PRIVACY POLICY
Fronius International GmbH
I. GENERAL INFORMATION
PREAMBLE
We, Fronius, are a leading technical company in the fields of welding technology, photovoltaics and battery charging technology and a data controller within the meaning of the General Data Protection Regulation (GDPR) (hereinafter "Fronius").
This privacy statement applies to any form of processing of personal data by Fronius.
With the following, Fronius would like to inform you about which personal data Fronius processes, how and for what purpose it is used, and what rights data subjects are entitled to. All data is processed in compliance with the relevant legal regulations on data protection and data security.
You can view, download or print our current data protection declaration at any time on our website. The data protection declaration also constitutes an integral part of our terms of use and/or webshop conditions, which are also made available on our website.
CATEGORIES OF PERSONAL DATA
We process the following categories of data or parts thereof. Which personal data is specifically processed depends on your relationship with us. You will find more detailed information on this in chapters III. and IV.
| Data category: | Description: | Data such as: |
|---|---|---|
| Name | Data, for the direct identification of a person | First name, middle name, last name, title, salutation |
| Contact Details | Data that we use to contact you or to reach you; other information necessary for addressing you that results from modern communication technologies | Street, Number, Postcode, City, Township, Address, Country, State, Time Zone, Phone Number, Email Address, Fax, Social. Media Account |
| Company Data | Data that is related to your professional contact with us or contains general information about the company | Company name, type of company, company register data, professional function and position, occupational group, job title, job category, decision-maker status, scope of representative authority, notes on the person, the business cases or projects you have handled with us |
| Personal Data | Data, about your person | Language, citizenship, date of birth, gender |
| Contract Data | Data in connection with the establishment, processing, execution and termination of a legal relationship with you or a company | Beginning, end, duration of a legal relationship, communication regarding the creation and execution of a contract, customer number, offers, orders, contracts and other agreements between you and us, customs documents, customs clearance and export control data |
| IT data | Data that arises from the fact that you register with our online services or visit our website | In addition to name and contact details, user name, password, double opt-in data, user ID, IP address, log files, if applicable |
| Cookies | Cookies are small data packets that are exchanged between your browser and our web server when you visit our website | For information on cookies, see our Cookie Policy and the information contained in the special section of this Privacy Policy |
| Visit data | Data we process when you visit one of our sites or attend one of our events | Visit or event date, visitor group, guest list, visit location, travel data |
| Image Data | Data that capture the outward appearance of a person through photography or video | Identity, appearance, behavior, time and place of the image recording |
| Product usage and system data | Data collected when our products are used as well as system and device data | Plant name, plant identification, commissioning date/time, plant power, manufacturer, module type, plant description, plant image, power and other device data |
| Position data | Data allowing localization | Coordinates (longitude, latitude, altitude) |
| Interaction and correspondence data | Data that arise during communication with us | Date and time, contacts, contents of e-mails and other communication tools such as MS Teams, Skype, etc., customer appointments |
| Content data | Data contained in documents, messages, recordings, documentation | Information on persons, cases, products, etc. |
| Bank and financial data | Data arising in connection with the processing of cash and payment flows as well as their correct accounting and tax treatment, including data on financial status | IBAN, tax number, delivery block dunning data, shareholdings, UID number and Intrastat identification number, dunning data and blocking indicators (e.g. invoice, delivery or payment block), bonus and commission data, creditworthiness data |
| Application data | Data that we process as part of your application to Fronius | Application, Intended employment and start date, Serial number(s), Dates of education, Work experience, Curriculum vitae, Special job requirements, Language skills, Test results, Master data, Photograph, Certificates, Cover letter |
| Special categories of personal data* | data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation | Health data, data related to criminal offences |
| Data subject | in the event of an assertion of the data subject rights within the meaning of the GDPR | Category of data subject, nature and content of the request, proof of identification, completion of the request, date of contact and completion; declarations of consent |
If necessary, further personal data are processed if this is required for the specific purpose.
In the event that Fronius also processes special categories of personal data, so-called sensitive data (e.g. health data), the processing is either based on your express consent (Art 9 para. 2 (a) GDPR) or it is necessary for the assertion, exercise or defense of legal claims (Art 9 Para. 2 (f) GDPR).
PURPOSE OF THE PROCESSING
| Processing purpose | Description of the purposes of processing |
|---|---|
| Research & Development | Processing in connection with our research collaborations and projects, including IP and grant management |
| Purchasing, production and logistics | Processing for the purchase of components and equipment as well as accessories, for the manufacture of our products and maintenance of the legal and normative conformity requirements for these, as well as for the fulfilment and execution of supply contracts with customers and suppliers, including the execution of the logistical processes along the supply chain |
| Provision of online services and software for customers | VProcessing for the provision of online services and software to customers to enable them to make the best use of Fronius products and to improve them, make them more user-friendly, find and rectify faults more quickly, control server capacity and analyses statistics relating to system and device data |
| Customer service and sales as well as customer support | Processing for the initiation and handling of business with customers in connection with our products, including the maintenance of a group-wide customer and supplier database; processing in the event of customer concerns as well as warranty and guarantee claims |
| Corporate Communications | Processing for communication with business partners, customers and interested parties, employees, former employees and the public; as well as operation and use of the website, including marketing |
| Event Management | Processing for the organization and handling of our events and visits as well as for the organization of external events (e.g. congresses, trade fairs) and the participation of our employees and visitors (customers, suppliers) |
| Quality Management | Organization and documentation of an orderly audit system as well as improvement processes |
| Safety, cleanliness and environmental protection at our sites | Processing for the operation of environmental, health and safety management systems, as well as the administration of the access system and video surveillance at our sites |
| Project / Change Management | Processing for the collection, evaluation and implementation of improvement ideas, measures and projects |
| IT Management | Processing for the operation of our IT systems and protection of the IT systems through appropriate technical and organizational measures (risk management) |
| Bookkeeping and accounting | Processing for accounting purposes, including accounting and the preparation of financial statements and accounting, compliance with tax obligations |
| Legal | Processing in connection with legal matters internally, as well as by external legal advisors, including document management |
| Candidate Management | Processing for the purpose of personnel search and implementation of the application procedure, processing of related correspondence and documents including possible keeping of records |
| Internal organization and traceability and internal management purposes | Processing for filing and data backup, for internal organization and structure of all processes and work activities |
| Compliance Management | Processing for compliance with legal regulations and guidelines as well as for the prevention of rule violations |
The processing of your personal data is necessary to achieve the purposes listed above. Failure to provide it could, depending on the category of data, result in us not being able to fulfil the listed purposes in accordance with the contract and the law, a smooth business process is not possible or we are unable to carry out the pre-contractual activities or conclude and implement the contractual relationship with you or your employer.
LEGAL BASES OF PROCESSING
Fronius processes your personal data within the meaning of Art 6 GDPR on the basis of the following legal grounds:
- fulfilment of a contractual relationship or implementation of pre-contractual measures (Art 6 Para. 1 lit b GDPR),
- fulfilment of a legal or statutory obligation (Art 6 Para. 1 lit c GDPR),
- protection of the legitimate interests of Fronius or a third party (Art 6 Para. 1 lit f GDPR) or
- if none of the aforementioned legal grounds apply, on the basis of the consent of the person concerned to the processing of their personal data (Art 6 Para. 1 lit a GDPR).
Fronius processes personal data primarily in the context of a business relationship with the data subject or with a company represented by the data subject, in particular in the area of contractual and pre-contractual relationships (Art. 6 Para. 1 lit b GDPR).
Furthermore, personal data is processed if necessary to comply with a legal or statutory obligation to which Fronius is subject (e.g. storage and documentation obligations under national laws and reporting obligations as an employer to the social security authorities) (Art. 6 Para. 1 lit c GDPR).
