Privacy Policy

1. Privacy at a glance

General notes

The following notes provide a quick summary of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information about data protection, please refer to our Privacy Policy as set out below.

Data collection on this website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information on the data controller" in this Privacy Policy.

How do we collect your data?
On the one hand, your data is collected by you providing it to us. For example, this may be data that you enter in a contact form.

Other data is collected by our IT systems automatically or after you giving your consent when you visit the website. This is mainly technical data (e.g. Internet browser, operating system, or time of page impression). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Part of the data is collected to ensure our website is made available without any errors. Other data may be used to analyze your user behavior.

What are your rights regarding your data?
You have the right at any time to receive information free of charge about the origin, recipient, and purpose of the personal data we store about you. You also have the right to request that this data be corrected or deleted. If you have given your consent to data processing, you may withdraw this consent at any time for the future. You also have the right to request that processing of your personal data be restricted under certain circumstances. Furthermore, you have the right to lodge a complaint with the relevant supervisory authority.

You may contact us at any time with regard to this and any other matters relating to data protection.

Analytics tools and tools from third-party suppliers

When you visit this website, your surfing behavior can be statistically analyzed. This is done primarily with so-called analytics programs. Detailed information about these analytics programs can be found in the Privacy Policy below.

2. Hosting

We host the content of our website with the following provider:

IONOS

The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (hereinafter referred to as IONOS). When you visit our website, IONOS collects various log files including your IP addresses. For details, please refer to IONOS’s privacy policy:https://www.ionos.de/terms-gtc/terms-privacy.

Use of IONOS is based on Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. Insofar as corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications and Telemedia Data Protection Act (TTDSG), to the extent that the consent includes the storage of cookies or access to information in the user's device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent may be withdrawn at any time.

Order processing
We have concluded an order processing agreement with the above-mentioned provider. This is a contract required by data protection law, which ensures that the provider processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

3. General notes and mandatory information

Privacy

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this Privacy Policy.

When you use this website, various items of personal data are collected. Personal data is data by which you can be personally identified. This Privacy Policy explains what data we collect and what we use it for. It also explains how this is done and for what purpose.

Please be aware that data transmission over the Internet (e.g. when communicating by email) may be subject to vulnerabilities. It is not possible to provide absolute protection of the data against access by third parties.

Information on the data controller

The controller responsible for data processing on this website is:

Farüchoc Schokoladenfabrik GmbH & Co. KG
Carl-Dütting-Strasse 1
49090 Osnabrück
Germany Tel.: +49 541 91331-0
email: info@faruechoc.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

Storage limitation

Unless more specific storage limitation has been specified within this Privacy Policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted after these reasons no longer apply.

General notes on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data are processed pursuant to Art. 9(1) GDPR. In the case of explicit consent to personal data being transmitted to third countries, the data processing is also carried out on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information in your device (e.g. via device fingerprinting), the data processing is also based on Section 25(1) of the German Telecommunications and Telemedia Data Protection Act (TTDSG). Consent may be withdrawn at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data on the basis of Art. 6(1)(c) GDPR if it is required for fulfilling a legal obligation. Data processing may also be based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case can be found in the following paragraphs of this Privacy Policy.

Data protection officer

We have appointed a data protection officer.

DSO Datenschutz Osnabrück GmbH
Dipl.-Kfm. Björn Voitel
Mercatorstr. 11
49080 Osnabrück
Germany Tel.:+49 541 60081631
email:info@dso-datenschutz.de

Note on data transfer to the USA and other third countries

Some of the tools we use are from companies based in the USA or other third countries that are not secure under data protection law. When these tools are active, your personal data may be transferred to and processed in these third countries. Please be aware that in these countries it is not possible to guarantee a level of data protection comparable to that in the EU. For example, U.S. companies are obligated to release personal data to security authorities without you, the data subject, being able to take legal action against this. It can therefore not be ruled out that U.S. authorities (e.g. intelligence agencies) process, evaluate, and permanently store your data located on U.S. servers for monitoring purposes. We have no influence on these processing activities.

