We are pleased that you are visiting our website and are delighted by your interest in our company and our products. The protection of your personal data is very important for us. Etrusco GmbH (hereafter "Etrusco", "we" or "us") attaches great importance to the security of users’ data and compliance with data protection legislation.
Etrusco websites may contain links to the websites of other providers, to which this privacy statement does not apply. We have no knowledge of what data may potentially be collected by the operators of these sites and we have no influence over such processes either. You can obtain more information from the data protection notice of the respective website.
Below we provide more detail about how your data is handled by us.
Data Controller and Data Protection Officer
Data Controller:
Etrusco GmbH
Ölmühlestraße 6
88299 Leutkirch
Tel: +49 7524 99-450
E-Mail: info@etrusco.com
Contact details of external Data Protection Officer:
DDSK GmbH
Stefan Fischerkeller
Tel.: +49 7542 949 21 00
E-Mail: datenschutz@etrusco.com
Terms
The terms used in this privacy notice should be understood as having the meanings defined in Art. 4 GDPR.
Notes on Data Processing
Anonymous Data Collection
You can visit our site without actively providing any details about yourself personally. However, we will automatically store access data each time the website is called up (server log files) such as the name of your Internet service-provider, the operating system used, the particular website you visit us from, the date and the duration of the visit or the name of the file requested, as well as for security reasons, e.g. to identify attacks on our websites, the IP address of the computer used; and all this for a period of 14 days. This data is evaluated only to improve our offering and does not permit any conclusions to be drawn about you personally. This data will be not aggregated with other data sources.
Legal Basis:
Legitimate interest, Art. 6 para. 1 lit. f) GDPR)
Legitimate interests:
Ensuring the functionality, error-free and secure operation of the website and adapting this website to the requirements of users
Use of Cookies (General, Functionality, Opt-Out Links, etc.)
We use so-called cookies on our websites in order to make your visit to our website attractive and to enable the use of certain functions. This concerns a standard internet technology for the storage and to call login and other use-related information for all users of the Etrusco-websites. Cookies are small text files, which are placed on your terminal device. Among other things, they enable us to store user settings, so that our websites can be displayed in a format that is customised for your device. Several of the cookies used by us are deleted again after the end of the browser session, therefore after your browser is closed (so-called session cookies). Other cookies remain on your terminal device and enable us or our partner companies to recognise your browser the next time you visit the website (so-called permanent cookies).
You can set your browser so that you are informed about the setting of cookies and can make individual decisions about their acceptance or exclude the acceptance of cookies for certain cases or generally. The cookies can furthermore be deleted subsequently in order to remove data that websites have lodged on your computer. You can find an instruction for this purpose quickly on the Internet. The deactivation of the cookies can lead to several restrictions to the functionality of the Etrusco-websites.
Categories of Data Subjects:
Website visitors, users of online services
Opt-Out:
Internet Explorer:
https://support.microsoft.com/de-de/help/17442
Firefox:
https://support.mozilla.org/de/kb/wie-verhindere-ich-dass-websites-mich-verfolgen
Google Chrome:
https://support.google.com/chrome/answer/95647?hl=de
Safari
https://support.apple.com/de-de/HT201265
Legal Basis:
Consent (Art. 6 para. 1 lit. a) GDPR); fulfilment or initiation of a contract (Art. 6 para. 1 lit. b) GDPR)
The relevant legal basis in each case is specifically named with the corresponding tool.
Legitimate interests:
Storage of opt-in preferences, presentation of the website, ensuring the functionality of the website, preservation of user status across the entire website, recognition for next website visitors, user-friendly online offering, ensuring chat function
Web Analysis and Optimisation
To enable us to evaluate visitor flows in relation to our online offering, we use tools for web analysis and reach measurement. To this end, we collect information about the behaviour, interests and demographic information of our visitors, such as age, gender or similar. This helps us to recognise at what time our online offering, its functions or content are most frequented and it also helps us to know how to invite repeated visits. In addition, the information we collect enables us to determine whether our online offering needs any optimisation or adjustment.
The information collected for this purpose is stored in cookies or similar processes and is used for reach measurement and optimisation. The data stored in cookies may include content viewed, online sites visited, settings and functions and systems used. As a rule, however, no clear user data is processed for the purposes described. In this case, data is changed in such a way that the actual identity of users is not known, either to us or to the provider of the tool used. The data changed in this way is often stored in user profiles.