The processing of personal data on the legal basis of Art. 6 Para. 1 lit f GDPR is generally based on the following legitimate interests of Fronius:
- Safeguarding operational interests such as the internal administration and optimization of business processes (document, file, customer and supplier management), data backup and ensuring smooth business operations,
- Improvement and further development of our products and troubleshooting,
- assertion, exercise or defense of legal claims,
- Containment of damage,
- Carrying out direct advertising (marketing and information activities, in particular about products and services offered by the person responsible),
- IT security and technical administration when using our systems such as internet access, communication tools, means of collaboration (telephone, email, video conferencing, instant messaging),
- Operation of a group-wide customer and supplier management system
- Event planning, invitation and coordination,
- Building security and ensuring general security on company and company premises
Personal data is only processed to protect the legitimate interests of Fronius if there is no reason to assume that the interests of the data subject merit protection.
Personal data may also be processed on the basis of the data subject's consent to processing, which consent may be revoked at any time (Art. 6 Para. 1 (a) GDPR). In this case, the personal data of the data subject is processed for the processing of which the data subject has given prior consent, such as the publication of photographs of the data subject for documentation or advertising purposes or the processing of his or her personal contact data for the purpose of sending newsletters.
Insofar as data is not collected from the data subject himself/herself within the meaning of Article 14 of the GDPR, personal data that can be accessed in publicly accessible databases such as the land register, company register, central register of associations, edict file, central register of residents, credit rating databases), as well as information on the data subject may be collected from search engines, social networks or various websites, from Fronius Group companies or from cooperation partners or from any funding bodies.
In order to guarantee the security of the personal data of the data subjects, Fronius has taken a number of technical and organizational measures as defined in Art. 32 DSGVO, in particular encryption of the services using state-of-the-art encryption methods (e.g. SSL), user authentication controls, secure network infrastructures, restriction of access to personal data, network monitoring solutions, area-restricted alarm systems as well as video surveillance, employee conduct instructions, obligation to maintain data secrecy. A list of technical and organizational measures at Fronius can be found
here.
Fronius does not process personal data for automatic decision-making or profiling.
RECIPIENTS OF PERSONAL DATA
In order to achieve the intended purposes or if there is a legal obligation to do so, it may be necessary on a case-by-case basis for us to transfer and disclose your data to recipients (e.g. authorities/public bodies, courts, banks, higher-level group companies, etc.) or to grant service providers access to your data (e.g. in order to carry out data management on our behalf, to use software and IT infrastructure, for support and maintenance purposes). The transfer of the relevant data in each individual case is based on the legal provisions or contractual agreement or, in part, on your (express) consent.
We only work with third parties who offer sufficient guarantees that your data is in safe hands.
These are the following categories of recipients within the meaning of Art 13 para 1 lit e GDPR:
- Fronius Group companies (in particular the subsidiaries listed at https://www.fronius.com/de/ueber-fronius/locations),
- Processors, insofar as they require the data for the performance of their respective services,
- Authorities, public bodies and institutions in the event of a legal obligation,
- Operators and participants of creditworthiness-related information systems for the purpose of creditor protection and risk minimization,
- Third-party providers and cooperation partners (e.g. customers, suppliers, payment service providers),
- Credit and financial institutions or similar entities,
- Legal and tax advisers and experts for the examination, assertion, exercise or defense of legal claims,
- Courts to assert, exercise or defend legal claims.
Personal data may be transferred to countries outside the EEA in order to carry out pre-contractual measures or in performance of a contract with the data subject or the company represented by the data subject, in particular by Fronius group companies or due to the use of cloud solutions for communication and collaboration, for video conferencing, for maintaining information and data security and for customer care and a corresponding customer relationship management system. Where appropriate, personal data may also be processed when used for promotional purposes on social media channels (e.g. Facebook, Instagram) or websites outside the EEA.
Such a transfer outside the EEA may take place on the basis of binding internal data protection rules under Art 47 GDPR, adequacy decisions of the European Commission under Art 45 GDPR or standard data protection clauses under Art 46 Para. 2 lit c and d GDPR. In exceptional cases, a data transfer may also take place on the basis of Art 49 GDPR, either because you have expressly consented to the proposed data transfer after having been informed of the potential risks to you of such data transfers without the existence of an adequacy decision (Art 45 GDPR) and without appropriate safeguards, the transfer is necessary for the performance of a contract between you and Fronius or for the performance of pre-contractual measures at your request, or the transfer is necessary for the conclusion or performance of a contract concluded in your interest by Fronius with another natural or legal person.
Data transfer to the USA / discontinuation of the Privacy Shield
Fronius would like to expressly point out that since 16 July 2020, due to the "Schrems II" decision of the European Court of Justice, the so-called "Privacy Shield", an adequacy decision of the EU Commission pursuant to Article 45 of the GDPR, with which the USA was confirmed an adequate level of data protection under certain circumstances, is no longer valid with immediate effect.
Since then, the Privacy Shield does not constitute a valid legal basis for the transfer of personal data to the USA!
If, in the context of data processing at Fronius, a transfer of data to the USA takes place, cannot be ruled out, or if we use a service provider based in the USA, we refer to this explicitly in this data protection declaration (see in particular the description of the technologies used on our website).
For you as a user, the transfer of personal data to the USA entails risks. These result from the corresponding powers of the US intelligence services and the legal situation in the USA, which currently - in the opinion of the ECJ - no longer ensures an adequate level of data protection in the USA. The issues include:
- Section 702 of the Foreign Intelligence Surveillance Act (FISA) provides no restrictions on the surveillance activities of the intelligence services and no safeguards for non-US citizens.
- Presidential Policy Directive 28 (PPD-28) does not give data subjects effective remedies against actions taken by US authorities and does not provide for barriers to ensure proportionate measures.
- The Ombudsman provided for in the Privacy Shield does not have sufficient independence from the executive; he cannot issue binding orders against the intelligence services.
Legally compliant transfer of data to the USA based on the standard contractual clauses
The standard contractual clauses adopted by the European Commission in 2010 (2010/87/EU of 05.02.2010), Art. 46 (2) c GDPR, are still valid, but a level of protection for personal data must be ensured that corresponds to that in the European Union. Therefore, not only the contractual relationships with our service providers are relevant here, but also the possibility of access to the data by authorities in the USA and the legal system there (legislation and jurisdiction, administrative practice of authorities).
By implementing decision of 4 June 2021 (2021/914), the European Commission has now adopted new standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
By the end of 30.09.2021, only the new standard contractual clauses for the transfer of personal data to third countries may be applied; previously agreed standard contractual clauses (2010/87/EU of 05.02.2010) must be updated by 31.12.2022.
The standard contractual clauses cannot bind authorities in the U.S. and therefore do not yet provide adequate protection in cases where authorities are empowered under U.S. law to interfere with the rights of data subjects without additional action by us and our service provider.
Our measures to make data transfers to the USA legally compliant
Wherever possible, we always choose to process data on EU servers. This should technically ensure that the data is located within the European Union and the risk of access by US authorities is largely minimized.
With US service providers, we strive to conclude standard contractual clauses and to demand additional guarantees. In particular, we demand, where possible, the use of technologies that prevent access to data, e.g. the use of encryption that cannot be broken even by US services, or anonymization
or pseudonymisation of the data, so that only Fronius or the service provider can make the assignment. At the same time, we require that the service provider inform us immediately if access to data by third parties is actually requested or occurs, and that the service provider exhaust all legal remedies against requested access to Fronius data. We contractually obligate our service providers or processors, including their subcontractors, to transfer data outside the EU exclusively in compliance with the principles for data transfers pursuant to Art. 44 et seq. of the Data Protection Regulation (GDPR) and to oblige the subcontractors to comply with the data protection level of the GDPR.
STORAGE PERIOD/DELETION
We store your data for different lengths of time depending on the existence of a legitimate processing purpose.
As a rule, we process your information for the duration of the entire business relationship (from the initiation, processing to the termination of a contract, as well as until the termination of any information interest on your part). In addition, we store your data in compliance with and within the scope of the statutory retention and documentation obligations, the applicable warranty, guarantee and limitation periods, in the event of legal disputes in which the data is required as evidence, until their termination.
Individual retention periods can be found in the special information on data processing. Our retention periods, in each case from the time the data is created, are based on the following principles:
- Data that do not need to be kept for longer for verification purposes will be deleted after 6 months.