Withdrawing your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw any consent you have given at any time. The legality of the data processing carried out prior to you withdrawing your consent shall remain unaffected by this withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If the data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. For the respective legal basis on which processing is based, please refer to this Privacy Policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the purpose of asserting, exercising, or defending legal claims (objection under Article 21(1) GDPR).

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing (objection pursuant to Art. 21(2) GDPR).

Right to lodge a complaint with the relevant supervisory authority

In the event of breaches of the GDPR, data subjects shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged breach. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, deletion, and correction

Within the framework of the applicable statutory provisions, you have the right at any time to free information about the personal data stored about you, its origin and recipient, and the purpose of data processing, and, if applicable, a right to correction or deletion of this data. You may contact us at any time with regard to this and any other matters relating to personal data.

Right to restriction of processing

You have the right to request that processing of your personal data be restricted. You may contact us at any time if you wish to exercise this right. The right to restrict processing exists in the following cases:

If you dispute the accuracy of the personal data we store about you, we usually need time to verify this. You have the right to request that processing of your personal data be restricted for the duration of this verification.
If the processing of your personal data took/is taking place unlawfully, you may request the restriction of data processing instead of deletion.
If we no longer need your personal data, but you need it to exercise, defend, or enforce legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Art. 21(1) GDPR, your interests must be balanced against ours. You have the right to request that processing of your personal data be restricted until it has been determined whose interests prevail.

If you have restricted the processing of your personal data, this data may - apart from being stored - only be processed with your consent, or for asserting, exercising, or defending legal claims, or for protecting the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or requests that you send to us as the site operator. An encrypted connection is indicated by the browser address bar changing from "http://" to "https://" and by the padlock icon in your address bar.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies

Our web pages use so-called cookies. Cookies are small packets of data and do not cause any damage to your terminal. They are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your terminal. Session cookies are automatically deleted after the end of your visit. Permanent cookies remain stored on your terminal until you delete them yourself or until they are automatically deleted by your web browser.

In some cases, cookies from third-party companies may also be stored on your terminal when you enter our site (third-party cookies). These enable us or you to use certain services of the third-party company (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the displaying of videos). Other cookies are used to evaluate user behavior or display advertising.

Necessary cookies, i.e. cookies that are necessary for carrying out the electronic communication process, for providing certain functions that you have requested (e.g. for the shopping cart function), or for optimizing the website (e.g. cookies for measuring the web audience), are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies in order to provide its services in optimized form and free from technical errors. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is based exclusively on this consent (Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications and Telemedia Data Protection Act (TTDSG)); consent may be withdrawn at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies on a case-by-case basis, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. Disabling cookies may limit the functionality of this website.

If cookies are used by third-party companies or for analysis purposes, we will inform you about this separately within the framework of this Privacy Policy and, if necessary, request your consent.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This information concerns:

browser type and browser version
operating system used
referring URL
hostname of the accessing computer
time of server request
IP address

This data will not be merged with other data sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in its website being presented free from technical errors and in an optimized form, to which end the server log files must be recorded.

Contact form

If you use the contact form to submit an inquiry, we will store the information you provide in the form, including any contact data you specify in it, for the purpose of processing the inquiry and in case of any follow-up questions. We do not pass on this data without your consent.

Processing of this data is based on Art. 6(1)(b) GDPR insofar as your inquiry is related to the performance of a contract or is necessary for implementing any pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), if this has been requested; you may withdraw your consent at any time.

The data you provide in the contact form will remain with us until you request us to delete it or withdraw your consent to it being stored, or until the purpose for storing the data no longer applies (e.g. after we have completed processing your inquiry). Mandatory statutory provisions - in particular retention periods - remain unaffected.

Inquiries submitted by email, telephone or telefax

If you contact us by email, telephone or telefax, your inquiry and all personal data (name, request) ensuing from it will be stored and processed by us for the purpose of processing your request. We do not pass on this data without your consent.

