BOMAG GmbH (subsequently referred to as BOMAG) appreciates your interest in our products and your visit to this website. Data protection and data security for customers and users have always had a high priority for BOMAG. This is why protecting your personal data throughout the entire business process is very important to us.
3.8 Tracking tool
3.8.2 Google Analytics
3.9 External links
4 Rights of those concerned
The party responsible within the definition of the General Data Protection Regulation and other data protection regulations is:
Hellerwald, 56154 Boppard, Germany
Phone: +49 6742 100-0
Fax: +49 6742 100 3090
Legal representatives: Ralf Junker, Dirk Woll, and Robert Laux
Contact details: see above
Data Protection Officer of the responsible processor is
c/o BOMAG GmbH, Hellerwald, 56154 Boppard, Germany
Phone: +49 6742 100-0
Fax: +49 6742 3090
3.1.1 Description of data processing and storage
Every time our website is accessed, our system automatically collects data and information from the computer system of the requesting user.
The following data is collected in the process:
The country from which the user accesses our website is determined on the basis of the IP address recorded. This serves to display the corresponding country and language version of the website (German/English). For this purpose, the IP address is truncated to the first 6 digits and analysed using a Geo IP database; the country through which the user accesses the website is thus determined. A country code is assigned to this country, which is then stored in the log files instead of the IP address.
The other data listed above is deleted from the log files of the system after 7 days, unless further processing is necessary to protect our legitimate interests in exceptional cases (e.g. to arrange for the blocking of IT addresses, filing of a criminal complaint). The data is then deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.
Storage and/or compilation of this data with other personal data of the user does not take place.
3.1.2 Purpose and legal basis of data processing
The data specified in a) is collected
3.1.3 Facebook competitions
Description of data processing, storage
When you participate in a Facebook competition organised by us, you will comment on our Facebook post and thus submit your declaration to participate in the competition, we log your Facebook username, the relevant post with your comment and the time of receipt of the declaration to participate (i.e. your comment on the post). We process this data to ensure you satisfy the eligibility conditions to participate in the draw and to contact you should you win a prize. If you win a prize, we record the time of sending the notification and the content of the message. We use this information to ensure you submit your postal address to receive the prize within the specified period of 7 days. We also collect and store your IP address.
The personal data of the winners will be stored for a period of 10 years in accordance with commercial and fiscal law. Once the statutory limitation period after the end of the competition has expired, the winners’ data will be restricted for further processing and used exclusively for the purposes of defending potential legal claims. The logged IP address will be deleted no later than after a period of 7 days. The data of competition entrants who have not won a prize will be restricted for further processing and used exclusively for the purposes of defending potential legal claims. This information will be deleted once the statutory limitation period has expired.
The purpose and legal basis for data processing
We store IP addresses to enable us to investigate the potential misuse of your personal data. The legal basis for processing this data is Art. 6 para 1 letter f GDPR. The opportunity to investigate the misuse of data is in our legitimate interest. Additional processing of personal information shall be carried out to manage the competition. The legal basis for this is Art. 6 para 1 letter b GDPR.
The data will be used exclusively for the purposes of the competition. Access to such data is only authorised for persons in the company who are assigned to manage the competition.
If you are a winner and communicate your postal address via email to enable us to send the prize, we will use our internal web server and IT system to process such information.
Facebook will also process data arising from comments entered on the Facebook post that are required to participate in the competition. Please visit Facebook for information on the relevant data processing procedures: www.facebook.com/help/568137493302217
When sending the prize by post, the recipient’s address will be made available to the post/parcel service provider. In this context, the data will not be disclosed to third parties.
You can object to the temporary storage of the IP address at any time. Section 4 also applies.
3.1.4 Disclosure/recipient of the data
The collected data is stored on our server.
The data collected in accordance with a) is not passed on to third parties unless this is necessary in the case of attacks on our IT (see b) above), for example, in the context of reporting a criminal offence to the prosecuting authorities.
3.1.5 Right of objection
The temporary acquisition of the user's IP address is essential for the provision of the website and the storage of data in log files for the operation of the website. Consequently, the user does not have the right to object. In all other respects, the user has the right to object to the processing at any time for reasons arising from his/her particular situation; see further information in section D.