Categories of Data Subjects:
Website visitors, users of online services
Categories of Data:
User data (e.g. websites visited, interest in content, access times), meta and communication data (e.g. device information, IP addresses), contact data (e.g. email address, telephone number), content data (e.g. text details, photographs, videos)
Purposes of Processing:
Website analysis, reach measurement, utilisation and evaluation of website interaction, lead evaluation
Legal Basis:
Consent (Art. 6 para. 1 lit. a) GDPR); fulfilment or initiation of a contract (Art. 6 para. 1 lit. b) GDPR)
Legitimate Interests:
Optimisation and further development of the website, profit increase, customer retention and acquisition
Matomo
Service used: InnoCraft Ltd, 150 Willis St., 6011 Wellington, Neuseeland
Privacy: https://matomo.org/privacy-policy/
Opt-Out link: https://matomo.org/docs/gdpr/
Legal Basis: Consent (Art. 6 para. 1 lit. f) GDPR)
Online Marketing
In order to continuously increase our reach and the awareness of our online offering, we process personal data as part of online marketing, in particular with regard to potential interests and measuring the effectiveness of our marketing actions.
For the purpose of measuring the effectiveness of our marketing actions and identifying potential interests, relevant information is stored in cookies or else similar processes are used. The data stored in cookies may include content viewed, online sites visited, settings and functions and systems used. As a rule, however, no clear user data is processed for the purposes described. In this case, the data is changed in such a way that the actual identity of users is not known, either to us or to the provider of the tool used. The data changed in this way is often stored in user profiles.
In the case of storage of user profiles, data can be read out, supplemented and added to on the server of the online marketing provider whenever other online offerings that use the same online marketing process are visted.
We can determine the success of our advertisements on the basis of aggregated data supplied to us by the provider of the online marketing process (so-called conversion measurement). Within the scope of these conversion measurements, we can track whether a marketing measure has led to a purchase decision by the visitor to our online offering. This assessment process is used to analyse the success of our online marketing.
Categories of Data Subjects:
Website visitors, users of online services, interested parties, communication partners, business and contractual partners
Categories of Data:
User data (e.g. web pages visited, interest in content, access times), meta and communication data (e.g. device information, IP addresses), location data, contact data, content data (e.g. text details, photographs, videos)
Purposes of Processing:
Marketing (partly also interest-based and behavioural), conversion measurement, target group formation, click tracking, development of marketing strategies and increasing the efficiency of campaigns
Legal Basis:
Consent (Art. 6 para. 1 lit. a) GDPR); fulfilment or initiation of a contract (Art. 6 para. 1 lit. b) GDPR)
Legitimate interests:
Optimisation and further development of the website, profit increase, customer retention and acquisition
Google Tag Manager
Service used: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
Data protection: https://policies.google.com/privacy
Opt-Out link: https://tools.google.com/dlpage/gaoptout?hl=de or https://myaccount.google.com
Legal Basis: Legitimate interest (Art. 6 para. 1 lit. f) GDPR)
Legitimate interests: Coordination of different tools, management, ease of use and presentation
Google Analytics
Service used: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
Privacy: https://policies.google.com/privacy
Opt-Out link: https://tools.google.com/dlpage/gaoptout?hl=de or https://myaccount.google.com/
Legal Basis: Consent (Art. 6 para. 1 lit. a) GDPR)
Google AdWords
Service used: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
Privacy: https://policies.google.com/privacy
Opt-Out link: https://tools.google.com/dlpage/gaoptout?hl=de or https://myaccount.google.com/
Legal Basis: Consent (Art. 6 para. 1 lit. a) GDPR)
Google Doubleclick
Service used: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
Privacy: https://policies.google.com/privacy
Opt-Out link: https://tools.google.com/dlpage/gaoptout?hl=de or https://myaccount.google.com/
Legal Basis: Consent (Art. 6 para. 1 lit. a) GDPR)
Google Adsense
Service used: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
Privacy: https://policies.google.com/privacy
Opt-Out link: https://tools.google.com/dlpage/gaoptout?hl=de or https://myaccount.google.com/
Legal Basis:Consent (Art. 6 para. 1 lit. a) GDPR)
Facebook-Pixel
Service used: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland
Privacy: https://www.facebook.com/privacy/explanation
Opt-Out link: https://www.facebook.com/policies/cookies/
Legal Basis: Consent (Art. 6 para. 1 lit. a) GDPR)
Service used: Xandr Inc. 28 West 23rd Street, Fl 4 New York, NY 10010 USA
Privacy: https://about.ads.microsoft.com/en-us/solutions/xandr/digital-platform-cookie-policy
Opt-Out link: https://monetize.xandr.com/privacy-center/captcha?next_page=/privacy-center/delete
Legal Basis: Consent (Art. 6 para. 1 lit. a) GDPR)
Social Media Presence
We maintain online presences on social networks and career platforms in order to be able to exchange information with the users registered there and to make contact wit them in an uncomplicated way.