The data you send to us via contact requests will remain with us until you request us to delete it or withdraw your consent to it being stored, or until the purpose for storing the data no longer applies (e.g. after we have completed processing your inquiry). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

Communication via WhatsApp

One of the ways we communicate with our customers and other third parties is via the instant messaging service WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communication takes place via end-to-end encryption (peer-to-peer), which prevents WhatsApp or other third parties from gaining access to the communication content. However, WhatsApp gains access to metadata that is created in the course of the communication process (e.g. sender, recipient, and time). Please also be aware that WhatsApp states that it shares personal data of its users with its parent company Meta, which is based in the USA. For more details on data processing, please refer to WhatsApp's privacy policy at:https://www.whatsapp.com/legal/#privacy-policy.

WhatsApp is used on the basis of our legitimate interest in communicating as quickly and effectively as possible with customers, interested parties, and other business and contractual partners (Art. 6(1)(f) GDPR). If corresponding consent has been requested, data processing is carried out exclusively on the basis of such consent; this can be withdrawn at any time with effect for the future.

The communication content exchanged between us on WhatsApp will remain with us until you request us to delete it or withdraw your consent to it being stored, or until the purpose for storing the data no longer applies (e.g. after we have completed processing your inquiry). Mandatory statutory provisions - in particular retention periods - remain unaffected.

We use WhatsApp in the "WhatsApp Business" variant.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details on this here:https://www.whatsapp.com/legal/business-data-transfer-addendum.

We have configured our WhatsApp account so that it does not automatically match data with the address book on the smartphones being used.

We have concluded an order processing agreement with the above-mentioned provider.

5. Analytics tools and advertising

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior of visitors to the website. The website operator receives various usage data, such as page impressions, session duration, operating systems used, and origin of the user. This data is summarized in a user ID and assigned to the respective end device of the website visitor.

Furthermore, Google Analytics enables us among other things to record your mouse and scroll movements and clicks. Google Analytics also uses various modeling approaches to augment the data sets it collects and employs machine learning technologies in its data analysis.

Google Analytics uses technologies that enable the user to be recognized for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the USA and stored there.

The use of this service is based on your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications and Telemedia Data Protection Act (TTDSG). Consent may be withdrawn at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details on this here:https://privacy.google.com/businesses/controllerterms/mccs/.

Browser plugin

You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link:https://tools.google.com/dlpage/gaoptout?hl=de.

For more information about how Google Analytics handles user data, please refer to Google’s privacy policy:https://support.google.com/analytics/answer/6004245?hl=de.

Order processing

We have concluded an order processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

6. e-commerce and payment service providers

Processing of customer and contract data

We collect, process, and use personal customer and contract data for the purpose of establishing, defining the content of, and amending our contractual relationships. We collect, process, and use personal data about the use of this website (usage data) only to the extent necessary to enable the user to use the service or to bill the user. Art. 6(1)(b) GDPR provides the legal basis for this.

The customer data collected will be deleted after completion of the order or termination of the business relationship and after any existing statutory retention periods have expired. Statutory retention periods remain unaffected.

7. Own services

Handling of applicant data

We offer you the opportunity to apply for a job with us (e.g. by email, post, or via online application form). In the following, we inform you about the scope, purpose, and use of your personal data collected during the application process. We affirm that the collection, processing, and use of your data will be in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence.

Scope and purpose of data collection

If you send us an application, we process your personal data associated with it (e.g. contact and communication data, application documents, notes taken during interviews, etc.) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is Section 26 of the Federal Data Protection Act (BDSG) under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (general contract initiation), and - if you have given your consent - Art. 6(1)(a) GDPR. Consent may be withdrawn at any time. Your personal data will only be passed on within our company to persons who are involved in processing your application.

If your application is successful, the data submitted by you will be stored in our data processing systems on the basis of Section 26 of the Federal Data Protection Act (BDSG) and Art. 6(1)(b) GDPR for the purpose of implementing the employment relationship.

Data retention period

If we are unable to make you a job offer, or if you reject a job offer or withdraw your application, we reserve the right - based on our legitimate interests under Art.6(1)(f) GDPR - to retain the data you have provided for up to six months from the end of the application process (rejection or withdrawal of the application). The data will subsequently be deleted and any physical application documents destroyed. Data is retained in particular for the purpose of providing evidence in the event of a legal dispute. If it is apparent that the data will be required after expiry of the six-month period (e.g. due to an impending or pending legal dispute), the data will not be deleted until the purpose for continued storage no longer applies.

