Privacy Policy

In this privacy policy, we inform you about the processing of your data when you use our website.

By "your data" we mean personal data. Personal data is information that we can use to identify you. Either directly or by combining it with other data. This includes, for example Your name, your address, your e-mail address. Your telephone number, your customer number or your order number.

Statistical data that we collect, for example, when you visit our website and that cannot be linked to you personally is not considered personal data.

You can print or save this privacy policy by using the usual functionality of your browser.

1. Responsible body

The controller within the meaning of the EU General Data Protection Regulation ("GDPR") is

Neutex Home Deco GmbH
Kulmbacher Street 82
95213 Münchberg
Telephone: 09281/49-0
E-mail: deco@neutex.com

(hereinafter "NEUTEX", "we" or "us")

Please contact the above-mentioned office with any questions or requests regarding the protection of your data.

2. Contact details data protection officer

Hoftex Group AG
Data Protection Officer
Fabrikzeile 21
95028 Hof
Telephone: 09281/49-0
E-mail: datenschutzbeauftragter@hoftexgroup.com

3. Data processing for contract processing and when contacting us

Your order or purchase data

When you place an order with us, our applications, in our partners' online shops (e.g. via Amazon) or by telephone, we collect your order or purchase data.

Order or purchase data includes, for example

• Your details about purchased items, such as name, size, colour, purchase price, etc.
• Your payment method details
• Your delivery and billing address
• Your cancellation notices, complaints and other communications relating to your orders or purchases
• Your order number
• Your order status, e.g. "Dispatched" or "Returned"
• Your payment status

We process your data so that we can process your order, so that we can send you your order and so that we can process any returns, complaints and warranty claims.

The legal basis for the aforementioned data processing is Art. 6 Para. 1 b) GDPR.

Your contact details and messages

You have the option of contacting us. In this context, we process your telephone number, your mobile phone number and/or your e-mail address exclusively for communication with you, e.g. so that we can contact you in the event of queries regarding your enquiry. The provision of this information is voluntary. However, if you do not provide your data, we will not be able to contact you if we have any questions.

The legal basis for the aforementioned data processing is Art. 6 para. 1 b) GDPR.

4. Visit to this website

Each time you use our website, we collect the data that your browser automatically transmits to enable you to visit the website. These are in particular

• IP address of the requesting end device
• Date and time of the enquiry
• Address of the website accessed and the requesting website
• Information about the browser used and the operating system of the end device

Data processing is necessary to enable you to visit the website and to ensure the long-term functionality and security of our systems. The aforementioned data is also temporarily stored in internal log files for the purposes described above in order to compile statistical data on the use of our website, to further develop our website with regard to the usage habits of our visitors (e.g. if the proportion of mobile devices used to access the pages increases) and to maintain our website for general administrative purposes.

The legal basis for the aforementioned data processing is Art. 6 para. 1 b) GDPR.

5. Information on the use of cookies and similar technologies

We use cookies in order to implement certain technically necessary functions of our website, to be able to track the use of our offers and to continuously optimise the websites and to be able to provide content adapted to your wishes. Cookies are small text files that are stored on your hard drive by a website. Cookies do not damage your computer, they cannot execute programmes and cannot contain viruses. Instead of cookies, so-called tracking pixels or comparable common technologies can also be used, which serve to (temporarily) store information on specific users or usage processes (collectively referred to below as "cookies"). You can prevent the storage of cookies on your computer at any time via the settings of your browser, please use the settings or the help function of your browser. The function of our website may then be restricted. We use cookies for various purposes. The individual cookies are listed below.

Technically necessary cookies

These cookies are essentially used to enable you to use the functions of the website, e.g. to store form data (e.g. as part of the contact form) or to control the display of information (e.g. the cookie banner). The legal basis for the data processing carried out in connection with the technically required cookies is Art. 6 para. 1 f) GDPR, based on our legitimate interest in enabling you to use our website conveniently and individually and to make its use as time-saving as possible. In certain cases, these cookies may also be necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, in which case the processing is carried out in accordance with Art. 6 para. 1 sentence 1 b) GDPR. It is not possible to deactivate these technically necessary cookies.