In some cases, the data of users on social networks is used to conduct market research and so, pursue advertising purposes. User profiles can be created via the usage behaviour of users; for example, by specifying interests, and can be used to adapt advertisements to the interests of target groups. For this purpose, cookies are regularly stored on the terminal devices of users, sometimes regardless of whether they are registered users of the social network.
Depending on where the social network is operated, user data may be processed outside the European Union or outside the European Economic Area. This can result in risks to users; for example, because it makes it more difficult to enforce their rights.
Categories of Data Subjects:
Registered users and non-registered users of the social network
Categories of Data:
Master data (e.g. name, address), contact data (e.g. e-mail address, telephone number), content data (e.g. text data, photographs, videos), usage data (e.g. websites visited, interests, access times), meta and communication data (e.g. device information, IP address)
Purposes of Processing:
Extension of reach, networking
Legal Basis:
Legitimate interests (Art. 6 para. 1 lit. f) GDPR), consent (Art. 6 para. 1 lit. a) GDPR)
Legitimate interests:
Interaction and communication on social media presence, increasing profit, insights about target groups
Service used: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland
Privacy: https://help.instagram.com/519522125107875 and https://www.facebook.com/about/privacy
Opt-Out link: https://www.instagram.com/accounts/login/?next=/accounts/privacy_and_security/
Service used: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland
Privacy: https://www.facebook.com/privacy/explanation and https://www.facebook.com/legal/terms/page_controller_addendum
Opt-Out link: https://www.facebook.com/policies/cookies/
TikTok
Service used: TikTok Inc., 10100 Venice Blvd., Culver City, CA 90232, USA
Privacy: https://www.tiktok.com/legal/privacy-policy?lang=de
Service used: LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA
Privacy: https://www.linkedin.com/legal/privacy-policy
Opt-Out link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
YouTube
Privacy: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
Privacy: https://policies.google.com/privacy?hl=de&gl=de
Opt-Out link: https://tools.google.com/dlpage/gaoptout?hl=de oder https://myaccount.google.com/
Plug-ins and Integrated Third-Party Content
We have integrated functions and contents into our online offering, which are obtained from third-party providers. For example, videos, representations, buttons or posts (hereafter referred to as content ) can be integrated.
In order to be able to display content to visitors to our online offering, the respective third-party provider processes, among other things, the IP address of the user, so that the content can be transmitted to the browser and displayed. Without this processing operation, the display of third-party content is not possible.
In some cases, additional information is collected via so-called pixel tags or web beacons, whereby the third-party provider receives information about the use of the content or visitor traffic on our online offering, technical information about the user's browser or operating system, the time of the visit or referring websites. The data obtained in this way is stored in cookies on the user's terminal device.
In order to protect the personal data of visitors to our online offering, we have taken certain security precautions to prevent automatic transmission of this data. This data is only transmitted when users use the buttons or click on the third-party content.