- Data that is required for verification purposes and / or is the basis for legal claims that are subject to a limitation period of 3 years (e.g. damages, warranty) and there is no justification for a longer storage, we delete after 3 years.
- Data whose storage is necessary for verification purposes, in particular correspondence and its contents, will be deleted after 5 years.
- Data whose storage is necessary for purposes relevant to accounting, tax law or customs law, as well as on the basis of subsidies or in the event of the assertion of purchase price, performance or special claims for damages or liability (e.g. product liability), shall be stored for a period of 10 years.
- Data whose retention is necessary for the fulfilment of warranty services and their traceability is retained for a period of 20 years (this period corresponds to the longest warranty period at Fronius).
- The deletion of personal data which are necessary, for example, for the issuing of a reference or which are necessary for the assertion, exercise or defense of legal claims, in particular with regard to an absolute limitation period of 30 years, may in these special cases also take place after 30 years - always taking into account the purpose of the processing.
In the case of consent to data processing (in particular when sending electronic messages), the data is stored - with the exception of other details in the consent text - until revocation by the person concerned, which is possible at any time, whereby the revocation does not affect the processing that has taken place up to this point in time.
RIGHTS OF PERSONS CONCERNED
Data subjects have the following rights at any time:
/ Right to request
You have the right to request information about your personal data that we process at any time within the scope of Art. 15 GDPR.
/ Right to rectification and completion
Should your personal data be incorrect or incomplete, you have the right to rectification and completion within the scope of Art. 16 GDPR.
/ Right to restriction of processing
If the legal requirements are met, you may request restriction of the processing of your personal data within the scope of Art. 18 GDPR.
/ Right to erasure
You may request the erasure of your personal data at any time within the scope of Art. 17 GDPR, unless we are legally obliged or entitled to continue processing your data.
/ Right to data portability
If processing takes place on the basis of a contract or your consent and with the help of automated processes, you have a right to the transfer of the personal data concerning you in a structured, common and machine-readable format within the scope of Art. 20 GDPR, provided that this does not affect the rights and freedoms of other persons.
/ Right to object
You have the right to object to processing within the scope of Art 21. GDPR, insofar as the data processing is carried out for the purposes of direct marketing or profiling. You may object to processing on the basis of a balance of interests by stating the reasons arising from your particular situation.
/ Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
/ Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR, in particular in the Member State of your residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority to which the complaint has been lodged will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR. The data protection authority or supervisory authority responsible for us can be found below in the contact details.
To exercise your rights as a data subject, please contact us - by post, e-mail or fax - at the address given below. Your request or your data will be processed without affecting the lawfulness of the processing carried out up to the receipt of your request and insofar as the processing is reasonable for Fronius.
II. INFORMATION ON INDIVIDUAL DATA PROCESSING
1. NEWSLETTER
Categories of personal data that Fronius collects and processes as part of this data processing:
- Name (such as first name, last name, name affixes, salutation)
- Contact details (such as e-mail address, if applicable also address, (mobile) phone number, if applicable company data: E-mail address, address)
- where applicable, data subjects and IT data (consent and double opt-in status)
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ Fulfilment of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purposes of initiating pre-contractual measures or fulfilling the obligations arising from a contract concluded with you (such as determining the winner of competitions, authentication for the use of our services, granting extended (warranty) rights) or on the basis of the terms and conditions accepted by you.
/ on the basis of your consent (Art 6 para 1 lit a GDPR)
Consent to the processing of your personal data for the purpose of sending newsletters can be revoked by you at any time with effect for the future. Consents granted before the applicability of the GDPR (25 May 2018) can also be revoked. Processing that took place before the revocation remains unaffected by the revocation.
/ Safeguarding of legitimate interests of Fronius within the framework of the balancing of interests (Art 6 para 1 lit f GDPR)
the purposes of the processing result from the safeguarding of our legitimate interests. Our legitimate interest may be used to justify the further processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. Our legitimate interest here lies in sending information and offers about our products to existing customers, users of our offers and services as well as interested parties.
Duration of processing (criteria for deletion)
the data will generally be stored and processed until the contractual relationship has been completed and beyond that for the purposes of sending the newsletter until you object to the sending of the newsletter or revoke your consent. We will inform you separately about this circumstance in the course of registration or in our terms and conditions.
Consent to the use of your e-mail address for advertising purposes can be revoked at any time with future effect by clicking on the "Unsubscribe" or "Newsletter unsubscribe" link at the end of the newsletter or by sending a message to cancellation(at)fronius.com with the revocation of your consent.
The data for the newsletter dispatch will be stored at the longest until you unsubscribe from the newsletter. We are entitled to check the authenticity and accuracy of your e-mail address on the basis of your other details.
Supplementary information on this data processing
You can receive a newsletter from Fronius if you have given us your consent to do so, if you are an existing customer, or if we process your personal data in return for providing you with our offers.
/ Consent: If you have given your consent to receive interesting offers and news from Fronius by e-mail on a regular basis, we will send you regular newsletters on the basis of this consent until your consent is revoked.
/ Existing customers: We will only send newsletter e-mails to existing Fronius customers if we have received their contact information for newsletter distribution in connection with the sale or provision of a service to you, and we have informed you at the time of collection and any subsequent transmission that you may opt out of the use of their contact information for this purpose, and provided you are not included in the list pursuant to Section 7 (2) of the E-Commerce Act.
/ Data for the use of our offers: You may also provide us with your personal data in return for the use of our offers or services such as
- the participation in a lottery,
- to gain access to our contents,
- the use of our online services, software or apps, or
- the product registration for extended warranty rights
and by accepting the relevant terms and conditions (of participation, use, business or otherwise) for processing for the regular receipt of newsletters about Fronius products and services for promotional purposes by e-mail.
Your e-mail address will not be passed on to third parties for advertising purposes.
2. ONLINE CONFERENCES AND WEBINARS
Categories of personal data that Fronius collects and processes as part of this data processing:
- Name (such as first name, last name, name affixes, salutation)
- Contact details (such as e-mail address, if applicable also address, (mobile) phone number, if applicable company data: E-mail address, address)
- IT data (such as username, password, IP address, log files)
- Image data, if applicable
- Interaction and correspondence data
- Content data
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ Fulfilment of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purpose of initiating pre-contractual measures or for the fulfilment of obligations arising from a contract concluded with you (such as the discussion of contractual content or processing in online conferences or the holding of a webinar booked by you) and on the basis of the conditions accepted by you.
/ On the basis of your consent (Art 6 para 1 lit a GDPR)
the purposes of the processing of personal data may result from the participant's consent (as in the case of a recording or a separate request for consent). Consent given for the processing of your personal data can be revoked by you at any time with effect for the future. Consents granted before the applicability of the GDPR (25 May 2018) can also be revoked. Processing that took place before the revocation remains unaffected by the revocation.
/ Safeguarding Fronius' legitimate interests in the context of the balancing of interests (Art 6 (1) (f) GDPR)
the purposes of the processing result from safeguarding our legitimate interests. Our legitimate interest may be used to justify the processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. Our legitimate interest here, in the case of open webinars, unless a contractual relationship has arisen through participation in the webinar, is to conduct a webinar and provide information to a wide audience. Legitimate interests may also lie in the further processing for documentation purposes after the conclusion of online conferences or seminars.
Duration of processing (criteria for deletion)
The processing of the data provided by you is carried out for as long as it is necessary to achieve the contractually agreed purpose, in principle for as long as the contractual relationship with you exists. After termination of the contractual relationship, the data provided by you will be processed to comply with statutory retention obligations or on the basis of our legitimate interests. After the expiry of the statutory retention periods and/or the lapse of our legitimate interests, the data provided by you will be deleted.
Supplementary information on this data processing
When using our tools, various types of data are processed. The scope of the data also depends on the data you provide before or when participating in an "online meeting".
In order to join an online meeting, you must provide a name; you may also choose a pseudonym. This information is stored temporarily in the browser and used for future access to online events.
In order to enable the display of video and the playback of audio, data from the microphone of your terminal device and from a video camera of the terminal device are processed during the meeting. Access can be disabled at any time using the buttons with the respective icons. Participation in online events is generally possible even if access is deactivated. It is also possible to exchange text messages in a group chat. The messages are then visible for all participants of the online event.
