Privacy Policy

You may have the option of subscribing to DIFOX's e-mail newsletter via a double opt-in process. This means that after your registration, we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your subscription, your information will be blocked and subsequently deleted. In addition, we process your respective IP addresses used and times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

Subscription includes consent to receive the regular newsletter, which may contain current information about DIFOX's Internet offerings and information about special product offers, as well as advertising for other DIFOX services and benefits. After you register, DIFOX will therefore use your email address for its own advertising purposes.

You may unsubscribe at any time via the function provided for this purpose in the newsletter, by sending an e-mail to dataprotection@difox.com or - if offered - the corresponding option in the settings of your user account. Your email address will be saved in order to facilitate delivery of our newsletter. The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. a) GDPR.

4.2.2 Newsletter dispatch in existing customer relationship

If you have already purchased goods or services from us, DIFOX will also use your email address and the first and last name of the contact person on file for personalisation purposes in order to send you our newsletter for direct advertising of similar goods or services, if you have not objected to this use of the aforementioned data. You can of course object to the sending of our newsletter at any time with effect for the future by clicking on "unsubscribe" at the end of the newsletter or by contacting our data protection officer at dataprotection@difox.com. You do not incur any costs other than the transmission costs according to the basic tariffs for this.

The legal basis for this data processing is Art. 6 para. 1 S. 1 lit. f) GDPR. Our legitimate interest rests in being able to inform you about our latest offers for our products by means of direct advertising.

4.3 Processing of personal data in the context of payment

4.3.1 Prepayment, invoice

If you are given the option of “Payment in advance (bank transfer)”or “Purchase on account” during your order, DIFOX alone processes the personal data which you entered during the ordering process in order to carry out the contractual relationship with you.

The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. b) GDPR.

4.3.2 Merchandise insurance contract

DIFOX has concluded a merchandise insurance contract. DIFOX is co-insured under the terms of a merchandise insurance contract. Specialist services of the insurer (credit insurance, factoring, risk assessment and collection) are drawn upon within the framework of this contract. Insofar as DIFOX makes use of the described services, personal data concerning the unfulfilled contract will be transmitted to Coface. The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. f) of GDPR. Our legitimate interest exists in the sense that we protect ourselves from payment defaults and assert our rights and would like to assert claims.

4.4 Registration as a specialist retailer (new customer form)

4.5 Drop shipment

DIFOX may also deliver goods to the end customer as a drop shipper. Drop shipping refers to a special form of business conducted in trading between a supplier and an (online) retailer. The supplier offers the retailer products which the latter then offers for sale in its online shop. As soon as a product is purchased by a customer, the retailer forwards the order to the supplier. The latter sends the goods in a neutral form directly to the end customer, meaning that the retailer does not have any contact with the goods at all. As a rule, the end customer does not notice that the actual sender is the supplier rather than the retailer. DIFOX processes the data of the end customer (name, address, telephone number, e-mail address) provided by the specialist retailer so that it can carry out the drop shipment.

The legal basis for data processing for the delivery of the product in question to the end customer is Art. 6 (1)(1)(b) and (f) GDPR. DIFOX’s legitimate interest consists in its desire to fulfil its contractual obligation to the retailer as a drop shipper and to deliver the ordered product to the end customer.

4.6 Special conditions / rebate

DIFOX may send reports to its manufacturers and suppliers to allow it to verify possible special conditions in the context of initiation of the contract or downstream bonuses (kickbacks) after the execution of a contract for a customer. These reports contain the company name and may in individual cases also feature personal data, namely the name of the entrepreneur. The legal basis for this data processing is Article 6 (1)(1)(b) GDPR. A contact person in the customer's company for whom the special conditions are being verified may also be named. The legal basis for this data processing is Article 6 (1)(1)(f) GDPR. DIFOX’s legitimate interest consists in making it possible for the manufacturer or supplier to contact the customer, if required. In addition, its legitimate interest consists in ensuring that the product manufacturer cannot verify any special conditions / rebates without necessary information. The transfer of personal data to a third country within the scope of the above purpose only takes place in very exceptional cases in accordance with Art. 49 para. 1 lit. c) GDPR in order to be able to claim the downstream bonuses.

