Privacy Policy

Preliminary remark

Every company that processes personal data must provide data protection notices in order to fulfil the statutory information requirements of the General Data Protection Regulation (GDPR). This also applies to PNE AG and its subsidiaries. The data protection notice serves to transparently inform the persons concerned, i.e. customers, suppliers, interested parties and all other persons whose personal data is processed by PNE AG, about the processing of this data. This data protection notice provides information about the processing of personal data when using the online services of PNE AG, in particular via the website, but also via email contact or the use of social media services. 

1. Introduction

1.1 Scope of application

Data protection is a top priority for us. PNE AG processes your personal data exclusively within the framework of the applicable data protection laws, in particular the General Data Protection Regulation (GDPR). In the following, we inform you about the mode, scope and purposes of the processing of your personal data in accordance with Art. 13 GDPR. This privacy policy applies to the processing of personal data when you use our website, when you contact us via other communication channels and when your data is processed in the processes of customer service, contact management and project management. Using the table of contents, you can find the aspects of the processing of data by PNE AG and its subsidiaries in which you are interested. If you have any further questions, please do not hesitate to contact us.

1.2 Controller

The controller within the meaning of the data protection regulations for the processing of personal data is:

PNE AG
Peter-Henlein-Str. 2-4
D-27472 Cuxhaven

Further contact information can be found in the provider identification ('Legal Notice') of this website.

1.3 Data protection officer

You can reach our company data protection officer at

PNE AG
Company data protection officer 
Oberbaumbrücke 1
D-20457 Hamburg 

Email: datenschutz(at)pnegroup.com

0049 (0)151-55840922

2. Definitions of terms

In this data protection notice, we use certain terms that also appear in the General Data Protection Regulation (GDPR). For a better understanding, we are providing explanations of the terms used below.:

2.1 Personal data

Personal data means any information relating to an identified or identifiable natural person. A person is considered identifiable if they can be directly or indirectly identified - for example, by reference to a name, an identification number, location data, an online identifier (such as IP addresses or cookies) or specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

2.2 Processing

The term processing refers to any activity involving the handling of personal data. This includes all processes – regardless of whether they are automated or not. Examples of this are the collection, storage, modification, use, transmission, publication, erasure or destruction of data.

2.3 Controller

A controller is a natural or legal person, public authority, organisation or other body which, alone or jointly with others, determines the purposes and means of the processing of data. The controller must take appropriate organisational and technical measures to ensure that the processing of personal data complies with legal requirements and is regularly reviewed.

2.4 Processor

A processor is a person, organisation, authority or other body that processes personal data on behalf of the controller. The processor acts on the basis of the controller's instructions.

2.5 Recipient

The recipient is any natural or legal person, public authority or other body to whom personal data is disclosed. This applies regardless of whether it is a third party or not. However, authorities that request personal data as part of statutory investigation mandates are not considered recipients under data protection law.

2.6 Third party

A third party is any natural or legal person, public authority or body other than the data subject, the controller or the processor. Persons who are authorised to process data under the direct supervision of the controller or a processor are also not considered third parties.

2.7 Consent

Consent is a central element of self-determination under data protection law. It represents the voluntary and conscious consent of the data subject to have their personal data processed. Consent must be given unambiguously - either in the form of a written declaration or by another confirmatory act. Any consent given can be withdrawn at any time.

3. General information on data processing

3.1 Scope of the processing of personal data

Personal data is information about your identity. This includes, for example, information such as name, address, telephone number or email address. We process the personal data of our interested parties, customers and suppliers only to the extent necessary to provide a functional website or to offer our services. As a rule, such data is processed if the data subject has given their prior consent. However, personal data may also be processed on other legal bases.

3.2 Legal bases for the processing of personal data

Personal data is only processed on the basis of a valid legal basis in accordance with the EU General Data Protection Regulation (GDPR):

• If a data subject has consented to the processing of personal data, the processing is based on Art. 6 para. 1 lit. a GDPR.
• In the case of processing operations that are necessary for the initiation or fulfilment of a contract to which the data subject is party, we rely on Art. 6 para. 1 lit. b GDPR.
• If the processing is necessary on the basis of a legal obligation to which we are subject, Art. 6 para. 1 lit. c GDPR forms the legal basis.
• In cases where vital interests of the data subject or another natural person require processing, this is done on the basis of Art. 6 para. 1 lit. d GDPR.
• If the processing is based on our legitimate interest, whereby the interests, fundamental rights and freedoms of the data subject do not prevail, Art. 6 para. 1 lit. f GDPR serves as the basis for data processing.

We will inform you at the relevant points in this privacy policy of the legal basis on which your personal data is processed.

3.3 Storage and erasure of personal data

Personal data will be erased or blocked as soon as the purpose for which it was collected no longer applies. Any further storage will only take place if it is prescribed by legal regulations of the European Union or national law to which we are subject. If legally stipulated storage periods expire, the data will also be erased or blocked, unless its further storage is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures.