If a participant's screen is transferred during an event, the displayed screen content is shown to all other participants in the online meeting. Each participant should therefore ensure that no sensitive data is displayed on the screen before using the function. The screen sharing function can be deactivated at any time using the corresponding button.
In the event that we record online meetings, we will notify you before the recording begins and - if necessary - ask for verbal consent. If you do not wish to be recorded, you can leave the online meeting. If online meetings are being recorded, this will be indicated by a recording icon in the screen area. In this case, all video and audio data will be stored by us.
Online conferencing tools at Fronius and recipient
We use Microsoft Teams and Skype internally and externally to carry out our daily office communications and for conference calls, online meetings and/or video conferences. For webinars, we also use GotoWebinar.
To participate in an online meeting or a webinar, a participant receives an e-mail containing an invitation link. The e-mail address was either provided to us by the external participant or collected by us during registration for an online meeting or webinar. Fronius employees use their company contact data to participate in online meetings.
Microsoft Teams:
To conduct online meetings and host webinars, we use the Microsoft Teams service provided by Microsoft Ireland Operations, Ltd, South County Business Park Leopardstown, Dublin 18, D18 P521, Ireland, an affiliated company of Microsoft Cooperation, Redmond, WA, USA, https://www.microsoft.com/de-at/microsoft-teams/group-chat-software ("MS Teams").
ATTENTION: Within the scope of this service, data transmission to the USA takes place or cannot be ruled out.
Skype for Business:
To conduct online meetings and host webinars, we use the Skype service provided by Microsoft Ireland Operations, Ltd, South County Business Park Leopardstown, Dublin 18, D18 P521, Ireland, an affiliated company of Microsoft Cooperation - Redmond, WA, USA, https://www.skype.com/de/business/ ("Skype").
ATTENTION: Within the scope of this service, data transmission to the USA takes place or cannot be ruled out.
We have concluded an order processing agreement with Microsoft (MS Teams & Skype). For the processing of data in the USA, the level of protection is guaranteed through the use of the EU standard contractual clauses.
Further information on data protection can be found at https://privacy.microsoft.com/privacystatement on the use of this service.
GotoWebinar:
To conduct online meetings, and in particular to host webinars, we use the GotoWebinar service provided by LogMeIn Ireland Unlimited Company, an affiliate of LogMeIn Group LogMeIn, Inc. Boston, 320 Summer Street, Boston, MA 02210, USA.
ATTENTION: Within the scope of this service, data transmission to the USA takes place or cannot be ruled out.
We have concluded an order processing agreement with LogMeIn Ireland. For the processing of data in the USA, the level of protection is guaranteed through the use of the EU standard contractual clauses.
Further information on data protection can be found at https://www.logmein.com/de/trust/privacy on the use of this service.
3. COURSES, TRAINING und WEBINARS
Categories of personal data that Fronius collects and processes as part of this data processing:
- Name (such as first name, last name, name affixes, salutation)
- Contact details (such as e-mail address, if applicable also address, (mobile) phone number, if applicable company data: E-mail address, address)
- if applicable, company data (such as type and name of the company, professional function)
- Personal data (like language)
- Contract data, if applicable
- Visit data, if applicable
- bank and financial data, if applicable
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ performance of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purposes of initiating pre-contractual measures or for the performance of obligations arising from a contract concluded with you (or with your company/employer) (such as registration and participation in the relevant course offering or webinar, organization and communication, and implementation and completion of qualifications) and on the basis of the terms and conditions accepted by you.
/ To protect the legitimate interests of Fronius in the context of the balancing of interests (Art 6 para 1 lit f GDPR)
the purposes of the processing result from the protection of our legitimate interests. Our legitimate interest may be used to justify the processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. For example, our legitimate interest here may lie in the processing of your personal data for the purposes of organizing and holding courses and training sessions, both present and online, as well as in providing information about further course offerings.
Duration of processing (criteria for deletion)
The processing of the data provided by you is carried out for as long as it is necessary to achieve the contractually agreed purpose, in principle for as long as the contractual relationship with you exists. After termination of the contractual relationship, the data provided by you will be processed to comply with statutory retention obligations or on the basis of our legitimate interests. After the expiry of the statutory retention periods and/or the lapse of our legitimate interests, the data provided by you will be deleted.
Supplementary information on this data processing
Pathways to Fronius courses, training and webinarsFronius
offers its customers, business partners, employees and others the opportunity to attend courses, training or even webinars related to Fronius products. Completion of this offer can also be part of an agreement with business partners and a prerequisite for certifications by Fronius (such as certification as a "Certified Partner").
Recipients So far as
we organize courses, trainings or webinars together with partners of ours, you will receive information about this and we will share your personal data with them. For this purpose, we have concluded corresponding order processing contracts or joint responsibility contracts with our partners.
If courses or training sessions are held as webinars, the provisions set out under "Online Conferences and Webinars" shall apply in addition.
4. ONLINE-SERVICES, SOFTWARE AND APPS
Categories of personal data that Fronius collects and processes when you register to use our online services or apps:
- Name
- Contact details
- Company data
- Personal data
- Contract data
- IT data
- Product usage data (such as plant and equipment usage data)
- Position data
- Bank and financial data
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ Fulfilment of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purposes of initiating pre-contractual measures or fulfilling the obligations arising from a contract concluded with you (or with your company/employer) (such as provision of online services and software, authentication for the use of our services, granting of extended rights) and on the basis of the terms and conditions accepted by you.
The purposes of the processing of personal data may result from your consent to the processing of your data for the purposes of using our online services and software or our services. Consent given for the processing of your personal data can be revoked by you at any time with effect for the future. Consents granted before the GDPR (25 May 2018) came into force can also be revoked. Processing that took place before the revocation remains unaffected by the revocation.
/ Safeguarding Fronius' legitimate interests in the context of the balancing of interests (Art 6 (1) (f) GDPR)
the purposes of the processing result from safeguarding our legitimate interests. Our legitimate interest can be used to justify the processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. Our legitimate interest here is the provision of online services and software for our customers, optimization and expansion of our offer, improved customer service, corporate communication, in the internal administration and optimization of the business process, as well as in the improvement of our products and troubleshooting. After registering to use our online services, software and apps, Fronius also processes the data of your registered systems and devices in accordance with the applicable terms of use. In the process, usage data of your registered systems and devices is regularly transferred to Fronius for the purpose of analyzing this data and subsequently improving performance as well as our products. The system and device data is processed on the basis of Fronius' legitimate interest in using usage data from systems and devices registered with Fronius for analysis and improvement purposes.
Duration of processing (criteria for deletion)
the data is generally processed for the duration of the contractual relationship. After deactivation of your account, your personal data will be stored for 3 years for the purpose of reversing erroneous deactivation and a possible legal defense and then deleted.
In the event that you have given your consent to data processing, we will delete your data as soon as you revoke your consent.
Supplementary information on this data processing
Ways to our online services, software and apps
For the use of our online services, software and apps, an online registration by means of email address and password as well as, if applicable, the entry of your further data is required, in which the data is collected directly from you. In the course of registration, you accept the terms and conditions of the respective offer.
Recipients
Your data will not be passed on to third parties.
For the operation of our online services, software and apps, we use cloud solutions and service providers with whom we have concluded corresponding order processing agreements. Regarding data transfers to third countries, the information in the general section applies in addition.
After registering for our services, you can partially make your user name visible to other members. In addition, you can release or publish further data of your profile or your attachment and make it visible for other members. Within your profile, you have the option to adjust the extent to which your data is published by making the appropriate settings. It is at your discretion to decide which and to what extent this data is released or published for other users. Details are explained in more detail on the websites in the respective function of the respective online services and apps.
Fronius as a processor
Where our business customers are considered "controllers" when using our online services, software and apps and we are "processors" within the meaning of the GDPR, the order processing agreement available here for our business customers
applies.
