Data protection declaration in accordance with the GDPR
The purpose of the following is to inform you of the ways in which we collect personal data through the use of our website. Personal data is any data that can be connected to you personally, e.g. name, address, email addresses, user behaviour, IP address.
Updated: April 2023
Name and address of data controller
The data controller within the meaning of art. 4, para. 7 of the EU General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as any other legal provisions concerning data protection is:
Grass Platz 1
Tel.: +43 5578 701-0
Name and address of data protection officer
The data protection officer responsible is:
c/o migosens GmbH
45473 Mülheim an der Ruhr
We host our website with our order processor Platform SH, Platform.sh GmbH, Marienstr. 90, 50825 Cologne, Germany.
Connection data is processed for the purpose of providing and delivering the website. For the mere purpose of providing and delivering the website, this data shall not be stored after the page request. However, the connection data is stored by our processor for security purposes. The duration of processing for security purposes is variable and ends when those security purposes are no longer required. In addition, our processor anonymises the collected data immediately upon its collection and makes the anonymous data available to us for evaluation in the form of statistics. We use these statistics to troubleshoot and further develop our website.
The legal basis for data processing is the unconditional technical necessity for the provision and delivery of the service you expressly requested with your page request to www.grass.eu in accordance with sec. 96 para. 3 of the German Telecommunications Act (Telekommunikationsgesetz - TKG)
Server log files
Connection data is processed for the purpose of monitoring the technical function of our website and to increase the operational security of our web host. In terms of log file rotation, log files are stored until a 100 MB limit is reached and automatically overwritten or deleted after the 100 MB limit is reached. The storage period is approximately 60 days. The legal basis for data processing is the unconditional technical necessity of a server log file as a basic data base for error analysis and for security measures within the framework of the service you expressly requested with your page request to www.grass.eu in accordance with sec. 96 para. 3 of the TKG.
On our website there is the opportunity to contact us directly by means of a contact form. Upon submitting the contact form, the personal data you have entered will be processed by GRASS GmbH for the purpose of processing your request on the basis of the consent you have given by submitting the form in accordance with art. 6 para. 1 line a of the GDPR. Data processing is carried out until revoked. There is no legal or contractual obligation to provide the personal data. The only consequence of non-provision is that you cannot submit your request and that we cannot process it.
Insofar as you have given your consent, Google Analytics 4, a web analysis service of Google LLC, is used on this website. The entity responsible for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
Scope of processing
We use the User ID function. The User ID allows us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and analyse user behaviour across devices.
With Google Analytics 4, IP addresses are anonymised by default. IP anonymisation means that Google truncates your IP address within European Union member states or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.
During your visit to the website, your user behaviour is recorded in the form of "events". Events can be:
- Page requests
- First visit to the website
- Start of session
- Your "click path", Interaction with the website
- Scrolls (whenever a user scrolls to the end of the page (90%))
- Clicks on external links
- Internal search requests
- Interaction with videos
- File downloads
- Adverts seen/clicked on
- Language setting
The following is also recorded:
- Your approximate location (region)
- Your IP address (in shortened form)
- Technical information on your browser and your devices (e.g. language setting, screen resolution)
- Your Internet provider
- The referrer URL (the website/advert via which you came to this website )
Purposes of processing
On behalf of the operator of this website, Google will use this information to analyse your use of the website and to create reports regarding website activities. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.
Recipients of the data are/may be
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor in acc. with art. 28 GDPR)
- Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
- Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
The possibility that US authorities may access data stored by Google cannot be excluded.
If data is processed outside the EU/EEA and the level of data protection is not in accordance with the European standard, we have concluded EU standard contractual clauses with the service provider in order to establish an appropriate level of data protection. Google Ireland's parent company, Google LLC, is based in California, USA. Transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently regarded as a third country from a data protection perspective. You do not have the same rights in that country as you do within the EU/EEA. You may not have any legal remedies against access by authorities.
The data sent by us and linked to cookies will be automatically deleted after 14 months. Data that has reached the end of its retention period is automatically deleted once a month.
The legal basis for this data processing is your consent in accordance with art. 6, para. 1, p.1 line a of the GDPR.
You may revoke your consent at any time, effective for future processing, by accessing the cookie settings [ADD THE LINK TO THE CONSENT TOOL COOKIE SETTINGS HERE] and changing your selection. The legality of processing carried out based on your consent until the point of revocation remains unaffected by this.