5. Processing of personal data

5.1 Logfiles

However, when the DIFOX website is accessed, the following data is automatically logged by the web server:

• IP address of the requesting PC;

• Date and time of the request;

• Access method/function requested by the requesting PC;

• Entry values (e.g. file name) requested by the requesting PC;

• Web server access status (file transferred, file not found, command not executed etc.);

• Name of the requested file and

• URL from which the file was requested/the desired function was released.

This information is used exclusively for the purpose of identifying and tracing unauthorised accesses to the web server and other criminal acts. The legal basis for data processing is Art. 6 para. 1 p. 1 lit. f) GDPR. Our legitimate interests are the assurance of IT security as well as the assurance of the operation of our Internet presence.

5.2 Cookies

When using our website, so-called cookies, which can be stored on your end device, are used as technical functional aids for various functions. A cookie is a text information that can be stored in the web browser of your end device for each visited website. The cookie is either sent to the web browser by the web server or generated in the web browser by a script as a sequence of repetitive program instructions.

Below is an overview of the cookies and other technologies we use when you use the website.

5.3 Google Analytics

5.4 YouTube video embedding

5.5 Newsletter tracking

DIFOX uses Emarsys Marketing Suite to track the recipient behaviour of our newsletter. Recipient reactions (opening a mail, clicking on text and image links, downloading images with an e-mail program) are recorded and stored anonymously for statistical purposes. It is not possible to identify individual users from the data used. The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. f) of GDPR in combination with § 25 Abs. 2 Nr. 2 TDDDG. The legitimate interest of DIFOX is the provision of better and accurate information for recipients of the newsletter. The recipient of the data is our service provider, Emarsys Interactive Services GmbH.

5.6 Contact

You will find an e-mail address for contact on DIFOX’s website. The data provided in the context of that e-mail correspondence with us will be stored for the purpose of individual communication with you, and the data processing is justified, in accordance with Art. 6 para. 1 p. 1 lit. f) GDPR, by our desire to offer you a simple contact option. Your data will also be stored for the purpose of answering your request, as well as for possible follow-up questions.

If you contact us in order to request a quote, the legal basis for data processing is Art. 6 para. 1 p. 1 lit. b) GDPR.

5.7 Google reCAPCHTA

5.8 Data Exchange Portal

For internal and external file transfers DIFOX uses its own web client solution. Within the scope of the use of the web client, DIFOX processes the IP address of the user for up to seven days. The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. c) GDPR in conjunction with § 12 TDDDG as well as Art. 6 para. 1 p. 1 lit. f) GDPR. The legitimate interest of DIFOX is in particular to protect against misuse of the web client and to ensure network and information security.

6. Social media appearances

6.1 Facebook Fanpage

DIFOX operates a so-called fan page on Facebook. These are websites that are offered on the Facebook platform to present DIFOX as a company and to get in touch with customers and interested parties, for example. Facebook is part of Meta.

6.1.1 Shared responsibility with Meta

6.1.2 Sole responsibility of DIFOX

DIFOX also processes the data from your use of the fan page that you voluntarily provide (in a comment, for example) for the purpose of answering your inquiries, communicating with you and publishing information regarding the content offered on the fan page or from DIFOX. The legal basis for processing are Art. 6 para. 1 p. 1 lit. b) .and f) GDPR. The legitimate interest lies in the effective information of users, customers and interested parties and communication with these persons.

You are welcome to contact us as long as it regards the data processed by us on our own account, and assert the rights to which you are entitled as our data subject. However, if these refer to processing that is purely in the area of responsibility of Facebook, we point out in advance that our options with regards exercising your rights are limited to referring you to the appropriate places of Facebook.

6.1.3. Sole responsibility of Meta

Meta remains solely responsible for the processing of personal data of this kind in connection with visits to fan pages that do not fall within the scope of joint responsibility.

