Data protection notice

Thank you very much for your interest in our company. Data protection is of a particularly high priority for the Management of Einkaufsbüro Deutscher Eisenhändler GmbH. With the help of this data protection notice, Einkaufsbüro Deutscher Eisenhändler GmbH (hereinafter “E/D/E GmbH”, “we”, “us” or “controller”) wishes to) inform you about the processing of your personal data that is transmitted when you visit our website or that you transmit to us when you visit our website.

As the controller, the E/D/E GmbH has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. Nevertheless, Internet-based data transmissions can always have security gaps, so that absolute protection cannot be guaranteed.

The controller within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is the:

Einkaufsbüro Deutscher Eisenhändler GmbH
EDE Platz 1
42389 Wuppertal
Germany

Phone: +49 202 6096-0
E-mail: webkontakt@ede.de
Website: www.ede.de

Einkaufsbüro Deutscher Eisenhändler GmbH
Attn. of the data protection officer

EDE Platz 1
42389 Wuppertal
Germany

E-mail: datenschutz@ede.de
Website: www.ede.de

You can contact our data protection officer directly at any time with any questions or suggestions regarding data protection.

Each time our website is accessed, our system automatically collects data and information from the end device. The following data is collected.

• Scope of data processing
• Information about the browser type and version used
• The operating system of the retrieval device
• The IP address of the retrieval device
• Date and time of access
• Websites and resources (images, files, other page content) accessed on our website.
• Websites from which the user’s system came to our website (referrer tracking)

This so-called logging is carried out to maintain the compatibility of our website for as many visitors as possible and to combat misuse and eliminate faults. For this purpose, it is necessary to log the technical data of the accessing computer in order to be able to react as early as possible to display errors, attacks on our IT systems and/or errors in the functionality of our website. In addition, we use the data to optimize the website and to generally ensure the security and proper operation of our information technology systems.

This data is stored in the log files of our system. This data is not stored together with the personal data of a specific user, so that individual site visitors cannot be identified. The data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR, our legitimate interest in the secure and trouble-free operation of our website.

The E/D/E GmbH website uses cookies. Cookies are text files that are stored on an end device via an Internet browser.

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters through which websites and servers can be assigned to the specific Internet browser in which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser can be recognized and identified via the unique cookie ID.

Through the use of cookies, the E/D/E GmbH can provide the users of this website with more user-friendly services that would not be possible without the cookie setting.

By means of a cookie, the information and offers on our website can be optimized for the benefit of the user. As already mentioned, cookies enable us to recognize the users of our website. The purpose of this recognition is to make it easier for users to use our website. For example, the user of a website that uses cookies does not have to re-enter their access data each time they visit the website because this is taken over by the website and the cookie stored on the user’s end device. Another example is the cookie of a shopping cart in an online store. The online store remembers the items that a customer has placed in the virtual shopping cart via a cookie.

You can prevent the setting of cookies by our website at any time by means of a corresponding setting of the Internet browser used and thus permanently object to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an Internet browser or other software programs. This is possible in all common Internet browsers. If you deactivate the setting of cookies in the Internet browser you are using, you may not be able to use all the functions of our website to their full extent.

Klicken Sie hier, um Ihre Cookie-Einstellungen zu aktualisieren

We incorporate functional and content elements into our online offering that are obtained from the servers of the respective providers (hereinafter referred to as “third-party providers”). These can be, for example, graphics, videos or city maps (hereinafter collectively referred to as “content”).
The integration always requires that the third-party providers of this content process the IP address of the user, as they would not be able to send the content to the user’s browser without the IP address.
The IP address is therefore required for the display of these functions or content. We endeavor to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These “pixel tags” can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, visit time and other information about the use of our online offer and may be linked to such information from other sources.

Information on legal bases: If we ask users for their consent to use third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and user-friendly services). In this context, we also refer to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offer and user-friendliness, provision of contractual services and customer service.
• Legal basis: Legitimate interest in accordance with. Art. 6 para. 1 lit. f GDPR.

Due to legal regulations, our website contains information that enables quick electronic contact to our company and direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If you contact us by e-mail or via a contact form, the personal data you provide will be stored automatically. Such personal data transmitted to us by you on a voluntary basis will be stored for the purpose of processing or contacting you. This personal data is not passed on to third parties.
If you write to us via our contact form and send us your contact details (including your preferences; for example, which of our products you are interested in), we process these in accordance with the legal requirements and only use them to respond to your inquiry.