PRIVACY POLICY
Fronius International GmbH
I. GENERAL INFORMATION
PREAMBLE
We, Fronius, are a leading technical company in the fields of welding technology, photovoltaics and battery charging technology and a data controller within the meaning of the General Data Protection Regulation (GDPR) (hereinafter "Fronius").
This privacy statement applies to any form of processing of personal data by Fronius.
With the following, Fronius would like to inform you about which personal data Fronius processes, how and for what purpose it is used, and what rights data subjects are entitled to. All data is processed in compliance with the relevant legal regulations on data protection and data security.
You can view, download or print our current data protection declaration at any time on our website. The data protection declaration also constitutes an integral part of our terms of use and/or webshop conditions, which are also made available on our website.
CATEGORIES OF PERSONAL DATA
We process the following categories of data or parts thereof. Which personal data is specifically processed depends on your relationship with us. You will find more detailed information on this in chapters III. and IV.
| Data category: | Description: | Data such as: |
|---|---|---|
| Name | Data, for the direct identification of a person | First name, middle name, last name, title, salutation |
| Contact Details | Data that we use to contact you or to reach you; other information necessary for addressing you that results from modern communication technologies | Street, Number, Postcode, City, Township, Address, Country, State, Time Zone, Phone Number, Email Address, Fax, Social. Media Account |
| Company Data | Data that is related to your professional contact with us or contains general information about the company | Company name, type of company, company register data, professional function and position, occupational group, job title, job category, decision-maker status, scope of representative authority, notes on the person, the business cases or projects you have handled with us |
| Personal Data | Data, about your person | Language, citizenship, date of birth, gender |
| Contract Data | Data in connection with the establishment, processing, execution and termination of a legal relationship with you or a company | Beginning, end, duration of a legal relationship, communication regarding the creation and execution of a contract, customer number, offers, orders, contracts and other agreements between you and us, customs documents, customs clearance and export control data |
| IT data | Data that arises from the fact that you register with our online services or visit our website | In addition to name and contact details, user name, password, double opt-in data, user ID, IP address, log files, if applicable |
| Cookies | Cookies are small data packets that are exchanged between your browser and our web server when you visit our website | For information on cookies, see our Cookie Policy and the information contained in the special section of this Privacy Policy |
| Visit data | Data we process when you visit one of our sites or attend one of our events | Visit or event date, visitor group, guest list, visit location, travel data |
| Image Data | Data that capture the outward appearance of a person through photography or video | Identity, appearance, behavior, time and place of the image recording |
| Product usage and system data | Data collected when our products are used as well as system and device data | Plant name, plant identification, commissioning date/time, plant power, manufacturer, module type, plant description, plant image, power and other device data |
| Position data | Data allowing localization | Coordinates (longitude, latitude, altitude) |
| Interaction and correspondence data | Data that arise during communication with us | Date and time, contacts, contents of e-mails and other communication tools such as MS Teams, Skype, etc., customer appointments |
| Content data | Data contained in documents, messages, recordings, documentation | Information on persons, cases, products, etc. |
| Bank and financial data | Data arising in connection with the processing of cash and payment flows as well as their correct accounting and tax treatment, including data on financial status | IBAN, tax number, delivery block dunning data, shareholdings, UID number and Intrastat identification number, dunning data and blocking indicators (e.g. invoice, delivery or payment block), bonus and commission data, creditworthiness data |
| Application data | Data that we process as part of your application to Fronius | Application, Intended employment and start date, Serial number(s), Dates of education, Work experience, Curriculum vitae, Special job requirements, Language skills, Test results, Master data, Photograph, Certificates, Cover letter |
| Special categories of personal data* | data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation | Health data, data related to criminal offences |
| Data subject | in the event of an assertion of the data subject rights within the meaning of the GDPR | Category of data subject, nature and content of the request, proof of identification, completion of the request, date of contact and completion; declarations of consent |
If necessary, further personal data are processed if this is required for the specific purpose.
In the event that Fronius also processes special categories of personal data, so-called sensitive data (e.g. health data), the processing is either based on your express consent (Art 9 para. 2 (a) GDPR) or it is necessary for the assertion, exercise or defense of legal claims (Art 9 Para. 2 (f) GDPR).
PURPOSE OF THE PROCESSING
| Processing purpose | Description of the purposes of processing |
|---|---|
| Research & Development | Processing in connection with our research collaborations and projects, including IP and grant management |
| Purchasing, production and logistics | Processing for the purchase of components and equipment as well as accessories, for the manufacture of our products and maintenance of the legal and normative conformity requirements for these, as well as for the fulfilment and execution of supply contracts with customers and suppliers, including the execution of the logistical processes along the supply chain |
| Provision of online services and software for customers | VProcessing for the provision of online services and software to customers to enable them to make the best use of Fronius products and to improve them, make them more user-friendly, find and rectify faults more quickly, control server capacity and analyses statistics relating to system and device data |
| Customer service and sales as well as customer support | Processing for the initiation and handling of business with customers in connection with our products, including the maintenance of a group-wide customer and supplier database; processing in the event of customer concerns as well as warranty and guarantee claims |
| Corporate Communications | Processing for communication with business partners, customers and interested parties, employees, former employees and the public; as well as operation and use of the website, including marketing |
| Event Management | Processing for the organization and handling of our events and visits as well as for the organization of external events (e.g. congresses, trade fairs) and the participation of our employees and visitors (customers, suppliers) |
| Quality Management | Organization and documentation of an orderly audit system as well as improvement processes |
| Safety, cleanliness and environmental protection at our sites | Processing for the operation of environmental, health and safety management systems, as well as the administration of the access system and video surveillance at our sites |
| Project / Change Management | Processing for the collection, evaluation and implementation of improvement ideas, measures and projects |
| IT Management | Processing for the operation of our IT systems and protection of the IT systems through appropriate technical and organizational measures (risk management) |
| Bookkeeping and accounting | Processing for accounting purposes, including accounting and the preparation of financial statements and accounting, compliance with tax obligations |
| Legal | Processing in connection with legal matters internally, as well as by external legal advisors, including document management |
| Candidate Management | Processing for the purpose of personnel search and implementation of the application procedure, processing of related correspondence and documents including possible keeping of records |
| Internal organization and traceability and internal management purposes | Processing for filing and data backup, for internal organization and structure of all processes and work activities |
| Compliance Management | Processing for compliance with legal regulations and guidelines as well as for the prevention of rule violations |
The processing of your personal data is necessary to achieve the purposes listed above. Failure to provide it could, depending on the category of data, result in us not being able to fulfil the listed purposes in accordance with the contract and the law, a smooth business process is not possible or we are unable to carry out the pre-contractual activities or conclude and implement the contractual relationship with you or your employer.
LEGAL BASES OF PROCESSING
Fronius processes your personal data within the meaning of Art 6 GDPR on the basis of the following legal grounds:
- fulfilment of a contractual relationship or implementation of pre-contractual measures (Art 6 Para. 1 lit b GDPR),
- fulfilment of a legal or statutory obligation (Art 6 Para. 1 lit c GDPR),
- protection of the legitimate interests of Fronius or a third party (Art 6 Para. 1 lit f GDPR) or
- if none of the aforementioned legal grounds apply, on the basis of the consent of the person concerned to the processing of their personal data (Art 6 Para. 1 lit a GDPR).
Fronius processes personal data primarily in the context of a business relationship with the data subject or with a company represented by the data subject, in particular in the area of contractual and pre-contractual relationships (Art. 6 Para. 1 lit b GDPR).
Furthermore, personal data is processed if necessary to comply with a legal or statutory obligation to which Fronius is subject (e.g. storage and documentation obligations under national laws and reporting obligations as an employer to the social security authorities) (Art. 6 Para. 1 lit c GDPR).
The processing of personal data on the legal basis of Art. 6 Para. 1 lit f GDPR is generally based on the following legitimate interests of Fronius:
- Safeguarding operational interests such as the internal administration and optimization of business processes (document, file, customer and supplier management), data backup and ensuring smooth business operations,
- Improvement and further development of our products and troubleshooting,
- assertion, exercise or defense of legal claims,
- Containment of damage,
- Carrying out direct advertising (marketing and information activities, in particular about products and services offered by the person responsible),
- IT security and technical administration when using our systems such as internet access, communication tools, means of collaboration (telephone, email, video conferencing, instant messaging),
- Operation of a group-wide customer and supplier management system
- Event planning, invitation and coordination,
- Building security and ensuring general security on company and company premises
Personal data is only processed to protect the legitimate interests of Fronius if there is no reason to assume that the interests of the data subject merit protection.