3.2.1 Description of data processing and storage
You can write to us at the e-mail address provided in the “Contact us” section. In this case, the personal data transmitted by e-mail is processed by us. The data is used to answer your request. If you provide us with your name and postal address, we process this data in accordance with section C 3 (postal advertising).
The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. If the request relates to a contract that has been concluded or is under negotiation, the contents and times of communication are stored until any claims arising from these have lapsed.
In other cases, the personal data from your e-mail request is restricted for further processing and only used to defend against any legal claims that may arise once the respective conversation with you has ended. The conversation is terminated when it can be inferred from the circumstances that the facts in question have been clarified in full. After the expiry of the limitation period, the data is deleted.
3.2.2 Purpose & legal basis of data processing
Your e-mail address and any other data you provide is stored to respond to your enquiry. The legal basis for this is set out in Article 6(1)(f) of GDPR. If the aim of contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of GDPR.
The data is used exclusively for processing and answering the contact request. We use our own web server and our own IT system for the transmission of the contact request and its processing. BOMAG is a global group with legally independent international companies. If you have any specific requests, your personal data may be shared with affiliated companies to the extent necessary to fulfil your request.
3.2.4 Right of objection and deletion
You may object to the use of your personal data at any time. In this case, the conversation cannot be continued. Section D then also applies.
3.3.1 Description of data processing, storage, purpose and disclosure
If you provide us with your name and postal address, we store them for possible future postal advertising (letters) of our products. If necessary, the data may be made available to an external service provider during franking and dispatch. This provider acts in accordance with our instructions and on our behalf and is based in the European Union. Data is not otherwise disclosed to a third party. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected or if you have objected to its processing.
3.3.2 Legal basis of data processing; right of objection
The legal basis for the data processing defined in a) is Article 6(1)(f) of GDPR. Sending you product information by post is a legitimate interest of our company. You may object to this use of your personal data at any time. In this case, we will cease to send you postal advertising. Section D then also applies.
3.4.1 Description of data processing and storage
The BOMAG Parts Webshop is aimed solely at business clients and legal entities. Before using the service, it is necessary to register electronically for a customer account via the registration page provided. The fields marked as mandatory must be completed so that we can check registration requests, including whether the applicant is actually a company or a legal entity.
Mandatory information includes:
To verify your e-mail address and registration request, we automatically send an e-mail to the address provided before checking the information. You are then asked you to confirm your registration request and verify the accuracy of data provided. If this registration request is not confirmed within 7 days, your login data is deleted.
If you confirm your registration request, we record and save the date and time of the confirmation.
Upon receipt of confirmation, we check whether the applicant really is a company or a legal entity. Since parts are subsequently supplied from our Webshop before payment, a credit check is conducted for companies. For this purpose, information is obtained from Creditreform Koblenz Dr. Rödl & Brodmerkel KG, Rizzastr. 49, 56068 Koblenz. This requires us to provide your company name and registered business address. We then view and assess the information. A decision is not made automatically.
You subsequently receive the result of the registration verification by e-mail. We also process your company name/the name of your legal entity and your postal address in accordance with item C 3 (postal advertising). If we reject your registration request, the data collected is deleted immediately.
In the event of successful registration, we process the data collected during registration in accordance with C 6 (customer account).
3.4.2 Purpose and legal basis of data processing
The mandatory data supplied in the registration process and any other data you may have provided is stored to check the requirements for registration, conduct the credit check, see a) above, inform you of the decision, and to create the customer account. The legal basis for this is set out in Articles 6(1)(b) and (1)(f) of GDPR.
The truncated IP address and the time the registration confirmation is sent is stored for the purpose of verifaying your registration and, if necessary, clarifying any possible misuse of your data. The legal basis for the processing of this data is Article 6(1)(f) of GDPR.
3.4.3 Disclosure/recipient of the data
For the execution of the credit check, we disclose your company name and address to the credit agency named under a). The information on data processing pursuant to Article 14 of GDPR, which is provided by the credit agency, can be found at www.creditreform-koblenz.de. The data is not disclosed in any other respect. We use our own web server IT system to transmit of the registration request and its processing.
