Data protection information of LACOS GmbH

LACOS GmbH ("LACOS", "we", "us/our/our") is the operator of this website. With this data protection notice, we would like to inform you on what basis and for what purposes we process personal data that we collect from you or that you provide to us. We would also like to inform you about your data protection rights, including your right to object to individual processing operations carried out by Lacos.

Supplementary data protection notices apply to certain categories of data processing. You will find some of them linked below.

• Data protection notice for users of our websites www.lacos.eu and www.lacos.de
• Data protection notice for users of our video conferencing systems
• Data protection notice for users of our telemetry portal (lc-fleetnav-web.lacos.de)
• Data protection notice for our online store customers
• Data protection notice for users of the Lacos Facebook fan page
• Data protection notice for business partners of Lacos

We may also provide additional information at the relevant points about certain data processing to the extent that appears necessary, e.g. for certain forms.

Please contact us if you have any questions, comments or concerns regarding this statement or our processing of your personal data.

1 General data protection notice

1.1 Who is responsible for data processing and who can I contact?

Responsible within the meaning of the General Data Protection Regulation (GDPR) is

LACOS GmbH
Industriestraße 9
07937 Zeulenroda-Triebes

Fon +49 36628.6 88-0
Fax +49 36628.6 88-17
Mail info@lacos.de

You can reach our company data protection officer using the above contact details and by email: datenschutzprotect@protectlacosprotect.protectde

1.2 What data do we collect?

We typically process the following categories of personal data, among others:

• Master data: Name, address
• Contact data: e.g. telephone number, e-mail address, any company affiliations
• Contact preferences: e.g. preferred contact medium, advertising messages received
• Inquiries: e.g. offers, inquiries, expressions of interest, feedback
• Customer data: e.g. correspondence, contracts, services, orders, joint appointments
• Product information: e.g. your product ID, start and end of the subscription and your purchase date and, if applicable, assigned dealer
• Financial and payment data: e.g. bank account number, billing address, payments received
• Application data: e.g. CV, certificates, cover letter, previous activities and positions in other organizations, education, professional qualifications, reference contact information, position preferences, salary expectations, interests and wishes, gender, marital status, age, information from publicly available sources such as professional social media networks
• all other information that you provide to us, as well as any sensitive data such as origin, religion, health data and degree of disability, criminal convictions, sanctions from supervisory or professional organizations
• Device data: e.g. information about the end devices you use to visit our websites, such as the operating system used, browser type, language set, IP address.

1.3 For what purposes do we collect, use and store this personal data?

We collect, use, store and process your personal data:
 

1.3.1 if you have given us your consent (Art. 6 para. 1 lit. a GDPR)

• to receive a newsletter or information about Lacos offers by post, telephone, messenger or e-mail,
  If you give your consent to receive direct advertising, we always offer you the opportunity to revoke your consent or, for example, to unsubscribe directly in the newsletter.

1.3.2 if necessary, to fulfill contractual obligations and pre-contractual measures (Art. 6 para. 1 lit. b GDPR)

• Processing your inquiries and contacting you in this regard, for example for certain contractual offers from Lacos,
• to decide on the establishment of an employment relationship for job applications (the legal basis for this is Section 26 (1) BDSG). In particular, we process the data that you have sent us in connection with your application in order to check your suitability for the position (or any other open positions in our companies) and to carry out the application process,
• for example to execute a purchase or service contract and invoicing, or to contact you for these purposes by post, telephone, e-mail, messenger service.

1.3.3 insofar as the legitimate interests of us or third parties require it and no interests of data subjects worthy of protection prevail and you have not objected to the use (Art. 6 para. 1 lit. f GDPR)

• for the purposes of maintaining, servicing and improving our IT systems and services, data protection control and data backup,
• to respond to other inquiries and complaints,
• for internal administrative purposes,
• for the purposes of documentation and reporting by photographing or filming events that we attend or organize and, if applicable, publishing the recordings on our website,
• to detect, prevent or otherwise combat fraud, security or technical issues
• um Strafverfolgungsbehörden bei Verdacht auf Vorliegen einer Straftat die zur Strafverfolgung notwendigen Informationen bereitzustellen,
• zum Schutz und Wahrung unserer legitimen Geschäftsinteressen, Geschäftsbedingungen und gesetzlichen Rechte und Pflichten. Dazu gehören unter anderem die Verwendung etwaiger personenbezogener Daten im Zusammenhang mit Compliance-, Regulierungs-, Audit- und Rechtsansprüchen (einschließlich der Offenlegung solcher Informationen im Zusammenhang mit Rechtsverfahren oder Rechtsstreitigkeiten),
• for direct advertising outside the existence of consent, insofar as legally permissible. In connection with the sale of a service to you or your company, we may process your postal contact data outside the existence of specific consent in order to send you occasional information about new offers (direct advertising). Under the legal requirements of Section 7 (3) UWG, we are also entitled to use your e-mail address, which you provided when purchasing a service, for direct advertising for our own similar goods or services. Please note the objection options under 1.7.1.1.