Categories of Data Subjects:
Users of the plug-in or embedded third-party content
Categories of Data:
Usage data (e.g. websites visited, interests, access time), meta and communication data (e.g. device information, IP address), contact data (e.g. e-mail address, telephone number), master data (e.g. name, address)
Purposes of Processing:
Designing our online offering, increasing the reach of social media ads, sharing posts and content, interest and behaviour-based marketing, cross-device tracking
Legal Basis:
Consent (Art. 6 para. 1 lit. b) GDPR)
Facebook Social Plugins
Service used: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland
Privacy: https://www.facebook.com/privacy/explanation
Opt-Out link: https://www.facebook.com/policies/cookies/
Legal Basis: Consent (Art. 6 para. 1 lit. b) GDPR)
Getty Images
Service used: Getty Images, Inc., 605 5th Avenue South, Suite 400, Seattle, Washington 98104, USA
Privacy: https://www.gettyimages.de/company/privacy-policy
Opt-Out link:
Legal Basis: Consent (Art. 6 para. 1 lit. b) GDPR)
OpenStreetMap
Service used: OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, Vereinigtes Königreich
Privacy: https://wiki.osmfoundation.org/wiki/Privacy_Policy
Opt-Out link:
Legal Basis: Consent (Art. 6 para. 1 lit. b) GDPR)
ReCaptcha
Service used: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Privacy: https://policies.google.com/privacy?hl=de&gl=de
Opt-Out link: https://tools.google.com/dlpage/gaoptout?hl=de or https://myaccount.google.com/
Legal Basis: Consent (Art. 6 para. 1 lit. b) GDPR)
Newsletters and Circulars (possibly with Tracking)
On our online offering, users have the option of subscribing to our newsletter or any notifications via various channels (hereafter newsletter). Subject to legislative provisions, we only send out newsletters to recipients who have consented to receive the newsletter. We use a selected service-provider to send out our newsletter.
In order to subscribe to one of our newsletters, it is necessary to provide an e-mail address. If necessary, we collect additional data, such as an individual’s name, in order to provide our newsletter with a personal address.
Our newsletter is only sent out after the so-called double opt-in procedure has been completed. If visitors to our online offering decide to subscribe to our newsletter, they will receive a confirmation e-mail, which is used to prevent the misuse of false e-mail addresses and to exclude the possibility that a simple, possibly accidental click triggers the sending of the newsletter. Subscription to our newsletter can be terminated for the future at any time. An unsubscribe link (opt-out link) is included at the end of each newsletter.
In addition, we are obliged to provide proof that our subscribers actually wanted to receive the newsletter. For this purpose, we collect and store their IP address and their log-in and log-out times.
Our newsletters are designed in such a way as to make it possible for us to gain insights into improvements, target groups or the reading behaviour of our subscribers. This enables us to use a so-called web beacon or a tracking pixel, which reacts to interactions with the newsletter; for example, on the basis of whether links are clicked, whether the newsletter is opened at all or at what time the newsletter is read. We may, for technical reasons, attribute this information to individual subscribers.
Categories of Data Subjects:
Newsletter subscribers
Categories of Data:
Master data (e.g. name, address), contact data (e.g. e-mail address, telephone number), meta and communication data (e.g. device information, IP address), usage data (e.g. interests, access times)
Purposes of Processing:
Marketing, customer retention and new customer acquisition, analysis and evaluation of the success of a campaign
Legal Basis:
Consent (Art. 6 para. 1 lit. a) GDPR)
Salesforce
Service used: Salesforce.com, inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA
Privacy: https://www.salesforce.com/uk/company/privacy/
Raffles and Competitions
We use our online presences to run prize draws and/or competitions . In doing this, we process the data of campaign participants, as required to implement the respective campaign. This also includes the data we need to inform the winner and to pay out the winnings.
Depending on the nature of the campaign, contributions from or about campaign participants may be published, for example when reporting on the respective campaign or if a vote on a submitted contribution by the participant is part of the campaign. The name of the participant will also be published. The data we process in individual cases depends on the specific campaign carried out and on the data we receive from the participant.
The implementation of the respective campaign on our presence in a social network is also subject to the usage and data protection provisions of the respective network.
Categories of Data Subjects:
Campaign participants
Categories of Data:
Master data (e.g. name, address), contact data (e.g. e-mail address, telephone number), content data (e.g. text entries, photos, videos)
Purposes of Processing:
Competition implementation incl. prize distribution and announcement of the winner in various media
Legal Basis:
Consent (Art. 6 para. 1 lit. a) GDPR)
Contact
Our online offering provides the options of either contacting us directly or else obtaining information via various contact possibilities. In order for users always to have an overview of contacts, we use a management tool to process corresponding requests.
Whenever contact is made, we process the data of the person making the enquiry only to the extent needed to answer or process the enquiry. Depending on the way in which contact is made, the actual data processed may vary.
