Privacy Policy

Use of the NEUERO RAILTEC GmbH website is generally possible without providing any personal data. However, if you wish to make use of a particular service offered by our company via our website, the processing of personal data may become necessary.

Where the processing of personal data is necessary and there is no statutory legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, email address or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation (GDPR) and the applicable country-specific data protection regulations.

For this reason, you cannot use certain parts of our website without confirming the collection of your data, as we are obliged under the applicable legal provisions (e.g. the European General Data Protection Regulation and other data protection legislation) to fulfil the transparency obligations contained therein.

By means of this Privacy Policy, our company wishes to inform the public about the nature, scope and purpose of the personal data we collect, use and process. Furthermore, this Privacy Policy informs data subjects of their rights.

As the controller responsible for processing, NEUERO RAILTEC GmbH has implemented numerous technical and organisational measures to ensure the most comprehensive protection possible of personal data processed through this website. Nevertheless, internet-based data transmissions may generally contain security gaps, meaning that absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us via alternative means, for example by telephone.

Our website does not use cookies and does not use Google services or any other third-party services for analytics or advertising purposes. Consequently, no personal data is transferred to such third parties.

1. Definitions

The Privacy Policy of NEUERO RAILTEC GmbH is based on the terminology used by the European legislator for directives and regulations when adopting the General Data Protection Regulation (GDPR) and the German Act Adapting Data Protection Law to Regulation (EU) 2016/679 and Implementing Directive (EU) 2016/680 (DSAnpUG-EU).

To ensure clarity, we would like to explain the terminology used in advance.

Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

Processing

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting its future processing.

Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data cannot be attributed to an identified or identifiable natural person.

Controller

The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law.

Processor

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient

A recipient is a natural or legal person, public authority, agency or another body to which personal data is disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

Third party

A third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent

Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

 

2. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the Member States of the European Union, and other provisions relating to data protection is:

NEUERO RAILTEC GmbH

Industriestr. 5a

49824 Emlichheim

Germany

Phone: +49 (0) 5948 - 900 80

Fax: +49 (0) 5948 - 900 700

Email: info@neuero-railtec.com

 

3. Contact details of the Data Protection Officer

exkulpa GmbH

Waldfeuchter Str. 266

DE-52525 Heinsberg

Germany

Email: datenschutz@peters-gmbh.de

Any data subject may contact our Data Protection Officer directly at any time with any questions or suggestions regarding data protection.

 

4. Contact details of the competent data protection supervisory authority

The State Commissioner for Data Protection of Lower Saxony

Prinzenstr. 5

30159 Hanover

Lower Saxony

Germany

Phone: +49 (0) 511 / 120 450 0

 

5. Collection of general data and information

The website of NEUERO RAILTEC GmbH collects a range of general data and information each time it is accessed by a data subject or an automated system. This general data and information is stored in the server log files.

The following information may be collected:

• Browser types and versions used
• The operating system used by the accessing system
• The website from which an accessing system reaches our website (so-called referrer)
• The subpages accessed on our website by an accessing system
• The date and time of access to the website
• An Internet Protocol address (IP address)
• The Internet service provider of the accessing system
• Other similar data and information used to protect our information technology systems against attacks

When using this general data and information, our company does not draw any conclusions about the identity of the data subject.

Instead, this information is required to:

• Deliver the contents of our website correctly
• Optimize the contents of our website
• Ensure the long-term functionality of our information technology systems and the technology of our website
• Provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack

These anonymously collected data and information are evaluated by our company both statistically and with the aim of increasing data protection and data security within our company, ultimately ensuring an optimal level of protection for the personal data we process. The anonymous data contained in the server log files is stored separately from all personal data provided by a data subject.

 

6. Contact via the website

The website of NEUERO RAILTEC GmbH contains information required by law that enables rapid electronic contact with our company as well as direct communication with us, including a general electronic mail (email) address. If a data subject contacts the controller by email or via a contact form, the personal data transmitted by the data subject is automatically stored.

Such personal data voluntarily transmitted by a data subject to the controller is stored for the purpose of processing the request or contacting the data subject. This personal data will not be disclosed to third parties.

 

7. Routine erasure and blocking of personal data

The controller processes and stores the personal data of the data subject only for the period necessary to achieve the purpose of storage or where this is provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage no longer applies or a statutory retention period prescribed by the European legislator or another competent legislator expires, the personal data will be routinely blocked or erased in accordance with the applicable legal provisions.

 

8. Rights of the data subject

Right to confirmation

Every data subject has the right to obtain confirmation from the controller as to whether personal data concerning them is being processed.

Right of access

Every data subject has the right to obtain, at any time and free of charge, information from the controller about the personal data stored concerning them and to receive a copy of that information. Furthermore, the European legislator grants the data subject access to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data concerning them, or restriction of processing by the controller, or to object to such processing;
• the existence of the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from the data subject, any available information as to their source;
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

Furthermore, the data subject has the right to obtain information as to whether personal data has been transferred to a third country or to an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

Right to rectification

Every data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure ("Right to be forgotten")

Every data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay where one of the following grounds applies and insofar as processing is no longer necessary:

• The personal data have been collected or otherwise processed for purposes for which they are no longer necessary.
• The data subject withdraws consent on which the processing is based according to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
• The personal data have been unlawfully processed.
• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If one of the above reasons applies and a data subject wishes to request the erasure of personal data stored by NEUERO RAILTEC GmbH, they may contact our Data Protection Officer or another employee of the controller at any time. The Data Protection Officer or another employee will ensure that the request for erasure is complied with without delay.

Where NEUERO RAILTEC GmbH has made personal data public and is obliged pursuant to Article 17(1) GDPR to erase such personal data, we shall, taking account of available technology and the cost of implementation, take reasonable measures, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure of any links to, or copies or replications of, those personal data, insofar as processing is not required. The Data Protection Officer or another employee will arrange the necessary measures in each individual case.

Right to restriction of processing

Every data subject has the right to obtain from the controller restriction of processing where one of the following conditions applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by NEUERO RAILTEC GmbH, they may contact our Data Protection Officer or another employee of the controller at any time. The Data Protection Officer or another employee will arrange the restriction of processing.