1.3.4 to the extent necessary to comply with a legal obligation (Art. 6 para. 1 lit. c GDPR)

• e.g. for visitor registration in accordance with current Corona regulations,
• or to store the data collected for contract processing until the expiry of the statutory retention periods.

1.4 Who receives your data?

1.4.1 Transfers to companies that provide services for us as processors

Your personal data will be disclosed to companies that provide services on our behalf in accordance with our instructions. These are in particular companies in the categories of IT services, including website hosters, (cloud) software providers, including Microsoft Corp, Google LLC, Atlassian Ltd, data destruction, recruiting, printing and lettershop services.

When you communicate with us by email, these are processed on cloud-based servers of our email service provider Microsoft Corp.

We use so-called standard contractual clauses on data protection, which have been approved by the European Commission.

These standard contractual clauses are intended to guarantee data subjects affected by processing in insecure third countries an adequate level of data protection, in particular legally binding and enforceable rights. For more information, including to request a copy of the documents used to protect your data, please contact us.

1.4.2 Transfers to third parties

We will disclose your data to third parties if we are legally obliged to disclose your personal data or if we consider it necessary to protect the rights, property or safety of us, our customers or third parties.
Transfers to public authorities and/or law enforcement agencies will be made where required by law or where it is necessary to protect our legitimate interests in accordance with applicable laws.

We will inform you separately about these transfers to third parties in accordance with Art. 13 - 14 GDPR, for example in the context of consent given to us.

1.5 Do I have an obligation to provide data?

As part of our business relationship, you must provide the personal data that is necessary for the initiation, execution and fulfillment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or will no longer be able to perform an existing contract and may have to terminate it.

1.6 How long do we store your data?

We only process and store personal data of data subjects for as long as the purpose pursued requires it or is required by law. For example, retention periods under commercial and tax law may prevent deletion. The retention and documentation periods specified there are up to ten years. If the storage purpose no longer applies or if a legally prescribed storage period expires, the personal data is routinely deleted in accordance with the statutory provisions, unless it is used as evidence.

We process applicant data for the duration of the application process. If your application was not successful, we store applicant data after notification of the rejection decision for as long as we need the data to clarify inquiries or disputes. As a rule, we will delete your application data no later than 5 months after the application process has ended. If you have expressly agreed that we should also consider your application for future job advertisements, your data may also be stored for a correspondingly longer period.

1.7 What data protection rights do you have?

Every person affected by our personal data processing has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure. In addition, you have the right to lodge a complaint with the supervisory authority for data protection, e.g. the data protection authority responsible for your place of residence, your workplace or the location of the data protection breach.

If you have any questions about this data protection notice or would like to contact us for any other reason relating to the processing of personal data, please contact us using the contact details provided at the beginning.

1.7.1 Information about your right to object in accordance with Article 21 GDPR

1.7.1.1 Individual right of objection

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR (data processing on the basis of a legal obligation or balancing of interests); this also applies, where applicable, to profiling based on this provision within the meaning of Article 4(4) GDPR.

We also process your personal data in individual cases for direct marketing purposes. You also have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. 

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes. In the case of direct advertising by e-mail, you can revoke your consent at any time without incurring any costs other than the transmission costs according to the basic rates. A notification in text form to the aforementioned contact details (e.g. e-mail, fax, letter) is sufficient for this.

1.7.1.2 Revocation of consents granted

You can revoke any consent you have given us at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

1.8 Updates to this data protection notice

This privacy notice may be updated periodically. We will update the date at the top of this website accordingly and recommend that you check it for changes.

2 Supplementary data protection notice for users of our websites

This separate data protection notice applies to users of the Lacos websites www.lacos.eu and www.lacos.de and supplements the above general data protection notice of Lacos.