Analysis cookies

We also use cookies for website analysis, advertising and marketing purposes to enable personalised advertisements and to show you advertising content on external websites (e.g. Google or You Tube) for our products and offers that you have shown an interest in on our website or that match content that we believe will be of interest to you. General information about possible interests of users of our website and other interested parties collected by third parties on other websites is also used as part of the personalised advertising of our content (so-called re-targeting). The information is stored in cookie identifiers. You are not identified as a person, but are recognised solely on the basis of the end devices you use. If the cookies are deleted, the personalisation of advertising content will also cease. We only use these cookies if you consent to their use. The legal basis for the data processing carried out in connection with the marketing cookies is your consent (Art. 6 para. 1 a) GDPR).

In the event that personal data is transferred to the USA, we will obtain your express consent for this data transfer via the cookie banner in accordance with Art. 49 para. 1 sentence a) GDPR. The associated risks can be found below under "Data transfer to third countries". You can revoke your consent by accessing the cookie settings and changing the corresponding selection there.

You can also access the cookie settings from every page of this website via the footer.

We would like to point out that some pages of our website may also contain cookies that are not directly related to Neutex. If you visit a page with content embedded by third-party providers, these third-party providers may have set their own cookies. Neutex has no influence on the use of these cookies and cannot access them due to the way cookies work, as access to cookies is only possible for the person who originally set them.

Use of Google Analytics

Our website uses functions of the web analysis service Google Analytics. The provider of the web analysis service is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses "cookies." These are small text files that your web browser stores on your end device and enable website usage to be analysed. Information generated by cookies about your use of our website is transmitted to a Google server and stored there. The server location is usually the USA.

Google Analytics cookies are set on the basis of Art. 6 para. 1 lit. f GDPR. As the operator of this website, we have a legitimate interest in optimising our website in order to optimise our web offering and, where applicable, advertising.

IP anonymisation

We use Google Analytics in conjunction with the IP anonymisation function. It ensures that Google truncates your IP address within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before transmitting it to the USA. There may be exceptional cases in which Google transmits the full IP address to a server in the USA and truncates it there. Google will use this information on our behalf to analyse your use of the website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The IP address transmitted by Google Analytics will not be merged with other Google data.

Browser plugin

The setting of cookies by your web browser can be prevented. However, this may restrict some functions of our website. You can also prevent the collection of data relating to your website use, including your IP address and subsequent processing by Google. You can do this by downloading and installing the browser plugin available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Objection to the collection of data

You can prevent the collection of your data by Google Analytics by clicking on the following link. An opt-out cookie will be set to prevent your data from being collected on future visits to our website: Deactivate Google Analytics.

Details on how Google Analytics handles user data can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Data processing

We have concluded an data processing contract with Google in order to fully comply with the statutory data protection requirements.

Demographic characteristics with Google Analytics

Our website uses the "demographic characteristics" function of Google Analytics. It can be used to create reports that contain statements about the age, gender and interests of visitors to the site. This data comes from interest-based advertising from Google and visitor data from third-party providers. It is not possible to assign the data to a specific person. You can deactivate this function at any time. This is possible via the ad settings in your Google account or by generally prohibiting the collection of your data by Google Analytics, as explained in the section "Objection to data collection".

Google Tag Manager

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, does not store any cookies and does not carry out any independent analyses. It is only used to manage and display the tools integrated via it. However, Google Tag Manager records your IP address, which may also be transmitted to Google's parent company in the United States.

The Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the fast and uncomplicated integration and management of various tools on its website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time

6. Data processing in the context of an application

As part of an application, we process the data that we receive in the course of contacting and interviewing the applicant. This includes, for example, first and last name, address, e-mail address, telephone number, letter of application, CV (data on qualifications, professional experience and training, hobbies and leisure activities if applicable), photo if applicable, internal notes from interviews if applicable. In certain constellations, we also collect data from third parties, e.g. viewing the profile on professional social networks such as Xing and LinkedIn and if we receive the data and application documents from a personnel consultant or recruitment agency. We process all of the above-mentioned data to carry out the application process on the legal basis of Art. 6 para. 1 sentence 1 lit. b, Art. 88 GDPR, Section 26 para. 1 sentence 1 BDSG. Insofar as the data are so-called special categories of personal data, such as data on health (e.g. information on a severe disability), the processing is carried out on the legal basis of Art. 6 para. 1 sentence 1 lit. b, Art. 9 GDPR, Art. 88 GDPR, § 26 para. 3 sentence 1 BDSG. If you consent that we may also consider the application and the associated data for other positions, we process the data on the legal basis of Art. 6 Para. 1 S. 1 lit. a, Art. 88 GDPR, § 26 Para. 1 S. 1 BDSG.

If our offer of employment is accepted, we will store the data for the duration of the employment relationship. We generally store the data for as long as it is required for the application relationship. In the case of an application for a specific position and a rejection from us, the data will be deleted six months after rejection, unless storage is required for legal reasons or statutory obligations. If you consent to the application and the associated data also being considered for other positions, the data will be stored for a period of three months.

7. Data processing as part of a report via our ombudsman's office or as part of the whistleblower system

We use the information you provide in the context of the whistleblower system or the ombudsman's office for purposes such as reviewing and documenting the reports, for internal investigations, for forwarding to external lawyers, auditors or other professionals bound by professional secrecy and, if necessary, for forwarding to state authorities (such as the police, public prosecutor's office or courts). We ensure that all whistleblowers are treated confidentially.

We will only process your personal data if you provide it to us voluntarily. The data of a reported person will be processed in accordance with the provisions of the HinSchG in order to investigate and document the report.

The legal basis for the processing of your personal data by the internal reporting office is Art. 6 para. 1 lit. c (fulfilment of a legal obligation) in conjunction with § 10 HinSchG or § 8 LkSG for information within the framework of the Supply Chain Act.

The legal basis for the operation of the reporting system is Art. 6 para. 1 lit. f GDPR (legitimate interest of the controller); our legitimate interest is to set up suitable reporting channels in order to fulfil the legal requirements and to be able to investigate violations within the company. If you disclose your identity when submitting a report, the legal basis for the processing of your data is your consent in accordance with Art. 6 lit. a GDPR.

8. Recipient of the data

The data collected by us will only be passed on if

• you have given your express consent in accordance with Art. 6 para. 1 a) GDPR,
• the disclosure pursuant to Art. 6 para. 1 f) GDPR is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data
• we are legally obliged to disclose your data in accordance with Art. 6 para. 1 c) GDPR or
• this is legally permissible and required under Art. 6 (1) (b) GDPR for the fulfilment of contractual relationships with you or for the implementation of pre-contractual measures taken at your request.

Part of the data processing may be carried out by our service providers. In addition to the service providers mentioned in this privacy policy, these may include, in particular, data centres that store our website and databases, IT service providers that maintain our systems, consulting companies, suppliers, freight forwarders and postal service providers. If we pass on data to service providers, they may only use the data to fulfil their tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound by our instructions, have suitable technical and organisational measures in place to protect the rights of the data subjects and are regularly monitored by us.

Many systems and technologies are shared within our group of companies, the Hoftex Group. This enables us to implement our processes efficiently and in a legally compliant manner within the Group. Therefore, within the Hoftex Group, those companies and departments have access to your data that need it to fulfil our contractual and legal obligations or to fulfil their respective functions within the Hoftex Group.

We transmit your data in encrypted form within the Group to Hoftex Group AG

• for the purposes of tax documentation and information obligations within the framework of the VAT group to Hoftex Group AG on the basis of legitimate interest pursuant to Art. 6 para. 1 f) GDPR.
• for the purposes of the Group-wide HR department on the basis of legitimate interest pursuant to Art. 6 para. 1 f) GDPR.
• for the purpose of conducting internal investigations based on information based on our legitimate interest pursuant to Art. 6 para. 1 f) GDPR.

