Privacy Policy

1. General information

VTIS GmbH (hereinafter “VTIS” or “we”) attaches the utmost importance to compliance with data protection regulations. In this Privacy Policy, we describe which of your personal data is collected by VTIS during your visit to our website and when using our VTIS Shop, how we use this data, and what rights you have with regard to this data.

If you have any questions about data protection, please contact our Data Protection Officer by email at: datenschutz@vtis.de or by post at:

VTIS GmbH
Data Protection Officer
Nikolaus-Groß-Straße 31
D-44329 Dortmund

2. Controller

The controller responsible for collecting and processing your personal data on this website is VTIS GmbH, Nikolaus-Groß-Straße 31,
44329 Dortmund.

3. Use of our website and contacting us

3.1 You can generally use our website without providing personal data. If personal data (e.g., name, address, or email address) is collected on our pages, this is always done on a voluntary basis wherever possible.

3.2 If we evaluate your usage behavior on our website without your explicit consent, we use your data exclusively in
anonymized or pseudonymized form. This data includes, for example, the date and time you accessed our website, your browser type, browser settings and operating system, the last page you visited, the amount of data transferred, and your IP address. Your internet service provider can track which IP address was assigned to you at what time. Since the full IP address therefore allows at least an indirect personal reference, we record your IP address only in shortened (anonymized) form, so that it is not possible for us to identify you.

3.3 When you contact us by email or via a contact form, the data you provide (e.g., your email address, phone number) is stored by us in order to answer your questions. We delete the data arising in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply.

4. Contacting us to conclude a data processing agreement with you

On our website, you have the option to conclude a data processing agreement pursuant to Art. 28 GDPR. A contact form is available for this purpose, in which you can enter the following data: company name, contact person, customer no., email address, and message to us. If you enter the data and give us your consent, the data entered in the input form will be transmitted to us and stored. Before submitting, we also refer you to this Privacy Policy.
Alternatively, you can contact us via the email address provided: avv@vtis.de. In this case, the personal data transmitted by you with the email will be stored.
In this context, the data will not be passed on to third parties. The data is used exclusively for processing and preparing a data processing agreement pursuant to Art. 28 GDPR.
The legal basis for processing the data, where you have given consent, is Art. 6(1)(a) GDPR.
The legal basis for processing the data transmitted in the course of sending your email is Art. 6(1)(f) GDPR. If the email contact aims at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.
The processing of personal data from the input form serves us solely to handle the contact request and to prepare a data processing agreement with you. In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.
The other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our IT systems.
You may revoke your consent to the processing of personal data at any time. If you contact us by email, you may object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.

5. Use of the VTIS Shop (shop.vtis.de)

5.1. You can visit our shop at any time without providing information about your person. If individual functions and services offered via our website require the provision, storage, and use of personal data, you will be specifically informed of this in advance.

5.2. If we evaluate your usage behavior in our shop without your explicit consent, we use your data exclusively in anonymized or pseudonymized form. This data includes, for example, the date and time you accessed our website, your browser type, browser settings and operating system, the last page you visited, the amount of data transferred, and your IP address. Your internet service provider can track which IP address was assigned to you at what time. Since the full IP address therefore allows at least an indirect personal reference, we record your IP address only in shortened (anonymized) form, so that it is not possible for us to identify you.

6. Applications

You can apply for open positions with us by email. The purpose of data collection is to select applicants with a view to potentially establishing an employment relationship. To process your application, we collect the data you provide (generally first and last name, email address, application documents such as certificates and CV, date of earliest possible job start, and salary expectations). We would like to point out that confidentiality cannot be guaranteed if applications are sent by unencrypted email. As a rule, you can also apply for our positions by post or directly on site. The legal basis for processing your application documents is Art. 6(1) sentence 1(b) and Art. 88(1) GDPR in conjunction with Section 26(1) sentence 1 BDSG.
We store your personal data upon receipt of your application. If we accept your application and an employment relationship is established, we store your applicant data for as long as it is required for the employment relationship and insofar as legal provisions establish an obligation to retain it. If we reject your application, we store your applicant data for a maximum of six months after rejecting your application, unless you give us your consent to longer storage. If you have given us separate consent, we will store the data transmitted as part of the application in our applicant pool for a further twelve months after completion of the application process in order to identify any other suitable positions for you and, if necessary, contact you again. After the period expires, the data will be deleted. You can revoke this consent at any time with effect for the future by sending us an email to info@vtis.de.

7. Legal basis for processing personal data

• Where we obtain the data subject’s consent for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
• When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures.
• Where processing of personal data is necessary to comply with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
• In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
• If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and freedoms of the data subject do not override the former interest, Art. 6(1)(f) GDPR serves as the legal basis for processing.

8. Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place beyond this if provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or deleted when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

9. Disclosure of your data to third parties

Your data will not be passed on to third parties unless we are legally obliged or entitled to do so, or you have expressly consented to the disclosure of your data in advance.

10. Processing of data on behalf / commissioned processing

We work with service providers who process certain data on our behalf. This is done exclusively in accordance with the applicable data protection law. In particular, we have concluded data processing agreements with our service providers that meet the requirements of the EU General Data Protection Regulation. Through careful selection and regular monitoring, we ensure that our service providers take all organizational and technical measures required to protect your data.

11. Right of access, deletion, correction

You have the following rights vis-à-vis us with regard to your personal data:

11.1. Right to confirmation:

Every data subject has the right to obtain from the controller confirmation as to whether personal data concerning them is being processed. If a data subject wishes to exercise this right to confirmation, they may contact our Data Protection Officer or another employee of the controller at any time.

11.2. Right of access

Every data subject affected by the processing of personal data has the right to obtain from the controller, at any time and free of charge, information about the personal data stored about them and a copy of this information. If a data subject wishes to exercise this right of rectification, they may contact our Data Protection Officer at any time.

11.3. Right to rectification

You have the right to obtain from VTIS without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

11.4. Right to erasure (right to be forgotten)

Every data subject affected by the processing of personal data has the right to obtain from the controller the erasure of personal data concerning them without undue delay, where one of the following grounds applies and insofar as processing is not necessary:
The personal data has been collected or otherwise processed for purposes for which it is no longer necessary; the data subject withdraws consent on which the processing was based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing; the data subject objects to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR; the personal data has been processed unlawfully; erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject; or the personal data has been collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.

11.5. Right to restriction of processing

Every data subject affected by the processing of personal data has the right to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
• The processing is unlawful, the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
• The controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise, or defense of legal claims;
• The data subject has objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

11.6. Right to data portability

Every data subject affected by the processing of personal data has the right to receive the personal data concerning them in a structured, commonly used, and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to which the personal data has been provided, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, in exercising their right to data portability pursuant to Art. 20(1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

12. Right to lodge a complaint

If you believe that data is being processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.

13. Objection to or withdrawal of consent for the processing of your data

If you have given consent to the processing of your data, you can withdraw it at any time. Such a withdrawal affects the lawfulness of the processing of your personal data after you have notified us of it.
Where we base the processing of your personal data on a balancing of interests, you may object to the processing. This is the case if the processing is not necessary, in particular, for the performance of a contract with you, as we describe in each case below when explaining the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we do. In the event of your justified objection, we will examine the situation and will either stop or adjust the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.

14. Server log files

Server log files are anonymized data that is collected when you access our website. This information does not allow any conclusions to be drawn about you personally, but for technical reasons it is indispensable for delivering and displaying our content. It also serves our statistics and the ongoing optimization of our content. Typical log files include the date and time of access, the amount of data, the browser used for access and its version, the operating system used, the domain name of the provider you commissioned, the page from which you came to our offering (referrer URL), and your IP address. Log files also enable precise checks in the event of suspected unlawful use of our website.

15. Google Analytics

We use Google Analytics to analyze the use of our website. Google Analytics is a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies” to create pseudonymized user profiles. Cookies are small text files stored by your web browser that enable your web browser to be recognized.
The information generated by the cookie about your use of our website is transmitted to a Google server in the USA and stored there. Google will use this information on our behalf to evaluate your use of our website, to compile reports on website activity for us, and to provide other services related to website and internet usage for the purposes of market research and demand-oriented design of our website.
The IP address automatically transmitted by your browser to Google as part of Google Analytics is not merged with other Google data. Since IP anonymization is also activated on this website, your IP address is shortened within the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA.
You can prevent the storage of cookies by adjusting your web browser settings accordingly. However, we would like to point out that in this case you may not be able to use all functions of our website to their full extent.
In addition, you can prevent the collection of the data generated by the cookie and related to your use of our website as well as the processing of this data by Google on all websites by downloading and installing a browser add-on provided by Google.
Further information on Google Analytics can be found in Google’s privacy information, available here: http://www.google.com/intl/de/analytics/privacyoverview.html
Please click the following button to deactivate Google Analytics for this website. You must repeat this action on other websites of our company. Likewise, if you visit this website with a different browser, you will need to click the button again:

16. Map services (Google Maps)

We use Google Maps on the contact page to display geographical information in a visually appealing way. Google Maps is a map service provided by Google Inc. (“Google”). In order for the Google map material we use to be integrated and displayed in your web browser, your web browser must connect to a Google server when you access the contact page, which may also be located in the USA. This provides Google with the information that the contact page of our website was accessed from your device’s IP address.
The use of Google Maps is in the interest of an appealing presentation of our online offerings and to make it easy to find the locations specified by us on the website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.
More information on how user data is handled can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.