2.1 What additional data is collected, processed and shared when you use this website?

2.1.1 Collection of usage and device data and processing in log files

We collect data about every access to the server on which the website is located (so-called server log files) on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) in the detection and elimination of faults, ensuring the correct delivery of the website, system security and the detection and tracking of unauthorized access or access attempts. The access data includes the address of the website accessed, file, date and time of access, amount of data transferred, URL, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum of 7 days and then deleted. Data whose further storage is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

2.1.2 Collection of usage and device data via cookies

When you visit our website, it may retrieve information from your browser and process it using cookies, JavaScript or pixels (hereinafter collectively referred to as "cookies"). This may be information about you or your device. This allows us to distinguish your web browser from those of other users of our website, learn more about your product interests and provide or optimize functions accordingly. 
Cookies enable the provision of basic functions and services, e.g. registered users do not always have to log in again when accessing a page.

2.1.2.1 Consent management service

We use a consent management tool (also known as a consent management service) that informs you about further consent-based data processing, registers your consent in this regard and stores it on your end device using cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR, the legal obligation.

Further information on data processing, including the purpose, legal basis, recipients and storage period, can be found below. This applies in particular to our optional marketing and analysis services for which we request your consent.  

Irrespective of this, you can use the settings in your browser to determine whether cookies should be set and retrieved. For example, you can completely deactivate the storage of cookies in your browser, restrict it to certain websites or configure your browser so that it automatically notifies you as soon as a cookie is to be set and asks you for feedback.

The following information on the cookies used supplements the information in the consent management service,

2.1.2.2 Session cookies

We currently use technically necessary session cookies on the basis of Art. 6 para. 1 lit.f GDPR, our legitimate interest, necessary functions. Session cookies are deleted when you have finished using our online offer and, for example, log out or close the browser. On the other hand, some cookies or information remain stored in the browser's localStorage for a predefined period of time in order to use the information stored therein for repeat visits.

2.1.2.3 Google Analytics

The web analysis service "Google Analytics" from Google Ireland Ltd. is also used with your consent. Google Analytics uses cookies, among other things, to enable us to analyze the use of our websites by users under a pseudonym. The information collected about your use of this website (including your IP address) is transmitted to a Google server in the USA and stored there. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to other recipients where required to do so by law, or where such recipients process the information on Google's behalf. Google may associate this information with other data that Google has about you.

The Google Analytics function only becomes active with your consent.

2.1.2.4 Visableleads.com

We use a business intelligence solution from Visable GmbH (www.visable.com) for analysis and marketing purposes. This uses pixel-code technology and cookies to create pseudonymized user profiles, insofar as the system can establish affiliation with a company based on the user's IP address. The data collected, which may initially still contain personal data, is collected directly by Visable on our behalf and used there to create the above-mentioned user profiles. Visitors to this website are not directly identified and no other personal data is merged with the user profiles. If IP addresses cannot be assigned to a company, the aggregated usage data is deleted immediately. Insofar as a company reference could be established, Visable allows us to infer a possible interest in certain Lacos products or services.

The Visable function only becomes active with your consent.

2.1.3 Data processing with the use of our contact form

If you send us inquiries via the contact form, the information and contact details you provide will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We will not pass this data on to third parties without your consent.

We also process your data in our customer management systems (CRM). 

This data is processed within the scope of the legal bases listed under sections 1.3.2-1.3.4.

The data you enter in the contact form will be processed until you ask us to delete it and there are no legitimate interests to the contrary, or the purpose for data storage no longer applies (e.g. after your request has been processed) or legal obligations provide for further storage.

2.1.4 Integration of third-party services and content

We use content or service offers from third-party providers on our website on the basis of your consent. In particular, we have embedded videos on Youtube.com (hereinafter also referred to as "content").
Clicking on the video tiles calls up the videos. In this respect, you consent to the associated data processing, including the third-party provider Google Ireland Ltd. becoming aware of your IP address as the recipient of this content, the specific address of the page accessed on our website, the video, system date and time of access, and your browser ID.

Without this data, the content cannot be transmitted to your browser. The IP address is required to display this content.

Our website has integrated YouTube videos in the so-called extended data protection mode. In extended data protection mode, YouTube guarantees that it will not store any cookies with personal data on your end device. In particular, no connection is established with the DoubleClick ad network when the video is accessed.