3.4.4 Right of objection
You may object to the continuation of the registration check and the transmission of the data mentioned under c) to the credit agency at any time. In this case, registration is not completed and you will be unable to order via our Webshop.
3.5.1 Description of data processing
To place an order via our Webshop, you must first log into your customer account. The data you provided when registering and creating the account is then used automatically to complete the order details. You can enter a new delivery address and select the preferred shipping method (standard/express shipping). The new delivery address is then saved to your customer account. You then have the option to confirm you would like to order the items or make any necessary changes. These procedures are free of obligation. By clicking on the "pay order” button, the order is sent to BOMAG and concludes a binding purchase contract. We immediately confirm receipt of your order electronically and store the order in your customer account. We also record and store the date and time your order is received.
We inform you electronically with regard to the acceptance or rejection of the order.You have the option to track the dispatch status and progress of your items via your customer account.
For commercial and tax regulation related reasons, we are obliged to store your address, payment, and order data for a period of 10 years. After the regular limitation period following the conclusion of the sales contract expires, your data will be restricted for further processing and only used to defend against any legal claims that may arise, and for compliance with legal obligations. This does not apply to data collected in accordance with C 3 (postal advertising) and data stored in the customer account. You may delete this in the customer area; see the following information on the customer account in C 6.
If we do not accept your order, the data is deleted within 3 months.
3.5.3 Purpose and legal basis of data processing
The purpose of storing the dispatch time is to verify your order and, if necessary, to clarify any possible misuse of your personal data. The legal basis for the processing of this data is Article 6(1)(f) of GDPR. Personal data is processed during the verification and execution of the order for the following reasons:
3.5.4 Disclosure; recipient
We use our own web server and IT system to process your order. We notify our shipping provider / forwarding company of the specified delivery address for the purpose of delivering the order. No personal data is otherwise disclosed to a third party.
3.5.5 Right of objection and deletion
You may object to the storage of the time of order dispatch at any time; see section D.
3.6.1 Description of data processing and storage
With a customer account, it is possible to store the data of your company / legal entity for future orders via our Webshop, enabling them to be handled quickly. The data provided when requesting registration, new delivery addresses and all orders, the last login time and the BOMAG machines you select are all stored in this account.
This data is deleted if more than 2 years elapse since the last login. In all other respects, the data can be removed by deleting the customer account. Logging into the customer account is required for this. Deleting the account does not delete the data stored in our application system for concluded purchase contracts. In this respect, C 5 shall apply.
3.6.2 Purpose and legal basis of data processing
Creating and saving a customer account allows orders to be placed quickly and simply, as the ordering party’s data does not need to be re-entered. This also enables BOMAG to ensure effectively that the order originates from a company or legal entity under public law, as we only operate a B2B shop. The legal basis for the processing of this data is Article 6(1)(f) of GDPR.
3.6.3 Disclosure/recipient of the data
The data is not passed onto third parties. We use our own web server and IT system to store customer accounts and related processing.
3.6.4 Right of objection and deletion
You may object to the storage and processing of the data in your customer account at any time and/or request its deletion or delete it yourself by logging into the customer account. Subsequent orders of spare parts via our Webshop will then no longer be possible.
3.7.1 Anonymous data collection
When you visit our websites, our web server records the domain name or IP address of the computer accessing the site as well as the access date, file query of the client (file name and URL), the HTTP answer code, and the website from which you are visiting us as well as the number of bytes transferred during the connection. We save information in the form of cookies so that we can optimise our website according to your preferences.
We use "session oriented" cookies: They do not remain on your computer. When you leave our sites, the temporary cookie is deleted. The information collected enables us to analyse usage patterns and the structure of our website. As a result, we can continuously optimise our website by improving contents or personalisation as well as simplify its usage.
Most browsers accept cookies by default. The security settings allow you to individually allow or block temporary and permanent cookies. If you disable cookies, certain features on our site may not be available, and some websites may not display correctly.
Temporary cookies must be enabled to use our shopping basket! If you cannot or are unwilling to accept cookies, you may also place your order by phone or fax.
The data saved in our cookies is not linked to your personal details (name, address, etc.) without your express consent.
