (Article 18 of the GDPR)

You have the right to request that we restrict the processing of your personal data if one of the statutory conditions is met.

15.6 Data portability (Article 20 of the GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller to whom the personal data has been provided, without hindrance from us, provided that the processing is based on consent pursuant to Para 6(1)(a) of the GDPR or Para 9(2)(lit. a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability under Article 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, in so far as this is technically feasible and provided that this does not adversely affect the rights and freedoms of others.

15.7 Objection under Article 21 of the GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) of the GDPR (data processing in the public interest) or Article 6(1)(lit. f) of the GDPR (data processing based on a balancing of interests).

This also applies to profiling based on these provisions within the meaning of Article 4(4) of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves to establish, exercise or defend legal claims.

In individual cases, we process personal data for the purposes of direct marketing. You may object at any time to the processing of your personal data for the purposes of such marketing. This also applies to profiling, insofar as it is related to such direct marketing. If you object to us processing your personal data for direct marketing purposes, we will no longer process your personal data in such a way.

Furthermore, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you which we carry out for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

You are free, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

15.8 Withdrawal of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

15.9 Lodging a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority responsible for data protection regarding our processing of personal data.

We process and store your personal data only for the period necessary to fulfil the purpose of storage or insofar as this is required by the legal provisions to which our company is subject.

If the purpose of storage no longer applies or a prescribed retention period expires, the personal data will be blocked or deleted routinely and in accordance with statutory provisions.

The criterion for the duration of the storage of personal data is the relevant statutory retention period. Once this period has expired, the relevant data is routinely deleted, provided it is no longer required for the performance of a contract or for entering into a contract.

These data protection policies are currently valid and are dated: October 2026.

Due to the ongoing development of our website and services, or as a result of changes to legal or regulatory requirements, it may become necessary to amend the data protection policies. You can access and print the current version of the data protection policies at any time on the website at “https://www.boge.com/de/datenschutz”.

This data protection policy was created with the support of the data protection software: audatis MANAGER.