Simply clicking on an embedded YouTube video can trigger further processing operations over which we, as the operator of this website, have no influence.

Please note that data may also be transferred to the USA, in particular by Google. With your consent, you also agree to such transfers in accordance with Art. 49 para. 1 sentence 1 lit. a GDPR. In particular, there is a risk that your personal data may be processed by US authorities for control and monitoring purposes, possibly without the possibility of legal recourse.

Please note Google's privacy policy for YouTube.

2.2 Links to third party websites

Our website may contain links to third parties. Lacos accepts no responsibility for the content of websites linked to its website. If you visit a third party website, it is your responsibility to ensure that you read the privacy policy and terms and conditions that apply to that website.

3 Supplementary data protection notice for the use of our video conferences 

This separate data protection notice applies to users who use our video conferencing systems together with us. It supplements the above general data protection notice of Lacos.

We use various video conferencing tools for communication. Data processing takes place as part of your participation in a video conference or online event.

3.1 What additional data is collected, processed and shared when you use our video conferencing software?

3.1.1 Processing of content, usage and device data

In addition to image and sound, the following data is typically processed: Name and IP address of the participant, name of the room, data on the end device used. In addition, depending on use, content from shared screens, chats, whiteboard posts or status may be collected. Where applicable, telephone dial-in data can be processed: All voice communication as well as traffic data (telephone number, dial-in number, PIN, call duration). In the event of technical errors, the error ID and affected device data are also stored.

The online events are typically not recorded.
During such a video conference, all participants can see, read and hear data from screen shares, chats, videos, audios and whiteboard contributions.

By participating in video conferences and activating your device camera, you consent to the processing of your data. 

Please note that Microsoft Corp. may also transfer your data to the USA. 

3.2 Who receives your data?

3.2.1 Transfers to companies that provide services for us as processors

Your personal data is passed on to companies that provide video conferencing systems on our behalf in accordance with our instructions. The provider of our video conferencing system Microsoft Corp. provides Microsoft Teams for us. 

3.2.2 Transfers to third countries

If you use our video conferencing services with us, certain connection data will be processed on cloud-based servers of the US service providers. 

The transfer of personal data to so-called insecure third countries outside the EEA cannot be ruled out. Such third countries do not have a level of data protection comparable to that in the EU.

We have therefore provided suitable guarantees with the aforementioned providers by means of standard contractual clauses issued by the EU Commission, which provide you with enforceable rights and effective legal remedies. We also try to enable you to use such software in a data-saving manner (e.g. participation in a video conference without registering your e-mail address in MS Teams).

4 Supplementary data protection notice for users of our Lacos telematics package (lc-fleetnav-web.lacos.de)

This data protection notice provides information about the processing of personal data when our telematics package is used by subscribers or users of our telemetry portal. The data processing is generally carried out within the framework of order processing for our customers in accordance with Art. 28 GDPR.

4.1 What data do we process for what purposes and on what legal basis?

LACOS offers certain services as a subscription with its telematics package.

The corresponding connected components of the LC:TRACKER and LC:ONE product group collect telemetry data and transmit it to the LACOS telemetry portal LC:FLEETNAV-web. The telemetry data can be assigned to individual vehicles or machines or their usage and evaluated by the respective customer and their users.

For each tracker / display, GPS data and, if necessary, other sensor or operating data are collected and transmitted to the LACOS server via radio-based data transmission and logged there.

Notifications can also be sent to stored users via SMS or e-mail about certain status changes or specified deadlines.

The following personal data ("telemetry data") may be processed to carry out the subscription:

• Master, contact and customer data or inventory data
• Product information or usage data
• Company data: e.g. company name, location, contact details for notification
• Vehicle or machine information: e.g. make, model or type, working width, stored maintenance interval data
• GPS-based working time data: e.g. parking, transport, field and standing times and, if applicable, distance traveled, mapped lanes, location data for each vehicle or machine  
• GPS-based field data: e.g. uploaded fields of the customer as GPS polygons, field designation, area size, mapping of fields in map, other assigned properties, defined geofence areas for specific vehicles or machines
• User profile data: e.g. user name, name and e-mail address of the created user and assigned role
• Telemetry device data: e.g. serial number, eSIM number, assigned machine type, signal strength and status data of the telemetry unit, LC:TRACKER configuration or modes

LACOS may use the telemetry data collected and provided in LC:FLEETNAV for its own purposes for research and analysis purposes within the scope of the legitimate interest Art. 6 para. 1 lit. f GDPR in order to improve Lacos products and services and to develop new functions. Where possible, the telemetry data is pseudonymized or anonymized for these statistical evaluations.