We process the names and business contact details of persons with whom we have regular business dealings and the content of communications with these persons using the MS Dynamics CRM application from Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052-6399, USA, in the European Union (EU) represented by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland. This information is available to the employees of E/D/E GmbH who maintain business contact with these persons or who process the concerns of these persons.

MS Dynamics CRM is a cloud application that is hosted in Microsoft data centers within the EU. However, it cannot be ruled out that a data transfer to the USA is necessary, e.g. for the processing of support requests. Microsoft Deutschland GmbH and Microsoft Ireland Operations Limited, as the main representative of Microsoft within the EU, have concluded so-called Binding Corporate Rules with the parent company in the USA, approved by the Irish data protection supervisory authority in accordance with Art. 47 GDPR. These contain additional technical and organizational measures for the protection of personal data, so that an appropriate level of protection within the meaning of the GDPR can be assumed. In addition, Microsoft Corporation is certified under the EU-US Data Privacy Framework.

The processing of this personal data in the form described is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR, in a structured and efficient communication, both within E/D/E GmbH to our business partners, as well as with our business partners, in order to be able to process their concerns to the satisfaction of all parties involved.

You have the option of registering for events on our website. In order to carry out this registration, we process data on the basis of Art. 6 para. 1 lit. b) GDPR, fulfillment of a contract, the following personal data from you: Name, e-mail address, access data.

You also have the option of registering other people from your company for our events. We would like to point out that you need the consent of the respective person for this and we assume that you have this consent.

If you have been registered for one of our events by another person from your company, we will process your name and e-mail address in order to carry out the registration. If you have not consented to the registration, please cancel the registration via the communication channels provided.

In principle, we store the personal data of participants in our events for three months after the end of the event for the follow-up of the respective event. The data is then deleted. In the case of cancellations, we reserve the right to retain the data for up to 12 months in order to answer any queries relating to the cancellation before the data is deleted.

As part of events, we may make photo and video recordings and sound recordings for public relations work within the buying association and for E/D/E marketing purposes, in which individual participants and groups of participants at the event can be recognized or heard, e.g. in the context of group pictures, conversational situations or interviews.

E/D/E and its employees, as well as any photographers/videographers commissioned, will ensure that participants in the event are presented in a favorable light. In many cases, participants are also asked at the event whether recordings can be made of them and then shown the recordings directly. However, this is not always possible in certain situations, e.g. with pictures taken of an event plenary.

We will also carefully select event recordings before publication.

By clicking on the corresponding button “Consent to image, video and sound recordings”, you declare your consent in accordance with Art. 6 para. 1 lit. a) GDPR that image, video and sound recordings may be made of you at the respective event, which may be used and publicly distributed in the context of online and print publications of E/D/E (websites of E/D/E GmbH and such companies affiliated with E/D/E, incl. social media channels, concept group websites, PVH magazine, etc.).

Should you unexpectedly change your mind about publication, you can revoke your consent to the use of recordings in online publications. To do so, please contact your contact person at E/D/E GmbH for the respective event or use the contact details provided on the respective website or use the contact form provided. We will endeavor to delete the relevant image from the online publication and the image databases as quickly as possible.

With your consent, we will be granted a usage period for the duration of the respective print publication, i.e. copies may remain in circulation until the end of the print publication’s term. In this respect, the revocation is effective for the future: reprinting in the form of a further edition with a revoked photograph is excluded, as is any use for other, fundamentally new publications.

ZR-Online is operated by E/D/E GmbH and represents a technical platform through which suppliers and members (hereinafter referred to as “users”) of E/D/E GmbH as well as users who have a direct billing relationship with ETRIS Bank GmbH, as a subsidiary of E/D/E GmbH, can, among other thingsview lists (so-called “OP lists”) of settled and unsettled documents of a specific accounting period, recognize the document status and create payment advice notes as well as process documents for checking purposes (e.g. by marking), download and process complaints.

When using the service, the following personal data is transmitted to ZR-Online:

• First name
• Surname
• e-mail

The data is processed for the purpose of authenticating users, managing user accounts, sending notification e-mails and processing user inquiries.

Authentication takes place via a hashed session ID, which is transferred from the extranet to ZR-Online. This session ID is deleted at the end of the session.

Employees of E/D/E and ETRIS BANK GmbH as well as employees of the service provider commissioned by E/D/E GmbH to operate the application by way of order processing have access to the personal data. Furthermore, the data is transferred to the Microsoft Azure cloud instance of E/D/E GmbH, which is hosted in European data centers.

All data in the application is encrypted both during transport and at rest.

