4. individual processing operations

4.1. Provision and use of the website

a) Type and scope of data processing

When you access and use our website, we collect the personal data that your browser automatically transmits to our server. This information is temporarily stored in a so-called log file.

When you use our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:

• IP address of the requesting device
• Date and time of access
• Time zone difference to Greenwich Mean Time (GMT)
• Website accessed or requested
• Status of access (http status code)
• Size of the data volume transferred in each case
• Website from which your access is made (so-called referrer URL)
• Browser used, end device used and, if applicable, the operating system and the name of your access provider
• Language and versioning of the browser software
  
  

In addition, we use both technically necessary and voluntary cookies on our website, which may be used when using our web pages. Further information on this can be found under point 9 (“Use of cookies”) and in our cookie banner.

We use a service provider to host our website. For this purpose, we have concluded a processor contract (Art. 28 GDPR) with this service provider.

b) Legal basis

Art. 6 para. 1 lit. f GDPR serves as the legal basis for the aforementioned data processing. The processing of the aforementioned data is absolutely necessary for the provision of a website and thus serves to safeguard a legitimate interest of our company.

c) Storage period

As soon as the aforementioned data is no longer required to display the website, it is deleted. The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Further storage may take place in individual cases if this is required by law.

4.2. Contact us

a) Type and scope of data processing

You can contact us by e-mail, telephone or form to clarify your concerns. The processing takes place exclusively for the processing of your request, for communication with you and – if necessary – for the preparation or implementation of pre-contractual measures. When you contact us, the following personal data will be processed:

• E-Mail: Name, e-mail address, content contained in the message
• Telephone: Telephone number, content transmitted during the call
• Purchase contact form: title, first name, surname, telephone number, e-mail address, content of your message
• Press contact form: First name, last name, telephone number, e-mail address, company, content of your message
• Contact form for trainees: first name, surname, accompanying person (first name/surname), school, class, training area, e-mail address

The purpose of providing this data is to assign and process your request and to be able to respond to you.

b) Legal basis

• Processing of the request: Art. 6 para. 1 lit. f GDPR (legitimate interest)
• Contractual purposes (e.g. conclusion of a contract via telephone or e-mail): Art. 6 para. 1 lit. b GDPR

As a rule, there is a legitimate interest in answering your inquiries quickly and easily, which is in line with your interest in fast communication.

c) Storage period

As soon as the request you have made has been dealt with and the matter in question has been finally clarified, the personal data processed via the e-mail will be deleted. Further storage may take place in individual cases if and to the extent that there is a legitimate interest (Art. 6 para. 1 lit. f GDPR).

4.3. Chatbot / online support

a) Type and scope of data processing

We use a chatbot from Chatbase on our website to offer you a better service. Chatbots are computer-based programs that can communicate with people in real time. They can answer questions, provide information and perform tasks. When you use our chatbot, we process the data you enter to process your requests and provide you with automated or manual support.

The following personal data may be processed:

• IP address
• Browser type
• Browser version
• Operating system of your device
• Website from which you came to our website
• Content of your chat messages

This data is processed and stored by chatbase.co in the USA. You can find Chatbase’s privacy policy here: https://www.chatbase.co/privacy

b) Legal basis

The processing of your data is based on Art. 6 para. 1 lit. a GDPR. You can withdraw your consent to the processing and transfer of your personal data at any time with effect for the future, e.g. by closing or deactivating the chatbot. Further information on data protection and your rights can be found in our privacy policy.

c) Storage

The personal data you enter in the chatbot will be stored in the backend of the chatbot system for as long as is necessary to process your inquiries. Once your request has been processed, the data is regularly deleted, provided there are no statutory retention obligations or longer storage is required for legal prosecution. The chat histories are also stored locally on your computer via your browser until you delete them.

4.4. Contacting whistleblowing

a) Type and scope of data processing

If you provide us with information about possible violations, grievances or other relevant information, we will process the data you provide exclusively for the purpose of processing your information and communicating with you if there are any queries.

The following personal data may be processed:

• First name
• Surname
• Contact details (e-mail address, telephone number) if you wish to receive feedback
• Content of your note / message
• Company affiliation or other information that you provide voluntarily
  
  

Processing is carried out exclusively by internal controllers for whistleblowing and an external ombudsman (legal advisor). There is no automated whistleblowing system; the data is not processed automatically. Further information on whistleblowing at KIRCHHOFF Automotive can be found at: https://kirchhoff-automotive.com/company/compliance/

b) Legal basis

The legal basis for the processing of data in the context of whistleblowing contact is Art. 6 para. 1 lit. f GDPR, as there is a legitimate interest in the processing of reports and compliance with legal regulations. Insofar as personal data is processed to fulfill legal obligations (e.g. to comply with retention obligations), the processing is based on Art. 6 para. 1 lit. c GDPR.

c) Storage period

Your transmitted data will be stored for as long as is necessary to process your notification. After processing has been completed, the data will be deleted unless there are statutory retention obligations or longer storage is required for the defense of legal claims.