As part of the provision of the LACOS telematics package, Lacos processes inventory data for the calculation of fees for the Internet connection of the trackers (Art. 6 para. 1 lit. f GDPR).

4.2 Recipients of this data

The Openstreetmaps service is used to map the telemetry data. IP addresses and GPS coordinate logs are transmitted to display the geolocation data on a map.

• Further information on data protection at the OSM Foundation can be found here:
  wiki.osmfoundation.org/wiki/Privacy_Policy

Traffic data is processed by the telecommunications service provider in connection with the provision of the tracker's internet connection.

4.3 How long do we store your data?

We will process your data for the duration of the contract.

If you (i) cancel your subscription, (ii) deregister all your tracked vehicles or machines, or (iii) we terminate your account for violations of the Terms and Conditions, we will delete or anonymize your telemetry data shortly thereafter.

We anonymize telemetry data for our own purposes on a rolling basis 90 days after collection in each case.

We retain the data required for contract processing and, in particular, billing until the expiry of the periods specified by law in accordance with commercial and tax law within the meaning of Art. 17 para. 3 lit. b GDPR. For this period (regularly ten years from the conclusion of the contract), the data will be processed again solely in the event of a review by the tax authorities. 
This also extends to emails that were used as commercial or business letters to initiate, conclude, execute or rescind a commercial transaction and must be retained for six years.

5 Supplementary data protection notice for our online store customers 

This data protection notice supplements the above General Data Protection Notice and applies to customers of our online store.

5.1 What data do we process from customers of our online store?

5.1.1 Data processing with creation of a mandatory customer account

Registration and use of a customer account is required to use our online store. This enables us to legitimize the customer as an entrepreneur, as our offer is aimed exclusively at entrepreneurs.

To set up a customer account, a self-chosen password must be provided, together with an e-mail address for access to the customer account. The personal access data must be treated confidentially and in particular must not be made accessible to unauthorized third parties. We cannot accept any liability for misused passwords unless we are responsible for the misuse. The legal basis for the data processing associated with the customer account, insofar as personal data is stored, is Art. 6 para. 1 lit. b GDPR.

5.1.2 Data processing upon conclusion of a contract

When you use our online store, we process the data required for the conclusion, execution or termination of a contract. This includes in particular 

• Master data (e.g. name, addresses, telephone number, e-mail address)
• Contact data (e.g. telephone number, e-mail address, company affiliation)
• Customer account data (e.g. customer number, user name, password (hashed))
• Customer data: (e.g. correspondence, contracts, services, orders, archived correspondence)
• Product data: (e.g. product ID and your purchase date)
• Payment data (e.g. order total, payments received, receivables) 
• Product data (e.g. data on purchased products and deliveries)

The legal basis for this is Art. 6 para. 1 lit. b GDPR, i.e. we need this data to fulfill contractual obligations. We are also obliged to process your e-mail address due to a requirement in the German Civil Code (BGB) to send an electronic order confirmation (Art. 6 para. 1 lit. c GDPR).

If we do not use your contact data for advertising purposes, we store the data collected for contract processing until the expiry of any contractual warranty rights. After expiry of this period, we retain the information required under commercial and tax law for the contractual relationship for the periods specified by law. For this period (regularly ten years from the conclusion of the contract), the data is processed again solely in the event of a review by the tax authorities. 

The following data processing is also required to process the purchase contract: 

If you have selected the Paypal payment method, we will forward the required payment data to the payment service provider you have selected. We pass on details of your delivery address to a logistics company commissioned by us for the purpose of processing the purchase contract.

We use an external IT service provider (recipient) to operate the web store.

5.2 Data processing after conclusion of the contract

If you have concluded a contract with us, we will treat you as an existing customer. Under the legal requirements of Section 7 (3) UWG and, if applicable, in conjunction with Art. Art. 6 para. 1 lit. f GDPR, we are entitled to use the e-mail address you provided when placing a binding order for a product or service for direct advertising for our own similar goods or services.