Personal data may also be processed on the basis of the data subject's consent to processing, which consent may be revoked at any time (Art. 6 Para. 1 (a) GDPR). In this case, the personal data of the data subject is processed for the processing of which the data subject has given prior consent, such as the publication of photographs of the data subject for documentation or advertising purposes or the processing of his or her personal contact data for the purpose of sending newsletters.
Insofar as data is not collected from the data subject himself/herself within the meaning of Article 14 of the GDPR, personal data that can be accessed in publicly accessible databases such as the land register, company register, central register of associations, edict file, central register of residents, credit rating databases), as well as information on the data subject may be collected from search engines, social networks or various websites, from Fronius Group companies or from cooperation partners or from any funding bodies.
In order to guarantee the security of the personal data of the data subjects, Fronius has taken a number of technical and organizational measures as defined in Art. 32 DSGVO, in particular encryption of the services using state-of-the-art encryption methods (e.g. SSL), user authentication controls, secure network infrastructures, restriction of access to personal data, network monitoring solutions, area-restricted alarm systems as well as video surveillance, employee conduct instructions, obligation to maintain data secrecy. A list of technical and organizational measures at Fronius can be found
here.
Fronius does not process personal data for automatic decision-making or profiling.
RECIPIENTS OF PERSONAL DATA
In order to achieve the intended purposes or if there is a legal obligation to do so, it may be necessary on a case-by-case basis for us to transfer and disclose your data to recipients (e.g. authorities/public bodies, courts, banks, higher-level group companies, etc.) or to grant service providers access to your data (e.g. in order to carry out data management on our behalf, to use software and IT infrastructure, for support and maintenance purposes). The transfer of the relevant data in each individual case is based on the legal provisions or contractual agreement or, in part, on your (express) consent.
We only work with third parties who offer sufficient guarantees that your data is in safe hands.
These are the following categories of recipients within the meaning of Art 13 para 1 lit e GDPR:
- Fronius Group companies (in particular the subsidiaries listed at https://www.fronius.com/de/ueber-fronius/locations),
- Processors, insofar as they require the data for the performance of their respective services,
- Authorities, public bodies and institutions in the event of a legal obligation,
- Operators and participants of creditworthiness-related information systems for the purpose of creditor protection and risk minimization,
- Third-party providers and cooperation partners (e.g. customers, suppliers, payment service providers),
- Credit and financial institutions or similar entities,
- Legal and tax advisers and experts for the examination, assertion, exercise or defense of legal claims,
- Courts to assert, exercise or defend legal claims.
Personal data may be transferred to countries outside the EEA in order to carry out pre-contractual measures or in performance of a contract with the data subject or the company represented by the data subject, in particular by Fronius group companies or due to the use of cloud solutions for communication and collaboration, for video conferencing, for maintaining information and data security and for customer care and a corresponding customer relationship management system. Where appropriate, personal data may also be processed when used for promotional purposes on social media channels (e.g. Facebook, Instagram) or websites outside the EEA.
Such a transfer outside the EEA may take place on the basis of binding internal data protection rules under Art 47 GDPR, adequacy decisions of the European Commission under Art 45 GDPR or standard data protection clauses under Art 46 Para. 2 lit c and d GDPR. In exceptional cases, a data transfer may also take place on the basis of Art 49 GDPR, either because you have expressly consented to the proposed data transfer after having been informed of the potential risks to you of such data transfers without the existence of an adequacy decision (Art 45 GDPR) and without appropriate safeguards, the transfer is necessary for the performance of a contract between you and Fronius or for the performance of pre-contractual measures at your request, or the transfer is necessary for the conclusion or performance of a contract concluded in your interest by Fronius with another natural or legal person.
Data transfer to the USA / discontinuation of the Privacy Shield
Fronius would like to expressly point out that since 16 July 2020, due to the "Schrems II" decision of the European Court of Justice, the so-called "Privacy Shield", an adequacy decision of the EU Commission pursuant to Article 45 of the GDPR, with which the USA was confirmed an adequate level of data protection under certain circumstances, is no longer valid with immediate effect.
Since then, the Privacy Shield does not constitute a valid legal basis for the transfer of personal data to the USA!
If, in the context of data processing at Fronius, a transfer of data to the USA takes place, cannot be ruled out, or if we use a service provider based in the USA, we refer to this explicitly in this data protection declaration (see in particular the description of the technologies used on our website).
For you as a user, the transfer of personal data to the USA entails risks. These result from the corresponding powers of the US intelligence services and the legal situation in the USA, which currently - in the opinion of the ECJ - no longer ensures an adequate level of data protection in the USA. The issues include:
- Section 702 of the Foreign Intelligence Surveillance Act (FISA) provides no restrictions on the surveillance activities of the intelligence services and no safeguards for non-US citizens.
- Presidential Policy Directive 28 (PPD-28) does not give data subjects effective remedies against actions taken by US authorities and does not provide for barriers to ensure proportionate measures.
- The Ombudsman provided for in the Privacy Shield does not have sufficient independence from the executive; he cannot issue binding orders against the intelligence services.
Legally compliant transfer of data to the USA based on the standard contractual clauses
The standard contractual clauses adopted by the European Commission in 2010 (2010/87/EU of 05.02.2010), Art. 46 (2) c GDPR, are still valid, but a level of protection for personal data must be ensured that corresponds to that in the European Union. Therefore, not only the contractual relationships with our service providers are relevant here, but also the possibility of access to the data by authorities in the USA and the legal system there (legislation and jurisdiction, administrative practice of authorities).
By implementing decision of 4 June 2021 (2021/914), the European Commission has now adopted new standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
By the end of 30.09.2021, only the new standard contractual clauses for the transfer of personal data to third countries may be applied; previously agreed standard contractual clauses (2010/87/EU of 05.02.2010) must be updated by 31.12.2022.
The standard contractual clauses cannot bind authorities in the U.S. and therefore do not yet provide adequate protection in cases where authorities are empowered under U.S. law to interfere with the rights of data subjects without additional action by us and our service provider.
Our measures to make data transfers to the USA legally compliant
Wherever possible, we always choose to process data on EU servers. This should technically ensure that the data is located within the European Union and the risk of access by US authorities is largely minimized.
With US service providers, we strive to conclude standard contractual clauses and to demand additional guarantees. In particular, we demand, where possible, the use of technologies that prevent access to data, e.g. the use of encryption that cannot be broken even by US services, or anonymization
or pseudonymisation of the data, so that only Fronius or the service provider can make the assignment. At the same time, we require that the service provider inform us immediately if access to data by third parties is actually requested or occurs, and that the service provider exhaust all legal remedies against requested access to Fronius data. We contractually obligate our service providers or processors, including their subcontractors, to transfer data outside the EU exclusively in compliance with the principles for data transfers pursuant to Art. 44 et seq. of the Data Protection Regulation (GDPR) and to oblige the subcontractors to comply with the data protection level of the GDPR.
STORAGE PERIOD/DELETION
We store your data for different lengths of time depending on the existence of a legitimate processing purpose.
As a rule, we process your information for the duration of the entire business relationship (from the initiation, processing to the termination of a contract, as well as until the termination of any information interest on your part). In addition, we store your data in compliance with and within the scope of the statutory retention and documentation obligations, the applicable warranty, guarantee and limitation periods, in the event of legal disputes in which the data is required as evidence, until their termination.
Individual retention periods can be found in the special information on data processing. Our retention periods, in each case from the time the data is created, are based on the following principles:
- Data that do not need to be kept for longer for verification purposes will be deleted after 6 months.
- Data that is required for verification purposes and / or is the basis for legal claims that are subject to a limitation period of 3 years (e.g. damages, warranty) and there is no justification for a longer storage, we delete after 3 years.