If you are currently logged in to Facebook as a user, there is a cookie with your Facebook identifier on your terminal device. This enables Meta to track that you have visited our fan page and how you have used it. This also applies to all other Facebook pages. If you want to avoid this, you should log out of Facebook or disable the "stay logged in" feature, delete the cookies present on your device, and exit and restart your browser.

6.2 Instagram Profile

Meta Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland ("Meta") uses the technical platform and the services of Meta Ireland Ltd. for the information service offered here. Instagram is a part of Meta.

We would like to point out that you use this Instagram profile and its functions under your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also find the information offered via this page on our Internet offer at https://www.difox.com retrieve. Meta collects your IP address and other information that is stored on your PC in the form of cookies when you visit our Instagram profile.

6.2.1 Joint responsibility with Meta

6.2.2 Sole responsibility of DIFOX

Furthermore, DIFOX is also solely responsible for certain data processing. We process the following data for communication with LinkedIn users to offer our information service:

• User interactions (postings, likes, etc.),

• Profile name and data provided by the user in the course of the conversation, e.g. for processing service requests,

• Statistical surveys on target group advertising,

• Statistical data on user interactions in aggregated form, i.e. without personal reference for DIFOX (e.g. page activities, page views, page previews, likes, recommendations, posts, videos, page subscriptions incl. origin, times of day), and

• Targeted advertisements based on aggregated demographic data that is not personally identifiable (e.g., age, location, language, or gender information).

The processing is carried out for the purpose of answering your inquiries (if you have sent us an inquiry) or communicating with you and to publish information about events, products and services of DIFOX. The legal basis of the processing for the purpose of responding to inquiries that serve a future contract conclusion and are initiated by you is Art. 6 para. 1 p. 1 lit. b) GDPR and in the other cases Art. 6 para. 1 p. 1 lit. f) GDPR.

When personal data is transferred to LinkedIn servers in the USA for storage and further processing, LinkedIn is certified under the EU Commission's adequacy decision for data transfers to the USA, the Data Privacy Framework, which allows corresponding data transfers in accordance with this adequacy decision.

The legitimate interest consists in the effective delivery of information to users, customers and interested parties and the communication with these individuals as well as the external presentation of DIFOX.

You can find the current version of this privacy policy on the "About Us" page under the "Privacy Policy" section of our LinkedIn page.

After your request has been completed, the personal data you have provided will be deleted from our systems. Should you interact with us publicly, for example by leaving a comment or "liking" a post, this data will remain publicly accessible on the site until deleted by us or you. Insofar as legal storage obligations require longer storage, your data will only be stored for this purpose and will be blocked for other purposes.

To exercise your right to object to us, please contact us either at dataprotection@difox.com or at the above address by mail or telephone. We will then process your request immediately.

The provision of your data is voluntary. However, it is not possible to visit our profile without us processing personal data jointly with LinkedIn or DIFOX and LinkedIn processing personal data in their own, separate responsibility.

6.2.3. Sole responsibility of Meta

Meta remains solely responsible for the processing of such personal data in connection with visits to Instagram pages that do not fall under shared responsibility.

If you are currently logged in to Instagram as a user, there is a cookie with your Instagram identifier on your terminal device. This enables Meta to track the fact that you have visited our page and how you have used it. This also applies to all other Instagram pages. If you want to avoid this, you should log out of Instagram or disable the "stay logged in" feature, delete the cookies present on your device, and exit and restart your browser.

6.3 LinkedIn

DIFOX uses the technical platform and services of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter "LinkedIn") for the information service offered here. We would like to point out that you use this LinkedIn page of DIFOX and its functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating).

6.3.1 Joint responsibility with LinkedIn

6.3.2 Responsibility of DIFOX

Furthermore, DIFOX is also solely responsible for certain data processing. We process the following data for communication with LinkedIn users to offer our information service:

• User interactions (postings, likes, etc.),

• Profile name and data provided by the user in the course of the conversation, e.g. for processing service requests,

• Statistical surveys on target group advertising,

• Statistical data on user interactions in aggregated form, i.e. without personal reference for DIFOX (e.g. page activities, page views, page previews, likes, recommendations, posts, videos, page subscriptions incl. origin, times of day), and

• Targeted advertisements based on aggregated demographic data that is not personally identifiable (e.g., age, location, language, or gender information).