5.3 How long do we store your data?

We process and store any personal data collected within the scope of the statutory retention periods and our legitimate interest for internal administrative purposes for a maximum period of 10 years.

6 Supplementary data protection notice for users of the LACOS fan page on Facebook.com (www.facebook.com/lacosgmbh)

This data protection notice applies to users of the Lacos fan page at www.facebook.com/lacosgmbh/ and supplements the above General Data Protection Notice.

6.1 Who is responsible for data processing and who can I contact?

We are jointly responsible with Facebook Ireland Ltd. for the collection (but not the further processing) of data from visitors to our Facebook page ("Fan Page"). This data includes information about the types of content users view or interact with, or the actions they take (see "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), sas well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see "Device information"). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, known as "Page Insights", for page operators to help them understand how people interact with their pages and the content associated with them. We have concluded a special agreement with Facebook ("Information on Page Insights", www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfill the rights of data subjects (i.e. users of our fan page can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information on Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data).

Jointly responsible within the meaning of Art. 26 General Data Protection Regulation (GDPR) are the following controllers.

Operator of the Facebook platform:
Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2 Ireland

You can contact the Data Protection Officer of Meta Plattform Ireland Ltd. using this form. 

Editorially responsible for this fan page on Facebook is:
LACOS GmbH
Precision in Software

Industriestraße 9
07937 Zeulenroda-Triebes

6.2 What data do we process?

6.2.1 Data that you provide to us for general inquiries via the message form

For messages sent to us, we process your Facebook user name and all other information that you provide when using the message form on the fan page or that we take from your public profile. We process your request or posts in order to process and, if necessary, respond to them. This includes, for example, information that you provide when you contact us:

• submit a request for a specific service;
• ask a question or give us feedback.

This processing is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to be able to contact you in response to your inquiries or contributions, as well as to assert legal claims and defense in legal disputes, to assist the authorities in the prosecution of criminal offenses, to provide you with information about our services (direct marketing) that you request from us as our customer or that we believe may be of interest to you, insofar as this is permitted by law.

6.2.2 Statistical data that we analyze

If you interact with our fan page or our content on Facebook, the operator of the Facebook platform collects usage data. We do not have direct access to this usage data, but we do have access to statistical information based on it.

We use the Insights analysis service of the Facebook platform operator in order to

• Generate page statistics, including how many users we reached with which posts, how many reacted to them and how our fan page is interacted with;
• to obtain information about the target group we have reached in terms of its demographic characteristics
• to measure the effectiveness and distribution of our advertisements on Facebook.

This processing is also based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR to recognize acceptance and usage preferences (e.g. number of followers, number of views of individual page areas, user statistics by age, geography and language) and to be able to improve and align the offer on our fan page as closely as possible to the target group.

6.2.3 Data that Facebook collects when you visit this website

When you visit our fan page, the operator of the Facebook platform, as the other controller, collects various directly personal information about you and your device and processes it for various purposes, including Facebook's own purposes. 

Facebook Ireland Limited ("Facebook") is generally responsible for the collection and further processing of personal user data on Facebook websites. Please note that Facebook collects and processes certain information about your visit to our fan page even if you do not have a Facebook user account or are not logged in to Facebook.

For information on the processing of personal data by Facebook, please refer to Facebook's data policy (Privacy Policy) www.facebook.com/privacy/explanation

If you "share" one of our posts, "comment" on it, mark it with "Like" or "reply" to our comments, data processing takes place that is attributable to you or the platform operator Facebook. We are not responsible for this data processing within the meaning of Art. 4 No. 7 GDPR.

We are not obliged to check the contributions, comments or content uploaded, posted or sent in by users. However, Lacos GmbH reserves the right to immediately reject, block or remove any contributions, comments or content from blogs and forums - insofar as these are publicly accessible on the fan page - without prior notice as soon as it becomes aware of their illegality.

6.2.4 Where do we store your personal data?

When using this fan page, data is also transferred to countries outside the European Economic Area ("EEA"). There is no adequacy decision by the EU Commission for these countries, as there are no data protection regulations comparable to those of the EU (so-called third countries).
Please refer to further information in Facebook's privacy policy regarding additional legal bases for this third country transfer.

6.3 Your rights as a data subject

Every person affected by our personal data processing has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure. In addition, there is a right of appeal to a data protection supervisory authority in accordance with Article 77 GDPR in conjunction with Section 19 BDSG.