- Data whose storage is necessary for verification purposes, in particular correspondence and its contents, will be deleted after 5 years.
- Data whose storage is necessary for purposes relevant to accounting, tax law or customs law, as well as on the basis of subsidies or in the event of the assertion of purchase price, performance or special claims for damages or liability (e.g. product liability), shall be stored for a period of 10 years.
- Data whose retention is necessary for the fulfilment of warranty services and their traceability is retained for a period of 20 years (this period corresponds to the longest warranty period at Fronius).
- The deletion of personal data which are necessary, for example, for the issuing of a reference or which are necessary for the assertion, exercise or defense of legal claims, in particular with regard to an absolute limitation period of 30 years, may in these special cases also take place after 30 years - always taking into account the purpose of the processing.
In the case of consent to data processing (in particular when sending electronic messages), the data is stored - with the exception of other details in the consent text - until revocation by the person concerned, which is possible at any time, whereby the revocation does not affect the processing that has taken place up to this point in time.
RIGHTS OF PERSONS CONCERNED
Data subjects have the following rights at any time:
/ Right to request
You have the right to request information about your personal data that we process at any time within the scope of Art. 15 GDPR.
/ Right to rectification and completion
Should your personal data be incorrect or incomplete, you have the right to rectification and completion within the scope of Art. 16 GDPR.
/ Right to restriction of processing
If the legal requirements are met, you may request restriction of the processing of your personal data within the scope of Art. 18 GDPR.
/ Right to erasure
You may request the erasure of your personal data at any time within the scope of Art. 17 GDPR, unless we are legally obliged or entitled to continue processing your data.
/ Right to data portability
If processing takes place on the basis of a contract or your consent and with the help of automated processes, you have a right to the transfer of the personal data concerning you in a structured, common and machine-readable format within the scope of Art. 20 GDPR, provided that this does not affect the rights and freedoms of other persons.
/ Right to object
You have the right to object to processing within the scope of Art 21. GDPR, insofar as the data processing is carried out for the purposes of direct marketing or profiling. You may object to processing on the basis of a balance of interests by stating the reasons arising from your particular situation.
/ Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
/ Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR, in particular in the Member State of your residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority to which the complaint has been lodged will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR. The data protection authority or supervisory authority responsible for us can be found below in the contact details.
To exercise your rights as a data subject, please contact us - by post, e-mail or fax - at the address given below. Your request or your data will be processed without affecting the lawfulness of the processing carried out up to the receipt of your request and insofar as the processing is reasonable for Fronius.
II. INFORMATION ON INDIVIDUAL DATA PROCESSING
1. NEWSLETTER
Categories of personal data that Fronius collects and processes as part of this data processing:
- Name (such as first name, last name, name affixes, salutation)
- Contact details (such as e-mail address, if applicable also address, (mobile) phone number, if applicable company data: E-mail address, address)
- where applicable, data subjects and IT data (consent and double opt-in status)
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ Fulfilment of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purposes of initiating pre-contractual measures or fulfilling the obligations arising from a contract concluded with you (such as determining the winner of competitions, authentication for the use of our services, granting extended (warranty) rights) or on the basis of the terms and conditions accepted by you.
/ on the basis of your consent (Art 6 para 1 lit a GDPR)
Consent to the processing of your personal data for the purpose of sending newsletters can be revoked by you at any time with effect for the future. Consents granted before the applicability of the GDPR (25 May 2018) can also be revoked. Processing that took place before the revocation remains unaffected by the revocation.
/ Safeguarding of legitimate interests of Fronius within the framework of the balancing of interests (Art 6 para 1 lit f GDPR)
the purposes of the processing result from the safeguarding of our legitimate interests. Our legitimate interest may be used to justify the further processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. Our legitimate interest here lies in sending information and offers about our products to existing customers, users of our offers and services as well as interested parties.
Duration of processing (criteria for deletion)
the data will generally be stored and processed until the contractual relationship has been completed and beyond that for the purposes of sending the newsletter until you object to the sending of the newsletter or revoke your consent. We will inform you separately about this circumstance in the course of registration or in our terms and conditions.
Consent to the use of your e-mail address for advertising purposes can be revoked at any time with future effect by clicking on the "Unsubscribe" or "Newsletter unsubscribe" link at the end of the newsletter or by sending a message to cancellation(at)fronius.com with the revocation of your consent.
The data for the newsletter dispatch will be stored at the longest until you unsubscribe from the newsletter. We are entitled to check the authenticity and accuracy of your e-mail address on the basis of your other details.
Supplementary information on this data processing
You can receive a newsletter from Fronius if you have given us your consent to do so, if you are an existing customer, or if we process your personal data in return for providing you with our offers.
/ Consent: If you have given your consent to receive interesting offers and news from Fronius by e-mail on a regular basis, we will send you regular newsletters on the basis of this consent until your consent is revoked.
/ Existing customers: We will only send newsletter e-mails to existing Fronius customers if we have received their contact information for newsletter distribution in connection with the sale or provision of a service to you, and we have informed you at the time of collection and any subsequent transmission that you may opt out of the use of their contact information for this purpose, and provided you are not included in the list pursuant to Section 7 (2) of the E-Commerce Act.
/ Data for the use of our offers: You may also provide us with your personal data in return for the use of our offers or services such as
- the participation in a lottery,
- to gain access to our contents,
- the use of our online services, software or apps, or
- the product registration for extended warranty rights
and by accepting the relevant terms and conditions (of participation, use, business or otherwise) for processing for the regular receipt of newsletters about Fronius products and services for promotional purposes by e-mail.
Your e-mail address will not be passed on to third parties for advertising purposes.
2. ONLINE CONFERENCES AND WEBINARS
Categories of personal data that Fronius collects and processes as part of this data processing:
- Name (such as first name, last name, name affixes, salutation)
- Contact details (such as e-mail address, if applicable also address, (mobile) phone number, if applicable company data: E-mail address, address)
- IT data (such as username, password, IP address, log files)
- Image data, if applicable
- Interaction and correspondence data
- Content data
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ Fulfilment of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purpose of initiating pre-contractual measures or for the fulfilment of obligations arising from a contract concluded with you (such as the discussion of contractual content or processing in online conferences or the holding of a webinar booked by you) and on the basis of the conditions accepted by you.
/ On the basis of your consent (Art 6 para 1 lit a GDPR)
the purposes of the processing of personal data may result from the participant's consent (as in the case of a recording or a separate request for consent). Consent given for the processing of your personal data can be revoked by you at any time with effect for the future. Consents granted before the applicability of the GDPR (25 May 2018) can also be revoked. Processing that took place before the revocation remains unaffected by the revocation.
/ Safeguarding Fronius' legitimate interests in the context of the balancing of interests (Art 6 (1) (f) GDPR)
the purposes of the processing result from safeguarding our legitimate interests. Our legitimate interest may be used to justify the processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. Our legitimate interest here, in the case of open webinars, unless a contractual relationship has arisen through participation in the webinar, is to conduct a webinar and provide information to a wide audience. Legitimate interests may also lie in the further processing for documentation purposes after the conclusion of online conferences or seminars.
Duration of processing (criteria for deletion)
The processing of the data provided by you is carried out for as long as it is necessary to achieve the contractually agreed purpose, in principle for as long as the contractual relationship with you exists. After termination of the contractual relationship, the data provided by you will be processed to comply with statutory retention obligations or on the basis of our legitimate interests. After the expiry of the statutory retention periods and/or the lapse of our legitimate interests, the data provided by you will be deleted.
Supplementary information on this data processing
When using our tools, various types of data are processed. The scope of the data also depends on the data you provide before or when participating in an "online meeting".
In order to join an online meeting, you must provide a name; you may also choose a pseudonym. This information is stored temporarily in the browser and used for future access to online events.
In order to enable the display of video and the playback of audio, data from the microphone of your terminal device and from a video camera of the terminal device are processed during the meeting. Access can be disabled at any time using the buttons with the respective icons. Participation in online events is generally possible even if access is deactivated. It is also possible to exchange text messages in a group chat. The messages are then visible for all participants of the online event.
