Introduction

We, IsoTek GmbH, Wilhelm-Maybach-Straße 2, D-74219 Möckmühl, +49 6298 93753-0, info@isotek-gmbh.de, as the data controller, would like to explain below what data we process about you and how we do so.

Data Protection Officer

If you have any questions regarding data protection, our Data Protection Officer, Mr Michael Egner, will be happy to assist you.

He can be contacted at:

Arbeitssicherheit Süd, Silostraße 10, 74219 Möckmühl, info@arbeitssicherheit-sued.de, +49-6298 9374460

With this mandatory data protection information, we, as the data controller, fulfil our duty to provide information in accordance with Articles 12–14 of the GDPR.

Information on data collection and processing

Below you will find information on which personal data – that is, all data that identifies you as a natural person (hereinafter referred to as the ‘data subject’) or makes you identifiable – is collected and processed.

These include, for example:

• Customer master data for the performance of the contract / provision of the service, name, address, email address, data relating to payment processing, correspondence (e.g. written correspondence or email correspondence with you), marketing and sales data (e.g. to provide information about new offers that may be of interest to you by post or, with your consent, also by email)
• Data from initial contact attempts, such as name, telephone number and email address
• Supplier data, such as name, telephone number and email address
• Employee data, such as name, address, bank details and religious affiliation
• Personnel number, National Insurance number, log data generated when using IT systems, as well as other and special categories of personal data
• Applicant data such as name, address, email address, marital status, religious affiliation
• Data resulting from video surveillance

Right to lodge a complaint

If you consider that the processing of your personal data infringes the General Data Protection Regulation, you have the right to lodge a complaint with the data protection supervisory authority responsible for us, the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia, www.ldi.nrw.de, or with any other data protection supervisory authority.

Purposes of processing

1. Customer data/prospective customers

Purpose of processing

We process data that we receive in the course of conducting our business relationship with you. We receive this data directly from you, either in response to enquiries from prospective customers or contact requests, when an order is placed, or during order processing (see section ‘Information on data collection and processing’).

Legal basis

The collection and processing of data is necessary for the performance of the contract and is based on Article 6(1)(b) of the GDPR. The use of data for direct marketing is based on Article 6(1)(f) of the GDPR. It is in our legitimate interest to draw your attention to special offers by means of direct marketing. Data will not be disclosed to third parties unless required by law, such as to the tax authorities under tax legislation. The data will be deleted as soon as it is no longer required for the purpose for which it was processed or upon expiry of the statutory retention periods, such as accounting records relevant under tax and commercial law: 10 years; commercial and business correspondence: 6 years; records relating to suppliers, type, quantity, purchase and supply: 3 years.

You have the right to object to the use of your data for the purposes of direct marketing at any time. You are also entitled to request information about the data we hold about you, and to demand the rectification of any inaccurate data or the erasure of data where it has been stored unlawfully. You also have the right to lodge a complaint with a supervisory authority (see the section on the right to lodge a complaint).

Duration of data storage

Your personal data is regularly reviewed by members of the sales team. As soon as we become aware of the winding-up of a company or the departure of a contact person, an archiving note is immediately added.

Deletion of data

Your personal data is deleted in accordance with the statutory retention periods under commercial and tax law (usually after 10 years).

2. Suppliers

Purpose of processing

We process data that we receive in the course of conducting our business relationship with you. We receive this data directly from you when you place an order or during order processing (see the section ‘Information on data collection and processing’).

Legal basis

The collection and processing of data is necessary for the performance of the contract and is based on Article 6(1)(b) of the GDPR. Data will not be disclosed to third parties unless required by law, such as to the tax authorities under tax legislation. The data will be deleted as soon as it is no longer required for the purpose for which it was processed or upon expiry of the statutory retention periods, such as: accounting records relevant under tax and commercial law: 10 years; commercial and business correspondence: 6 years; records relating to suppliers, type, quantity, purchase and supply: 3 years.

You are entitled to request information regarding the data we hold about you, and to request the rectification of any inaccurate data or the erasure of data where its storage is unlawful. You also have the right to lodge a complaint with a supervisory authority (see the section on the right to lodge a complaint).

3. Employee data

See the separate template to be provided to employees.

4. Newsletter

Purpose of processing

If you wish to receive our newsletter, we require your first name and surname, your company name and address, an email address, and information enabling us to verify that you are the owner of the email address provided or that the owner consents to receiving the newsletter

You may withdraw your consent to the storage of your email address and the contact details mentioned above, as well as their use for sending the newsletter, at any time. A link to unsubscribe is provided at the end of every newsletter. To enable us to prove that consent was previously given in the event of an unsubscribed email address, we may store this information for up to 2 years before deleting it.

Legal basis

This is based on the consent of the recipients in accordance with Article 6(1)(a) of the GDPR, Article 7 of the GDPR in conjunction with Section 7(2)(3) of the Unfair Commercial Practices Act (UWG), or on the basis of statutory authorisation pursuant to Section 7(3) of the UWG.

You are entitled to request information about the data we hold about you, as well as to request the rectification of any inaccurate data or the erasure of data where its storage is unlawful. You also have the right to lodge a complaint with a supervisory authority (see the section on the right to lodge a complaint).

5. Job Applications

Purpose of Processing

If you apply for a job with us in response to a job advertisement, either by email or post, we will collect your personal data, such as your first name, surname, address, telephone number, email address and any attachments (cover letter, CV, certificates, photograph), and store this data for the duration of the selection process.