These rights can be exercised against both of the aforementioned controllers.

If you wish to exercise your rights vis-à-vis Facebook, please follow Facebook's instructions: https://www.facebook.com/privacy/explanation

Perception of objection or revocation of granted consent

Your objection can be made informally and can also be addressed to us by telephone.

Meta Platforms Ireland Limited ("Facebook") is responsible for the collection and further processing of personal user data on Facebook websites. 

7 Supplementary data protection notice for business partners of LACOS

This data protection notice applies to suppliers of LACOS GmbH and customers of our system house services and supplements the above General Data Protection Notice.

We hereby inform you about the processing of your personal data in connection with your employer's contractual relationship with us, or with regard to our joint contractual relationship if, for example, you are our direct contractual partner as a sole trader.

7.1 What data do we process, for what purposes and on what legal basis?

7.1.1 Processing of your data due to contractual obligations or pre-contractual measures (Art. 6 para. 1 lit. b GDPR)

We process your data in order to conclude, execute or terminate a contract with you or your employer. This data includes in particular

• Your name,
• your business address,
• Your business contact details, such as telephone number and e-mail address, as well as correspondence and contractual agreements with us,
• Performance metrics of our suppliers: e.g. information that allows us to assess the performance of the supplier, including the supplier's personnel,
• Support requests from customers of our system house services, but also offers for related products.

If we have not received the aforementioned data from you, it comes from publicly accessible sources. We will neither sell your personal data to third parties nor market it in any other way. 

7.1.2 Processing of your data on the basis of a balancing of interests (Art. 6 para. 1 lit. f GDPR), insofar as your legitimate interests do not outweigh our legitimate business interests

If you are our contractual partner, we carry out a prequalification procedure under certain conditions when establishing contractual relationships. In doing so, we determine whether we may enter into a business relationship with you, taking into account the provisions of the Money Laundering Act and the EU sanctions lists in accordance with EU Regulations 2580/2001 and 881/2002.

In addition, we process your data to protect our legitimate interests or those of third parties, to or for the purpose of

• Protecting our legitimate business interests and legal rights. This includes, but is not limited to, use in connection with legal claims, regulatory, audit, investigative purposes (including disclosure of such information in connection with legal proceedings, insurance claims, or litigation) and compliance reporting obligations
• Transmission of supplier data to our business partners as part of the preparation of offers and compliance checks of third parties
• Business management
• Providing you with information about our products, services, offers or technical developments (direct marketing) that you request from us as our business partner or that we believe may be of interest to you, to the extent permitted by law
• if you have indicated a preference in relation to marketing communications, or to process follow-up inquiries, to improve our service,
• or other correspondence.

7.2 Who receives your data?

We disclose your data to third parties if we are legally obliged to disclose your personal data or if we consider this necessary to protect the rights, property or security of us, our customers or third parties or if we have a legitimate interest.
Recipients may be

• Public bodies and institutions (e.g. tax authorities, law enforcement authorities) in the event of a legal or official obligation
• Creditors or insolvency administrators who make inquiries in the context of enforcement proceedings
• Auditors
• Service providers that we use in the context of order processing relationships,
• Suppliers to whom we disclose data on our other suppliers or sales partners as part of the review of standards, sanctions list reviews and certifications
• other business partners.

If you contact us via forms on our social media presences on Facebook, but also via our contact form, we process your data in our customer relationship management systems (CRM) or ticket system (Jira). The provider of the Jira software, Atlassian Ltd., cannot rule out the processing of personal data in so-called unsafe third countries outside the EEA. Such third countries do not have a level of data protection comparable to that in the EU.

With the aforementioned provider, we have therefore provided suitable guarantees by means of standard contractual clauses issued by the EU Commission, which provide you with enforceable rights and effective legal remedies. 

7.3 Do I have an obligation to provide data?

As part of our business relationship, you must provide the personal data that is necessary for the initiation, execution and fulfillment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or will no longer be able to perform an existing contract and may have to terminate it.

7.4 How long do we store your data?

We only process and store personal data of data subjects for as long as the purpose pursued requires it or is required by law.

Beyond the retention periods under commercial and tax law, we process contact data of our business partners' contact persons, corresponding business and communication processes for the duration of our business relationship. After termination of the cooperation, we retain the data for up to 15 years for internal administrative purposes, for example in order to be able to follow up on a previous cooperation.