The processing is carried out for the purpose of answering your inquiries (if you have sent us an inquiry) or communicating with you and to publish information about events, products and services of DIFOX. The legal basis of the processing for the purpose of responding to inquiries that serve a future contract conclusion and are initiated by you is Art. 6 para. 1 p. 1 lit. b) GDPR and in the other cases Art. 6 para. 1 p. 1 lit. f) GDPR.

When personal data is transferred to LinkedIn servers in the USA for storage and further processing, LinkedIn is certified under the EU Commission's adequacy decision for data transfers to the USA, the Data Privacy Framework, which allows corresponding data transfers in accordance with this adequacy decision.

The legitimate interest consists in the effective delivery of information to users, customers and interested parties and the communication with these individuals as well as the external presentation of DIFOX.

You can find the current version of this privacy policy on the "About Us" page under the "Privacy Policy" section of our LinkedIn page.

After your request has been completed, the personal data you have provided will be deleted from our systems. Should you interact with us publicly, for example by leaving a comment or "liking" a post, this data will remain publicly accessible on the site until deleted by us or you. Insofar as legal storage obligations require longer storage, your data will only be stored for this purpose and will be blocked for other purposes.

To exercise your right to object to us, please contact us either at dataprotection@difox.com or at the above address by mail or telephone. We will then process your request immediately.

The provision of your data is voluntary. However, it is not possible to visit our profile without us processing personal data jointly with LinkedIn or DIFOX and LinkedIn processing personal data in their own, separate responsibility.

7. User's rights

7.1 Withdrawing consent, objecting

If you have given DIFOX your consent to process personal data in the context of your use of DIFOX services, you can withdraw this consent at any time pursuant to Article 7 (3) GDPR. The revocation can be sent by email to dataprotection@difox.com or in writing to the address listed below. The effects of the revocation will be limited to the storage and use of personal data that may not be used or stored without your consent based on statutory permissions. This withdrawal of consent, once declared to us, will have an impact on the permissibility of the processing of your personal data. However, please note that it may not then be possible to process the data concerned in the future.

If we base the processing of personal data on the balance of interests, you may object to the processing pursuant to Article 21 GDPR. This will be the case if the processing is not specifically required to fulfil a contract with you. If you lodge such an objection, we would ask you to tell us why we should no longer process your data in the manner in which we have previously done so. If you provide a reasoned objection, we will review the matter and either cease or adapt our data processing or present you with the compelling legitimate reasons which permit us to continue to process your data. If you have exercised your right to object, the data controller will no longer process your personal data unless it can prove that there are compelling legitimate grounds for the processing that outweigh the data subject’s interests, rights and freedoms or that the processing serves the purpose of the assertion, exercise or defence against legal claims.

You can of course object at any time to the processing of your personal data for the purposes of advertising and data analysis. You can notify us of your objection to advertising by e-mailing us at: dataprotection@difox.com or via the address given below.

7.2 Your other rights

On request, DIFOX will provide you pursuant to Article 15 GDPR with information concerning the personal data stored by DIFOX. You also have the option at any time to require DIFOX to correct your data pursuant to Article 16 GDPR, to erase it pursuant to Article 17 GDPR or to restrict the processing thereof pursuant to Article 18 GDPR. Pursuant to Article 20 GDPR, you have the right to require us to hand over to you or a third party in a common machine-readable format data that we have automatically processed on the basis of your consent or for the fulfilment of a contract. If you have requested that the data be directly transferred to another controller, this will be done only if it is technically feasible.

You also have the right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR.

The only data that will be excluded from deletion are those that DIFOX requires for processing outstanding orders or for asserting existing rights and claims, as well as data that DIFOX has to store as required by law. Such data will however be blocked.

You also have the right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR.

We will be happy to provide you with further assistance.

Address

DIFOX a branch of
Duttenhofer GmbH & Co. KG
Alfred-Nobel-Str. 6
97080 Wuerzburg
Germany

dataprotection@difox.com
+49 931 9708-466