3.4 Disclosure of personal data

Your personal data will only be passed on to third parties if this is necessary for the purpose of carrying out the data processing set out below or if you have previously consented to the transfer. We only disclose personal data about interested parties, customers or suppliers if we are obligated to do so by law or by a court order or if the disclosure is necessary to enforce or protect our contractual obligations. This also applies accordingly with regard to the storage of data. The data is not disclosed for commercial purposes.

For certain processing activities, we use external service providers that we select with due care. If personal data is transferred to these service providers as part of so-called order processing, this is done in accordance with the requirements of Art. 28 GDPR. Our processors are contractually bound by our instructions and are regularly monitored by us. We only work with partners who are demonstrably able to meet the requirements of the GDPR and the Federal Data Protection Act (BDSG) and ensure the protection of your rights through suitable technical and organisational measures. Our processors or other third parties may not use the data for other purposes. Our employees and the employees of the companies commissioned by us are committed by us to maintain confidentiality.

3.5 Data transfer to third countries

The General Data Protection Regulation (GDPR) ensures a uniformly high level of data protection within the European Union. Therefore, when selecting our service providers and co-operation partners, we generally prefer European providers if the processing of your personal data is necessary. Processing outside the European Union or the European Economic Area only takes place in exceptional cases and in connection with the use of third-party services.

Processing of your data in a so-called third country is only permitted on condition that the strict requirements of Art. 44 et seq. GDPR are fulfilled. As a rule, we obtain your express consent for this in accordance with Art. 49 para. 1 lit. a GDPR. Alternatively, processing can be carried out on the basis of special guarantees. Such guarantees can be, for example, an officially recognised equivalence of the level of data protection by the EU Commission, as guaranteed by the Data Privacy Framework (DPF), or the application of so-called 'standard contractual clauses', which are officially recognised contractual obligations.

3.6 Profiling and automated decision-making

At PNE AG, personal data is neither used for automated decision-making nor for profiling in accordance with Art. 22 GDPR.

4. Rights of data subjects

You have the right to receive information about the origin, recipient and purpose of personal data stored concerning you free of charge and at any time. You also have the right to request the rectification, blocking or erasure of this data. You can contact us at any time if you have further questions on the subject of data privacy. You also have the right to lodge a complaint with the competent supervisory authority.

4.1 Right of access

In accordance with Art. 15 GDPR, you have the right to obtain information on the personal data concerning you, its origin and recipients and the purpose of the data processing, free of charge and at any time.

4.2 Right to rectification

If your data is not (or no longer) correct, you can request a rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed. If we have passed on your data to third parties, we will inform these third parties of the rectification - if this is required by law.

4.3 Right to erasure

The stored personal data will be erased in accordance with Art. 17 GDPR after expiry of the statutory retention periods. Stored personal data will also be erased if you withdraw your consent to storage and there is no other legal basis for the storage, if knowledge of the data is no longer required to fulfil the purpose for which it was stored or if its storage is inadmissible for other legal reasons, unless statutory retention requirements prevent erasure, in which case processing will be restricted (blocked) instead of erased.

Stored personal data will also be erased if your personal data has been processed unlawfully or must be erased in order to comply with legal requirements. In the event that erasure cannot be realised or can only be realised with disproportionate effort, processing shall be restricted instead of erased.

4.4 Right to restriction of processing

You have the right to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR. You can contact us at any time for this purpose. The right to restriction of processing  applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to check this. While the check is ongoing, you have the right to request that the processing of your personal data be restricted.
• If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.
• If we no longer need your personal data, but you need it for the exercise, defence or assertion of legal claims, you have the right to request the restriction of the processing of your personal data instead of its erasure.
• If you have lodged an objection in accordance with Art. 21 (1) GDPR, your interests must be weighed against ours. As long as it has not yet been determined whose interests prevail, you have the right to demand the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

4.5 Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw any consent you have already given at any time in accordance with Art. 7 (3) GDPR. All you need to do is to notify us by sending an informal email. The lawfulness of the data processing carried out until its withdrawal remains unaffected by the withdrawal.

4.6 Right to object to the collection of data

If the data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data at any time in accordance with Art. 21 GDPR for reasons arising from your particular situation. If you lodge an objection, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is required for the establishment, exercise or defence of legal claims.

4.7 Objection to advertising emails

We hereby object to the use of contact data published in the context of the imprint obligation to send unsolicited advertising and information material. PNE AG expressly reserves the right to take legal action in the event of the unsolicited sending of advertising material, such as spam emails.

4.8 Right to data portability

In accordance with Art. 20 GDPR, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract provided to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

4.9 Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work or place of the alleged violation. The right to lodge a complaint exists notwithstanding other administrative or judicial remedies.

A list of data protection officers and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

5. Online offers

5.1 Visits to our website

Purpose of data processing and data categories

If you only use the website for information purposes, i.e. if you do not transmit any other information to us, only the personal data that your browser transmits to the server will be processed when you visit this website. The data collected is used exclusively to provide and improve the content and functionality of our websites. 