We have concluded an data processing contract with Hoftex Group AG in order to fully fulfil the statutory data protection requirements.

In addition, data may be passed on in connection with official enquiries, court orders and legal proceedings if this is necessary for legal prosecution or enforcement (legal basis for this data processing is, depending on the individual case, Art. 6 para. 1 c) or f) GDPR).

Data transfer to third countries

As explained in this privacy policy, we use services whose providers are partly located in so-called third countries (such as the USA), i.e. countries whose level of data protection does not correspond to that of the European Union. If this is the case and the European Commission has not issued an adequacy decision for these countries (Art. 45 GDPR), we have taken appropriate precautions to ensure an adequate level of data protection for any data transfers. These include the standard contractual clauses of the European Union or binding internal data protection regulations.

Where this is not possible, we base the transfer of data on exceptions under Art. 49 GDPR, in particular your express consent (Art. 49 para. 1 a) GDPR) or the necessity of the transfer for the fulfilment of the contract or for the implementation of pre-contractual measures (Art. 49 para. 1 b) GDPR).

If a transfer to a third country is planned and there is no adequacy decision or suitable guarantees, it is possible and there is a risk that authorities in the respective third country (e.g. secret services) may gain access to the transferred data in order to collect and analyse it, and that the enforceability of your rights as a data subject cannot be guaranteed. When obtaining your consent via the cookie banner, you will also be informed of this.

9. Storage period

In principle, we only store personal data for as long as it is necessary to fulfil the purposes for which we collected the data. We then delete the data immediately, unless we still need the data until the statutory limitation period expires for evidence purposes for civil law claims or due to statutory retention obligations.

For evidence purposes, we must retain contractual data for three years from the end of the year in which the business relationship with you ends. Any claims expire at the earliest at this time in accordance with the statutory limitation period.

Even after this time, we must still store some of your data for accounting reasons. We are obliged to do so due to statutory documentation obligations that may arise from the German Commercial Code, the German Fiscal Code, the German Banking Act, the German Money Laundering Act and the German Securities Trading Act. The periods specified there for the retention of documents are two to ten years.

10. Your rights

You have the following statutory data protection rights under the respective legal requirements:

• Right to information (Article 15 GDPR, Section 34 BDSG)
• Right to erasure (Article 17 GDPR, Section 35 BDSG)
• Right to rectification (Article 16 GDPR, Section 34 BDSG)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)

To assert your rights described here, you can contact us at any time using the contact details above.

You also have the right to lodge a complaint with the data protection supervisory authority responsible for us. In Münchberg, where we are based, the competent supervisory authority is Bayerisches Landesamt für Datenschutzaufsicht, Postfach 606, 91511 Ansbach. Alternatively, you can contact the data protection authority in your place of residence, which will then forward your request to the competent authority.

Right of cancellation and objection

In accordance with Art. 7 para. 2 GDPR, you have the right to withdraw your consent at any time. As a result, we will no longer continue the data processing that was based on this consent in the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If we process your data on the basis of legitimate interests in accordance with Art. 6 (1) f) GDPR, you have the right to object to the processing of your data in accordance with Art. 21 GDPR and to give us reasons that arise from your particular situation and which, in your opinion, outweigh your interests worthy of protection. If you wish to object to data processing for direct marketing purposes, you have a general right of objection, which we will implement without you having to give reasons.

If you wish to exercise your right of cancellation or objection, simply send an informal message to the contact details given above.

Data security

To protect the security of your information during transmission, we use the TLS (Transport Layer Security) encryption protocol, also better known by its predecessor SSL (Secure Sockets Layer). This applies, among other things, to your orders or our contact form. We do not support older versions of the SSL protocol, which is why SSL connections with some older browsers are not accepted by our servers. We therefore recommend that you use a current browser version.