For reasons of traceability in terms of security, logging makes it possible to see when and by whom which data was created or edited and to whom which data was made available.

We use the Application Insights service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, for this purpose. The following information is collected and processed via this service: The approximate location based on an anonymized IP address, the browser and operating system version of the end device used, the URLs accessed within ZR-Online and an anonymous user ID. The latter makes it possible to assign activities to a user ID over time. It is therefore not possible to draw conclusions about a specific person. The information obtained in this way is deleted after 90 days.

Information about the service can be found at https://learn.microsoft.com/de-de/azure/azure-monitor/app/app-insights-overview can be accessed. Microsoft’s privacy policy can be found at https://www.microsoft.com/de-de/trust-center/privacy can be accessed.

In principle, the processing of personal data for invoicing is based on the fulfillment of a contract in accordance with Art. 6 para. 1 lit. b) GDPR. The processing of personal data in the form described above is based on the legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR, E/D/E GmbH is interested in the secure, traceable, user-friendly, fast, cost-effective and efficient provision of documents for its members and suppliers.

The following technologies and services are used on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR to ensure the secure, error-free and legally compliant operation of our website:

12.1 Borlabs Cookie

We have integrated Borlabs Cookie, Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany, on our website. In this way, we ask for your consent if this is required for the execution of techniques and services for the processing of personal data and can document your decisions in accordance with our obligations to provide evidence.

Borlabs Cookie sets a technically necessary cookie (borlabs-cookie) to store your cookie consent. No personal data is processed in the process. The borlabs-cookie cookie stores the consent you gave when you entered the website. If you wish to revoke this consent, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked for your cookie consent again.

You can find more information about Borlabs Cookie here.

For the following technologies and services, we require your consent in accordance with Art. 6 para. 1 lit. a) GDPR:

13.1 Microsoft (MS) Forms

We use MS Forms to carry out internal and external surveys, e.g. to create a market barometer, to evaluate campaigns carried out or to measure satisfaction with services offered, as well as to register for events.

MS Forms is a service of Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052-6399, USA, in the European Union (EU) represented by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland and enables the execution of surveys or queries via customizable forms.

The use by us takes place within the framework of our Microsoft 365 environment. Our contractual partner for this is Microsoft Deutschland GmbH, Walter-Gropius-Straße 5, 80807 Munich, Germany. The contracts also include a data processing agreement (DPA) in accordance with Art. 28 GDPR. Data is always stored within the EU. However, it cannot be ruled out that a data transfer to the USA is necessary, e.g. for the processing of support requests. Microsoft Deutschland GmbH and Microsoft Ireland Operations Limited, as the main representative of Microsoft within the EU, have concluded so-called Binding Corporate Rules with the parent company in the USA, approved by the Irish data protection supervisory authority in accordance with Art. 47 GDPR. These contain additional technical and organizational measures for the protection of personal data, so that an appropriate level of protection within the meaning of the GDPR can be assumed.

Information on data protection when processing personal data and on the use of cookies by Microsoft can be found here.

13.1.1 Participation in surveys

In principle, the following categories of personal or personally identifiable data are collected when you participate in surveys:

• IP address of the retrieval device
• Name
• E-mail address
• Set language
• Profile picture, if stored in Microsoft 365
• Status, if stored in Microsoft 365
• Date and time when the form was opened
• Date and time when the reply was sent

Access to this data and your answers is generally granted to our employees in the specialist area conducting the survey or to the form owner.

If you take part in an anonymous survey, we will not be able to trace your response back to you, i.e. we will not have access to your personal data.

Your answers will be processed by MS Forms and evaluated by our employees according to the purpose of the survey. If it is in line with the purpose of the survey, your answers and their analysis will also be made available to third parties, e.g. for the market barometer.

Participation in surveys is voluntary. If you give your consent to participate, the processing of your personal data is based on Art. 6 para. 1 lit. a GDPR as the legal basis. You can withdraw your consent at any time with effect for the future or refuse to participate without incurring any disadvantages. If it is necessary to conduct surveys to initiate or execute a contract, the processing of your personal data is based on Art. 6 para. 1 lit. b GDPR as the legal basis. If the implementation of surveys is necessary for the implementation or initiation of an employment relationship, the processing of your personal data is based on § 26 BDSG as the legal basis. If there is no contractual relationship between you and us, the implementation of surveys is based on our legitimate interest in targeted, effective campaigns and events and their improvement as well as in knowledge about market developments in accordance with Art. 6 para. 1 lit. a GDPR. 1 lit. f GDPR.