It may also be retained longer if you have given corresponding consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.

Inclusion in the applicant pool

If we do not make you a job offer, it may be possible to include you in our applicant pool. In this case, all documents and information from your application will be transferred to the applicant pool in order for us to be able to contact you in the event of suitable vacancies.

Inclusion in the applicant pool takes place exclusively on the basis of your express consent (Art. 6(1)(a) GDPR). Consent is voluntary and is not related in any way to the ongoing application process. Data subjects may withdraw their consent at any time. If they do so, the data will be irrevocably deleted from the applicant pool unless any statutory reasons for retaining the data exist.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been given.

Our social media presence

Data processing through social networks
We maintain publicly accessible profiles on social networks. The individual social networks we use are specified below.

Social networks such as Facebook, Twitter, etc. can generally analyze your user behavior extensively when you visit their website or a website with integrated social media content (e.g. Like buttons or advertising banners). Visiting our social media sites triggers numerous processing operations relevant to data protection. Specifically, this concerns the following:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected under certain circumstances when you are not logged in or if you do not have an account with the social media portal in question. In this case, data is collected, for example, through cookies being stored on your device or by your IP address being recorded.

The operators of the social media portals use this data to create user profiles in which your preferences and interests are stored. This enables interest-based advertising to be displayed to you inside and outside the social media presence concerned. If you have an account with the social network in question, the interest-based advertising may be displayed on all devices on which you are or were logged in.

Please also note that we cannot track all processing on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and privacy policies of the social media portals concerned.

Legal basis
Our social media presence is designed to ensure the broadest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which are to be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6(1)(a) GDPR).

Data controller and assertion of rights
If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. As a matter of principle, you may assert your rights (information, correction, deletion, restriction of processing, data portability, and complaint) both against us and against the operator of the social media portal in question (e.g. against Facebook).

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our possibilities are largely determined by the corporate policy of the provider concerned.

Storage limitation
The data collected directly by us via the social media presence will be deleted from our systems as soon as you request us to do so or withdraw your consent to it being stored, or as soon as the purpose for storing the data no longer applies. Stored cookies will remain on your device until you delete them. Mandatory statutory provisions - in particular retention periods - remain unaffected.

We have no influence on the storage limitation of your data stored by the operators of the social networks for their own purposes. For details, please refer directly to the information provided by the operators of the social networks (e.g. in their privacy policy, see below).

Individual social networks

Facebook
We have a profile on Facebook. This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as Meta). According to Meta, the collected data is also transferred to the USA and other third countries.

We have entered into a joint processing agreement (Controller Addendum) with Meta. This agreement specifies the data processing operations for which we or Meta are responsible when you visit our Facebook page. You can view this agreement at the following link:https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in:www.facebook.com/settings. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details on this here:https://www.facebook.com/legal/EU_data_transfer_addendumandhttps://de-de.facebook.com/help/566994660333381.

For details, please refer to Facebook’s privacy policy:https://www.facebook.com/about/privacy/.

Instagram
We have a profile on Instagram. This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details on this here:
https://www.facebook.com/legal/EU_data_transfer_addendum,https://help.instagram.com/519522125107875andhttps://de-de.facebook.com/help/566994660333381.

For details on how they handle your personal data, please refer to Instagram's privacy policy:https://help.instagram.com/519522125107875.

XING
We have a profile on XING. This service is provided by New Work SE, Dammtorstrasse 30, 20354 Hamburg, Germany. For details on how they handle your personal data, please refer to XING's privacy policy:https://privacy.xing.com/de/datenschutzerklaerung.

LinkedIn
We have a profile on LinkedIn. This service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you wish to disable LinkedIn advertising cookies, please use the following link:https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. For details, please go to www.linkedin.com/legal/l/dpa andhttps://www.linkedin.com/legal/l/eu-sccs.

For details on how they handle your personal data, please refer to LinkedIn's privacy policy:https://www.linkedin.com/legal/privacy-policy.