3.7.2 Usage of third party software
Google Tag Manager
Google Tag Manager is a solution that enables us to manage “website tags” via an interface and thus integrate Google Analytics and other Google marketing services into our website. The Tag Manager itself, which implements the tags, does not process any of the users’ personal data. With regard to the processing of users’ personal data, please refer to the following information on Google services. Usage guidelines: https://www.google.com/intl/de/tagmanager/use-policy.html.
Embedded YouTube videos
We embed YouTube videos on some of our pages. The operator of the relevant plug-in is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit a page containing the YouTube plug-in, a connection with YouTube servers will be established. This notifies YouTube which pages you are visiting. If you are logged into your YouTube account, YouTube will be able to match your surfing behaviour to you personally. You can prevent this by logging out of your YouTube account beforehand. When a YouTube video starts, the provider deploys cookies to collect indications of user behaviour. If you have deactivated cookies for the Google Ad Programme, no such cookies will be created when you watch YouTube videos. However, YouTube also stores non-personal user information in other cookies. If you wish to prevent this, you will need to deactivate the storage of cookies in your browser.
3.7.3 Description of data processing, purpose, recipient, and disclosure
We use the following cookies:
A list of all the cookies used by the tracking tool “eTracker” can be found here.
More information on the subject of tracking can be found in section 8.
Cookies are text files that are stored in or by the internet browser on your computer system when you visit our website. The cookie contains a characteristic string of characters that enables a unique identification of the browser when the website is revisited or after a page change (call up of different sub-pages).
The user data collected by cookies is not used to create user profiles. No information from the cookies is passed onto third parties.
3.7.4 Legal basis of data processing
The legal basis for processing personal data using the above mentioned cookies is Article 6(1)(f) of GDPR, supplemented by Article 6(1)(b) of GDPR, insofar as an order is placed via our Webshop.
3.7.5 Duration of storage, right of objection and deletion
Data for marketing and optimisation purposes is collected and saved on this website using technologies from etracker GmbH (www.etracker.com). This data can be used to create user profiles under a pseudonym.
The provider of this website uses services from etracker GmbH from Hamburg, Germany www.etracker.com to analyse usage data. When visitors provide their explicit consent, cookies are used, which enable a statistical analysis of the use of this website by visitors as well as the display of use-related content or advertising. Cookies are small text files that are stored on the user’s terminal device by the internet browser. etracker cookies contain no information that enables user identification.
Data generated by etracker is processed and saved by etracker exclusively in Germany on behalf of this website´s provider; consequently, this data is subject to strict German and European data protection laws and standards. In this respect, etracker has been checked independently, certified and awarded the data protection seal of quality ePrivacyseal.
Data processing is conducted on the legal basis of Article 6(1)(a) (consent) of the EU General Data Protection Regulation (GDPR) to optimise our online offer and website. Since our visitors´ privacy is particularly important to us, the IP address is anonymised at etracker as soon as possible, and login or device IDs are also converted by etracker into a unique key that is not assigned to a person. etracker neither uses the data, collates it with other data, nor discloses it to any third parties.
The data collected with etracker technology is not used to identify a visitor of the website or aggregated with personal data without the visitors´ explicit consent. The collection and storage of data may be refused by at any time, at which point no further data is collected.
Your consent may be revoked at any time. This has no adverse consequences for you.
Further information on data protection at etracker can be found here.
3.8.2 Google Analytics
Subject to your consent, this website will use Google Analytics, a web analysis service of Google LLC. The authorised service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Scope of processing
We use the ‘anonymise IP’ function (known as IP masking): due to activation of IP anonymisation on this website, your IP address will be truncated by Google within the Member States of the European Union or other state signatories to the Agreement on the European Economic Area. The full IP address will only be transmitted to a Google server in the USA and truncated in exceptional cases. The IP address transmitted by your browser in the course of Google Analytics will not be collated with other Google data.
During your visit to the website, the following data, for instance, will be collected:
Purpose of processing
On behalf of this website operator, Google will use this information to analyse your pseudonym use of the website and to compile reports on website activities. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.
The data recipient is
in its role as processor. Accordingly, we have concluded a data processing agreement with Google. Google LLC with its headquarters in California, USA, and, if necessary, US-American authorities may access the data stored by Google.
Transfer to third countries
A transfer of data to the USA cannot be ruled out.