If a participant's screen is transferred during an event, the displayed screen content is shown to all other participants in the online meeting. Each participant should therefore ensure that no sensitive data is displayed on the screen before using the function. The screen sharing function can be deactivated at any time using the corresponding button.
In the event that we record online meetings, we will notify you before the recording begins and - if necessary - ask for verbal consent. If you do not wish to be recorded, you can leave the online meeting. If online meetings are being recorded, this will be indicated by a recording icon in the screen area. In this case, all video and audio data will be stored by us.
Online conferencing tools at Fronius and recipient
We use Microsoft Teams and Skype internally and externally to carry out our daily office communications and for conference calls, online meetings and/or video conferences. For webinars, we also use GotoWebinar.
To participate in an online meeting or a webinar, a participant receives an e-mail containing an invitation link. The e-mail address was either provided to us by the external participant or collected by us during registration for an online meeting or webinar. Fronius employees use their company contact data to participate in online meetings.
Microsoft Teams:
To conduct online meetings and host webinars, we use the Microsoft Teams service provided by Microsoft Ireland Operations, Ltd, South County Business Park Leopardstown, Dublin 18, D18 P521, Ireland, an affiliated company of Microsoft Cooperation, Redmond, WA, USA, https://www.microsoft.com/de-at/microsoft-teams/group-chat-software ("MS Teams").
ATTENTION: Within the scope of this service, data transmission to the USA takes place or cannot be ruled out.
Skype for Business:
To conduct online meetings and host webinars, we use the Skype service provided by Microsoft Ireland Operations, Ltd, South County Business Park Leopardstown, Dublin 18, D18 P521, Ireland, an affiliated company of Microsoft Cooperation - Redmond, WA, USA, https://www.skype.com/de/business/ ("Skype").
ATTENTION: Within the scope of this service, data transmission to the USA takes place or cannot be ruled out.
We have concluded an order processing agreement with Microsoft (MS Teams & Skype). For the processing of data in the USA, the level of protection is guaranteed through the use of the EU standard contractual clauses.
Further information on data protection can be found at https://privacy.microsoft.com/privacystatement on the use of this service.
GotoWebinar:
To conduct online meetings, and in particular to host webinars, we use the GotoWebinar service provided by LogMeIn Ireland Unlimited Company, an affiliate of LogMeIn Group LogMeIn, Inc. Boston, 320 Summer Street, Boston, MA 02210, USA.
ATTENTION: Within the scope of this service, data transmission to the USA takes place or cannot be ruled out.
We have concluded an order processing agreement with LogMeIn Ireland. For the processing of data in the USA, the level of protection is guaranteed through the use of the EU standard contractual clauses.
Further information on data protection can be found at https://www.logmein.com/de/trust/privacy on the use of this service.
3. COURSES, TRAINING und WEBINARS
Categories of personal data that Fronius collects and processes as part of this data processing:
- Name (such as first name, last name, name affixes, salutation)
- Contact details (such as e-mail address, if applicable also address, (mobile) phone number, if applicable company data: E-mail address, address)
- if applicable, company data (such as type and name of the company, professional function)
- Personal data (like language)
- Contract data, if applicable
- Visit data, if applicable
- bank and financial data, if applicable
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ performance of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purposes of initiating pre-contractual measures or for the performance of obligations arising from a contract concluded with you (or with your company/employer) (such as registration and participation in the relevant course offering or webinar, organization and communication, and implementation and completion of qualifications) and on the basis of the terms and conditions accepted by you.
/ To protect the legitimate interests of Fronius in the context of the balancing of interests (Art 6 para 1 lit f GDPR)
the purposes of the processing result from the protection of our legitimate interests. Our legitimate interest may be used to justify the processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. For example, our legitimate interest here may lie in the processing of your personal data for the purposes of organizing and holding courses and training sessions, both present and online, as well as in providing information about further course offerings.
Duration of processing (criteria for deletion)
The processing of the data provided by you is carried out for as long as it is necessary to achieve the contractually agreed purpose, in principle for as long as the contractual relationship with you exists. After termination of the contractual relationship, the data provided by you will be processed to comply with statutory retention obligations or on the basis of our legitimate interests. After the expiry of the statutory retention periods and/or the lapse of our legitimate interests, the data provided by you will be deleted.
Supplementary information on this data processing
Pathways to Fronius courses, training and webinarsFronius
offers its customers, business partners, employees and others the opportunity to attend courses, training or even webinars related to Fronius products. Completion of this offer can also be part of an agreement with business partners and a prerequisite for certifications by Fronius (such as certification as a "Certified Partner").
Recipients So far as
we organize courses, trainings or webinars together with partners of ours, you will receive information about this and we will share your personal data with them. For this purpose, we have concluded corresponding order processing contracts or joint responsibility contracts with our partners.
If courses or training sessions are held as webinars, the provisions set out under "Online Conferences and Webinars" shall apply in addition.
4. ONLINE-SERVICES, SOFTWARE AND APPS
Categories of personal data that Fronius collects and processes when you register to use our online services or apps:
- Name
- Contact details
- Company data
- Personal data
- Contract data
- IT data
- Product usage data (such as plant and equipment usage data)
- Position data
- Bank and financial data
The data is collected directly from you and processed in particular on the basis of the following legal grounds:
/ Fulfilment of a contractual relationship or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR)
Data processing may be carried out for the purposes of initiating pre-contractual measures or fulfilling the obligations arising from a contract concluded with you (or with your company/employer) (such as provision of online services and software, authentication for the use of our services, granting of extended rights) and on the basis of the terms and conditions accepted by you.
The purposes of the processing of personal data may result from your consent to the processing of your data for the purposes of using our online services and software or our services. Consent given for the processing of your personal data can be revoked by you at any time with effect for the future. Consents granted before the GDPR (25 May 2018) came into force can also be revoked. Processing that took place before the revocation remains unaffected by the revocation.
/ Safeguarding Fronius' legitimate interests in the context of the balancing of interests (Art 6 (1) (f) GDPR)
the purposes of the processing result from safeguarding our legitimate interests. Our legitimate interest can be used to justify the processing of the data you have provided, provided that your interests or fundamental rights and freedoms are not overridden. Our legitimate interest here is the provision of online services and software for our customers, optimization and expansion of our offer, improved customer service, corporate communication, in the internal administration and optimization of the business process, as well as in the improvement of our products and troubleshooting. After registering to use our online services, software and apps, Fronius also processes the data of your registered systems and devices in accordance with the applicable terms of use. In the process, usage data of your registered systems and devices is regularly transferred to Fronius for the purpose of analyzing this data and subsequently improving performance as well as our products. The system and device data is processed on the basis of Fronius' legitimate interest in using usage data from systems and devices registered with Fronius for analysis and improvement purposes.
Duration of processing (criteria for deletion)
the data is generally processed for the duration of the contractual relationship. After deactivation of your account, your personal data will be stored for 3 years for the purpose of reversing erroneous deactivation and a possible legal defense and then deleted.
In the event that you have given your consent to data processing, we will delete your data as soon as you revoke your consent.
Supplementary information on this data processing
Ways to our online services, software and apps
For the use of our online services, software and apps, an online registration by means of email address and password as well as, if applicable, the entry of your further data is required, in which the data is collected directly from you. In the course of registration, you accept the terms and conditions of the respective offer.
Recipients
Your data will not be passed on to third parties.
For the operation of our online services, software and apps, we use cloud solutions and service providers with whom we have concluded corresponding order processing agreements. Regarding data transfers to third countries, the information in the general section applies in addition.
After registering for our services, you can partially make your user name visible to other members. In addition, you can release or publish further data of your profile or your attachment and make it visible for other members. Within your profile, you have the option to adjust the extent to which your data is published by making the appropriate settings. It is at your discretion to decide which and to what extent this data is released or published for other users. Details are explained in more detail on the websites in the respective function of the respective online services and apps.
Fronius as a processor
Where our business customers are considered "controllers" when using our online services, software and apps and we are "processors" within the meaning of the GDPR, the order processing agreement available here for our business customers
applies.