Google Tag Manager
For the management of our website and for the integration of cookie-based technologies, we use the Tag Manager service, which is offered by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). For this purpose, your IP address is transferred to a Google server, which may also be located in the USA, each time you visit one of our Internet pages. The IP address is not stored by Google as part of the Tag Manager service and is only used to integrate the technologies managed via the Tag Manager. The Tag Manager itself does not set cookies.
In the event of your consent having been given, we process your personal data as joint processors together with the service Youtube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for the purpose of playing videos on our website. We enable the service to collect connection data, collect data from your web browser and place an advertising cookie. By placing advertising cookies, Google is able to calculate an individual user ID for each user. This personal data, which can uniquely identify a user, is then processed within the framework of the advertising network operated by Google. The legal basis for this data processing is your consent pursuant to sec. 96 para. 3 of the TKG. Insofar as Google carries out further independent processing of the data, in particular within the framework of the Google advertising network, Google is solely responsible for this. For details, please refer to the Privacy Statement from Google.
Google transfers your personal data to the United States. The legal basis for the transfer of data to the USA is your consent pursuant to art. 49 para. 1 line a in conjunction with art. 6 para. 1 line a of the GDPR. You were informed prior to giving your consent that the USA does not have a level of data protection that meets EU standards. In particular, US intelligence services can access your data without you being informed and without you being able to take legal action. For this reason, the European Court of Justice has passed a judgement annulling the earlier Privacy Shield. Failure to give your consent means only that the Youtube service will not be made available to you.
You may revoke consent you have already given by deactivating Youtube here. (Integrate opt-out function)
We use the LinkedIn Insight conversion tool of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, which allows us to obtain information about the use of our website and to present you with advertising content on other websites tailored to your interests. For this purpose, a cookie with a validity of 120 days is set in your browser, which enables LinkedIn to recognise you when you visit a website. LinkedIn uses this data to create anonymous reports for us on ad activity and information about how you interact with our website.
You can opt-out of the LinkedIn Insight Conversion Tool and interest-based advertising by following this link: www.linkedin.com/psettings/guest-controls/retargeting-opt-out . To do so, if you are a LinkedIn member, click on the "Opt out on LinkedIn" box. Other visitors click on "Decline".
Further information on data protection at LinkedIn can be found here: www.linkedin.com/legal/privacy-policy
In case of granting your consent, we process with the service Facebook Pixel, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, as joint controllers, process your personal data for the purpose of data for the purpose of displaying personalised advertisements and measuring our our advertising success. Failure to provide consent has no direct effect on the directly affect the operation of the website, but we will not be able to however, if you do not give your consent, we will not be able to serve personalised advertising on your end devices.
We allow the service to collect connection data, data about your web browser and data about the data about the content accessed. We also enable the service to
tracking and recognition software as well as the storage of data on your storage of data on your terminal device. By means of the tracking and recognition software, it is then possible for the service to enrich its advertising network and to recognise you when you visit other websites or to websites and to play personalised advertising. In addition
we use the data collected to measure our advertising success. The data on your end device is stored for a period of up to two years stored.
The legal basis for the data processing is your consent in accordance with § 96 para. 3 TKG.
Right of objection
If the processing of your personal data is based on the legitimate interest, you have the right to object to this processing. If there are no compelling legitimate reasons for our processing, the processing of your data will be discontinued on this legal basis. In addition, you have the right to object to the processing of your personal data for the purpose of direct marketing. In the event of an objection, your personal data will no longer be processed for the purpose of direct marketing. The lawfulness of the data processed until the point of objection shall not be affected by the objection.
Right of revocation
You have the right to revoke your consent at any time. In the case of consent to the receipt of electronic advertising, your consent can be revoked by clicking on the unsubscribe link. In such a case, processing will be stopped unless there is another legal basis to continue it. The legality of the data processed until the revocation shall not be affected by the revocation.
Other rights of data subjects
You also have the right to information, correction, deletion and restriction of the processing of personal data. If the legal basis for the processing of your personal data is your consent or in a contract concluded with you, you also have the right to data portability. You also have the right to lodge a complaint with the supervisory authority. For more information on the supervisory authorities in the European Union, please click here.