When you visit our website, information is transmitted that we need in order to display and provide you with our webpages, such as

• Browser type/version
• The current IP address of the Internet connection you are using
• Operating system you are using
• Referrer URL (the previously visited page)
• Date and time of the server request

As a rule, this data cannot be assigned to a specific person; it is not merged with other data sources.

Legal basis for data processing

The legal basis for the processing of personal data is Art. 6 para. 1 lit. f GDPR, whereby our legitimate interest lies in the secure, stable and efficient provision of the functions of the website and the information that can be accessed via it. If we fulfil an existing contractual obligation towards you by providing the website, the legal basis is Art. 6 para. 1 lit. b GDPR.​​​​​​​

Duration of storage

The data collected will be erased after a statistical analysis at the end of the session.

Disclosure of data to third parties

Our website uses the Content Delivery Network from Hetzner. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (hereinafter 'Hetzner').

Hetzner provides a content delivery network distributed exclusively within the EU or EEA. The information transfer between your browser and our website is technically routed via Hetzner's Content Delivery Network. This enables us to increase the global accessibility and performance of our website.

The use of the Hetzner Content Delivery Network is based on our legitimate interest in the most error-free and secure provision of our website (Art. 6 para. 1 sentence 1 lit. f GDPR).

We have concluded an order processing contract (AVV) with Hetzner. This is a contract required by data protection law, which ensures that the personal data of our website users is only processed in accordance with our instructions and in compliance with the provisions of the GDPR.

Objection and withdrawal

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object. The data is erased at the end of the session.

5.2 Contact form

Purpose of data processing and data categories

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We do not pass on this data without your consent.

Legal basis for data processing

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR, provided that your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.

Duration of storage

We will retain the data you provide on the contact form until you request its erasure, withdraw your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Mandatory statutory provisions - in particular retention periods - remain unaffected.

Disclosure of data to third parties

Your data will not be passed on to third parties.

Objection and withdrawal

Your consent to the processing of personal data on the basis of the use of our contact form can be withdrawn at any time.

5.3 Newsletter

Purpose of data processing and data categories

You have the option to subscribe to a newsletter or order other publications of PNE AG on our website. To do this, we need your email address and information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. No further data is collected. 

Legal basis for data processing

The legal basis for data processing is Art. 6 para. 1 lit. a GDPR, as you give us your consent to the processing of your data for the purpose of sending you the newsletter when you register.

Duration of storage

The data you provide us with for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data stored by us for other purposes remains unaffected by this. 

Disclosure of data to third parties

Our website uses CleverReach to send newsletters. The provider is CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany (hereinafter referred to as 'CleverReach'). CleverReach is a service that can be used to organise and analyse the sending of newsletters. The data you enter for the purpose of receiving the newsletter (e.g. email address) will be stored on CleverReach's servers in Germany or Ireland. 

Our newsletters sent with CleverReach enable us to analyse the behaviour of newsletter recipients. Among other things, it is possible to analyse how many recipients have opened the newsletter email and how often which link in the newsletter was clicked on. Conversion tracking can also be used to analyse whether a predefined action has taken place after clicking on the link in the newsletter. 

We have concluded an order processing contract with CleverReach. This is a contract required by data protection law, which ensures that the personal data of our newsletter recipients is only processed in accordance with our instructions and in compliance with the provisions of the GDPR.

Objection and withdrawal

You can withdraw your consent to the storage of the data, the email address and its use for sending the newsletter at any time free of charge with effect for the future to PNE AG, e.g. via the 'Unsubscribe' link in the newsletter or the following email address datenschutz@pne-ag.com. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

5.4 Cookies

Purpose of data processing and data categories

Our Internet pages use so-called 'cookies'. Cookies are small text files and do not cause any damage to your end device. They are either stored temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your end device.

Cookies have various functions. Many cookies are technically necessary, as certain website functions do not work without them. Other cookies are used to evaluate user behaviour or display advertising. In some cases, cookies from third-party companies may also be stored on your end device when you use our website (third-party cookies). They enable us or you to use certain services of the third-party company. If cookies are used by third-party companies or for analysis purposes, we will ask for your consent.

Legal basis for data processing

If consent to the storage of cookies and comparable recognition technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 Telecommunications-Digital-Services-Data Protection Act [TDDDG]).

PNE AG has a legitimate interest in the storage of cookies necessary for the technically error-free and optimised provision of its website. Cookies that are required to carry out the electronic communication process, to provide certain functions that you have requested or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified.

Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 (1) (c) GDPR.

Duration of storage

Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser.

Disclosure of data to third parties

Our website uses Cookiebot's consent technology to obtain your consent to the storage of certain cookies on your end device or to the use of certain technologies and to document this in accordance with data protection regulations. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter referred to as 'Cookiebot').

When you enter our website, a connection is established to the Cookiebot servers in order to obtain your consent and other declarations regarding the use of cookies. Cookiebot then stores a cookie in your browser in order to be able to assign the consents given or their withdrawal to you. The data collected this way is stored until you ask us to erase it, delete the Cookiebot cookie yourself or the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected.

We have concluded an order processing contract with Cookiebot. This is a contract prescribed by data protection law, which ensures that the data controller processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.