The legal basis and possibility of revoking this data processing is your consent; refer to Art. 6(1)(1)(a) GDPR. You may revoke your consent with effect for the future at any time by calling up cookie settings and changing your selected preferences.
Some links on our site refer to websites hosted by third parties. Unless readily apparent, BOMAG indicates that such links are external. BOMAG has no influence on the contents or design of websites offered by external suppliers. For this reason, the data protection declaration does not apply in such cases.
As the data subject, you have a right to free information about the data stored by us about your person and, if applicable, a right to correction, restriction of processing, deletion, information of third parties, data transferability, objection, revocation of a data protection consent granted, non-execution of automatic decisions and/or complaint to the responsible data protection supervisory authority. You can find more details on this in the following information.
If you have any questions regarding data processing or the exercise of your rights, you can contact us, the controller, or our Data Protection Officer; see the contact information under A. and B. of this text.
If we process your personal data, you have the right to request information from us, the controller, free of charge as to whether we process your personal data. If this is the case, you, the data subject, have a right to obtain information about this personal data and the following information:
You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate guarantees pursuant to Article 46 of GDPR, in connection with the transmission.
You have the right to correct and/or complete any personal data processed concerning you that is incorrect or incomplete.
You may request that the processing of personal data concerning you be restricted if one of the following conditions is met:
If the processing of personal data concerning you has been restricted, such data may only be processed, apart from being stored, with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or a Member State.
If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by us, the controller, before the restriction is lifted.
4.4.1 Obligation to delete
You may request that the personal data concerning you be deleted immediately by us, the controller; in this capacity, we will be obliged to delete such data immediately if one of the following reasons applies:
The personal data concerning you is no longer necessary for the purposes for which they were collected or otherwise processed.
4.4.2 Information to a third party
If we, the controller, have made the personal data concerning you public and we are obliged to delete it pursuant to Article 17(1) of GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform those responsible for processing the personal data that you, as the data subject, have requested the deletion of all links to this personal data or of copies or replications of this personal data.
The right to deletion and informing of third parties does not apply insofar as the processing is necessary
Right to information
We shall notify all recipients to whom personal data relating to you has been disclosed of any correction, deletion or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients by us, the controller.
Right to data transferability
You have the right to receive the personal data concerning you that you have provided to us, the controller, in a structured, conventional and machine-readable format. Furthermore, you have the right to transmit this data to another person in charge without hindrance by us, the party responsible to whom the personal data was given, provided that
In exercising this right, you also have the right to request that the personal data concerning you be transferred directly by us, the controller, to another responsible party, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to transferability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on us, the controller.
Right of objection
You have the right to object at any time for reasons arising from your particular situation to the processing of personal data concerning you, which is carried out on the basis of Article 6(1)(e) or (f) of GDPR; this also applies to profiling based on these provisions. As the controller, we will cease to process the personal data concerning you, unless we can provide compelling reasons for its processing worthy of protection, which outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims. If the personal data concerning you is processed for direct advertising purposes, you have the right to object at any time to the processing of such data for the purpose of advertising; this also applies to profiling insofar as it is associated with such direct advertising. If you object to processing for direct advertising purposes, personal data concerning you will cease to be processed for these purposes. You may exercise your right of objection in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.
Right to revoke the data protection declaration of consent
You have the right to revoke your data protection declaration of consent at any time. This does not affect the legality of the processing carried out on the basis of consent until revocation.
Automatic decision in individual cases, including profiling.
You have the right not to be subject to a decision based exclusively on automatic processing, including profiling, which legally affects you or significantly affects you in a similar manner.
This does not apply if the decision is
However, these decisions may not be based on special categories of personal data pursuant to Article 9(1) of GDPR, unless Article 9(2)(a) or (g) shall apply and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.
If a case under a) or c) exists, we, the controller, shall take appropriate measures to safeguard your rights, freedoms, and legitimate interests, including at least the right to obtain the intervention of a person on our behalf as the controller, to state our own position and challenge the decision.
Right of appeal to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right of appeal to a supervisory authority, in particular, in the Member State where you are staying, working or where infringement is suspected, if you are of the opinion that the processing of personal data concerning you breaches the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under GDPR, art. 78.
Dated May 2018