17. YouTube

Our website uses plugins from the YouTube site operated by Google. The site is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our pages equipped with a YouTube plugin, a connection to YouTube’s servers is established. In doing so, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account. Further information on how user data is handled can be found in YouTube’s Privacy Policy at https://www.google.de/intl/de/policies/privacy
When embedding YouTube videos, we use the so-called “enhanced privacy mode”. This allows YouTube videos to be embedded without using cookies. However, due to the large number of embedded videos, it may happen that videos have also been embedded without the enhanced privacy mode. In this case, the previous paragraph applies.

18. Cookies

Our website uses cookies that collect your data exclusively using pseudonyms. Cookies are data packets generated by a web server and stored on your computer’s hard drive when your computer communicates with the web server. With the help of cookies, we create, among other things, usage profiles for the purposes of advertising, market research, and demand-oriented design of the website. This is done exclusively using pseudonyms. Regardless of the type of cookies used, you can decide whether you want to accept cookies or not. You can set your browser to notify you when you receive a cookie, or you can exercise your existing statutory right to object to the use of cookies by rejecting cookies in your browser settings. Cookies that have already been stored can be deleted using the corresponding function in your browser. For details, please refer to your internet browser’s help function. Please note that you may not be able to fully use the range of website functions if you do not accept cookies.

You can change your selected cookie settings at any time. Please use the following button:

19. Customer survey

We conduct anonymous customer surveys to improve our services. We need your support for this. We would like to know whether you are satisfied with our service, friendliness, reliability, professional expertise, and our team’s project management/planning.

Your opinion is important to us. We assure you that we conduct the survey completely anonymously and do not collect any personal data from you.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to further optimize our services.

20. Ordering GDPR notice signs

On our website, you have the option to order notice signs for your video surveillance from our partner “Bauer & Frischluft Werbung”, info@bauer-frischluft-werbung.de or 0 94 51 / 94 30 20.

For this reason, an iFrame is used on our website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The iFrame embeds our partner “Bauer & Frischluft Werbung”’s contact form. Data sent via this form is transmitted directly to “Bauer & Frischluft Werbung” and is not stored by us. This is done via a secure SSL connection.

21. Use of SalesViewer technology

On our website, data is collected and stored for marketing, market research, and optimization purposes using SalesViewer® technology. For this purpose, a JavaScript-based code is used to collect company-related data and use it accordingly. The data collected with this technology is encrypted using a non-reversible one-way function (so-called hashing). The data is immediately pseudonymized and is not used to personally identify visitors to our website. The data stored as part of SalesViewer is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. You can object to the collection and storage of data at any time with effect for the future by clicking this link https://www.salesviewer.com/opt-out to prevent SalesViewer® from collecting data on this website in the future. An opt-out cookie will be stored on your device for this website. If you delete your cookies in this browser, you must click this link again. The basis for using SalesViewer technology is our legitimate interest pursuant to Art. 6(1)(f) GDPR.
For more information, please refer to the SalesViewer GmbH Privacy Policy at https://www.salesviewer.com/de/datenschutzerklaerung/.

22. Video surveillance on the premises of VTIS GmbH

• Video surveillance is carried out on the premises of VTIS GmbH.
• Purpose and legal basis for data processing:
• Protection of property and enforcement of house rules
• Protection against violence against facilities (vandalism damage).
• Securing evidence to clarify liability claims.
• The legal basis for processing is Art. 6(1)(f) GDPR

The data subject has the right to obtain from the controller confirmation as to whether personal data concerning them is being processed; where that is the case, they have a right of access to such personal data and to the information listed in detail in Art. 15 GDPR. The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them and, where applicable, the completion of incomplete personal data (Art. 16 GDPR). The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay where one of the grounds listed in detail in Art. 17 GDPR applies, e.g., if the data is no longer needed for the purposes pursued (right to erasure). The data subject has the right to obtain from the controller restriction of processing where one of the conditions listed in Art. 18 GDPR applies, e.g., if the data subject has objected to the processing, for the duration of the controller’s review. The data subject has the right, on grounds relating to their particular situation, to object at any time to the processing of personal data concerning them. The controller shall then no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims (Art. 21 GDPR). Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to them infringes the GDPR (Art. 77 GDPR). The data subject may exercise this right with a supervisory authority in the Member State of their habitual residence, place of work, or the place of the alleged infringement.

The competent supervisory authority for NRW is: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia

P.O. Box 20 04 44

40102 Düsseldorf

Tel.: 0211/38424-0

Fax: 0211/38424-10

Email: poststelle@ldi.nrw.de