The collection, selection and assessment of your data is carried out by the secretariat, the HR department, the relevant department and the management. Your personal data will not be passed on to third parties.

Should the specific position for which you are applying have already been filled by another candidate, but you are considered suitable for future employment or for a role within a partner company or subsidiary based on your profile, we will seek your express consent before storing or forwarding your application any further, unless you have already consented to such storage or forwarding in your application.

If you are applying to us by email, please send your application documents exclusively to our dedicated email address, jobs@isotek-gmbh.de, so that they are delivered directly to the authorised staff.

The legal basis is Article 6(1)(b) of the GDPR, concerning the processing of pre-contractual measures.

Unless you inform us otherwise, the data will be deleted 6 months after the post has been filled in the event of a rejection. Applications sent by post will be destroyed or returned once processing has been completed in the event of a rejection.

Unsolicited applications will be deleted or returned at the latest by the end of the year following the rejection, should interest in the application cease.

Subject to the relevant legal requirements, you are entitled to the following rights: the right to access your data stored by us; the right to rectification, erasure, restriction of processing of your data or to object to processing; and the right to data portability. Furthermore, you naturally have the option at any time to request the deletion or destruction of all your application documents by sending us an email to: jobs@isotek-gmbh.de.

6. Server data collection

You can find further information on this under ‘Privacy Policy’.

7. Video surveillance

Purpose of processing

The purpose of our video surveillance is to exercise our rights as property owners, to protect persons and property, to protect against industrial espionage, to prevent and investigate criminal offences and vandalism, and to control access. As the data controller, we process personal image data which we collect as part of video surveillance on the premises. For operational reasons, the retention period is 7 days. After this period, the data is irrevocably deleted.

The legal basis is Article 6(1)(f) of the GDPR and Section 26(1), (3) and (4) of the BDSG. Our legitimate interest arises from the description of the purpose and lies primarily in the protection of property and our rights as the data controller.

This data is only disclosed to investigative authorities in the event of criminal offences.

You have the right to request confirmation from us, as the data controller, as to whether personal data concerning you is being processed. If this is the case, you have the right to access this personal data and, where the data is inaccurate, to request its rectification, or, where the data is being stored unlawfully, to request its erasure. You also have the right to lodge a complaint with a supervisory authority (see the section on the right to lodge a complaint).

If you have any questions regarding this, our Data Protection Officer will be happy to assist you at datenschutz@synflex.de.

Intention to process data in third countries

In particular, where there is an intention to process personal data in a third country, details must be provided regarding the existence or absence of an adequacy decision by the Commission. In the absence of such an adequacy decision, the website operator must, for example, describe the appropriate and suitable safeguards (primarily of a technical and organisational nature) envisaged for the data transfer. They must offer the possibility of obtaining a copy of the explanations regarding these safeguards. Further details are set out in Article 13(1)(f) of the GDPR. The processing relationship with a third country described above will exist in particular where the chosen service provider is established in a third country, where that provider collects the data or stores the data collected via the website on its own servers and can access it, or where it uses a third party’s servers and can thereby access the usage data.

Categories of recipients

In the course of providing our services, we engage service providers in specific areas who are separately bound by confidentiality and data protection obligations, where access to personal data cannot be ruled out.

These categories of recipients are:

Processors engaged by us (Article 28 of the EU GDPR), particularly in the fields of IT services, taxation, logistics and printing services, who process your data on our behalf in accordance with our instructions.

Public authorities and institutions (tax authorities) where there is a legal or regulatory obligation.

Other bodies to which you have given us your consent to transfer your data.

Data will only be disclosed to public authorities where there are overriding legal provisions.

Marketing and the right to object

Your surname, first name and address are also collected for marketing purposes (sending offers, information about additional services). You may object to processing for marketing purposes at any time without giving reasons by contacting us at: datenschutz@isotek-gmbh.de

Objection to data storage

Data processing for the purpose of carrying out follow-up orders (requested at the time of concluding the contract or at a later date) serves legitimate business interests from a data protection perspective. You may object to this processing at any time by contacting us at the following address: datenschutz@isotek-gmbh.de

Obligation to provide data

Without correct details from you, it is generally not possible to conclude a contract.

Data subjects’ rights

In accordance with Article 15 of the GDPR, you have the right to obtain information about the personal data stored about you, including any recipients and the intended duration of storage. Should incorrect personal data be processed, you have the right to rectification in accordance with Article 16 of the GDPR. Provided the legal requirements are met, you may request the erasure or restriction of processing, and you may object to the processing (Articles 17, 18 and 21 of the GDPR).

If you wish to have your data erased but we are still legally obliged to retain it, access to your data will be restricted (blocked). The same applies in the event of an objection. You may exercise your right to data portability, provided that the technical capabilities are available both at the recipient’s end and on our part.

Our Data Protection Officer is available to assist you with your data subject rights at datenschutz@isotek-gmbH.de.

Updates and amendments to this mandatory data protection notice

We reserve the right to amend the content of this mandatory data protection notice at any time. This is usually done in the event of further developments or legislative changes. You can access the current mandatory data protection information via a link included in our emails, quotations, order confirmations, invoices, etc.

Date of this statement: 09 July 2026

Further information on the processing of personal data can be found under Data Protection Notice.