Categories of Data Subjects:
Enquirers
Categories of Data:
Master data (e.g. name, address), contact data (e.g. e-mail address, telephone number), content data (e.g. text entries, photographs, videos), usage data (e.g. interests, access times), meta and communication data (e.g. device information, IP address).
Purposes of Processing:
Processing of enquiries
Legal Basis:
Consent (Art. 6 para. 1 lit. a) GDPR), fulfilment or initiation of a contract (Art. 6 para. 1 lit. b) GDPR)
Zendesk
Service used: Zendesk, Inc., 989 Market Street #300, San Francisco, CA 94102, USA
Privacy: https://www.zendesk.de/company/customers-partners/privacy-policy/
Contact form for making an appointment for a test drive/inspection/consultation with a trading partner
Via our website you have the option of being able to arrange a test drive and/or a consultancy appointment. For this purpose, the personal data required in this context will be collected and transmitted to the dealer you select. If you would like to be contacted by phone by your selected dealer, your phone number is also collected and transmitted as voluntary information. In order for us to be sure that the appointment will be attended as agreed, we will send you both a confirmation and an appointment reminder.
This collection, storage and transmission of data is based on your voluntarily given consent. You can revoke this consent at any time. In addition, you can also assert your rights against the dealer. To do this, contact the dealer you have selected.
Categories of Data Subjects:
Interested parties
Categories of Data:
Master data (e.g. name, address), contact data (e.g. e-mail address, telephone number), preferred vehicle type
Purposes of Processing:
Simplification of appointment finding with dealers, customer retention
Legal Basis:
Consent (Art. 6 para. 1 lit. b) GDPR)
Data Transmission
We transmit the personal data of visitors to our online offering for internal purposes (e.g. for internal administration or to the HR department in order to comply with legal or contractual obligations). Internal data transmission or disclosure of your data is only carried out in the extent necessary for this purpose, subject to compliance with the relevant data protection regulations.
AND/OR
We are a globally active company with headquarters in Germany. The data of visitors to our online offering is stored in our centralised customer database in Germany, subject to compliance with the relevant data protection regulations; and it is processed within this framework for internal administrative purposes throughout the Group. No processing is carried out beyond stated administrative purposes.
Legal Basis:
Legitimate interests (Art. 6 para. 1 lit. f) GDPR)
Legitimate interests:
so-called small group privilege, centralised management and administration within the company, in order to exploit synergy effects, cost savings, increasing effectiveness
In order to perform contracts or to comply with a particular legal obligation, it may be necessary for us to disclose certain personal data. If the data required in this regard is not supplied to us, it may not be possible to conclude the contract with the data subject concerned.
Recipient: [Link to Group structure and locations/branches]
In the event that we transfer internal Group data to a country outside the EEA for processing purposes, we will ensure that the processing carried out in the manner we intend is lawful. For this scenario, we have concluded binding corporate rules/standard data protection clauses that include a special arrangement involving appropriate technical and organisational measures; this is in order to protect the data of data subjects in the best possible way. A copy of the guarantee used can be downloaded here https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_de.
In order to perform contracts or to comply with a particular legal obligation, it may be necessary for us to disclose certain personal data. If the data required in this regard is not supplied to us, it may not be possible to conclude the contract with the data subject concerned
Storage Period
We principally store your data for as long as necessary in order to provide our services or to the extent envisaged by the European legislator of directives and regulations or another legislator in laws or regulations, which the data controller responsible for the processing is subject to. In all other cases we erase your personal data after completion of the relevant purpose. This does not include any data that we are required to continue to store in order to fulfil legal obligations (e.g. we are obligated owing to tax and commercial law storage obligations to keep documents in reserve such as e.g. contracts and invoices for a certain period of time).
Automated Decision-Making
We do not use automated decision-making or profiling pursuant to Art. 22 DSGVO.
Legal Basis
Art. 6 1 lit. a GDPR is used by our company as the legal basis for processing activities, whereby we will obtain special consent for a particular processing purpose.
If the processing of personal data is necessary in order to perform a contract, to which the data subject is a contractual party; as, for example, would be the case with processing activities, which are necessary to deliver goods or supply any other service or consideration, then the processing is based on Art. 6 I lit. b GDPR. The same applies to such processing operations as are needed to implement pre-contractual measures; for example, in the case of enquiries about our products or services.
If our company is subject to a legal obligation, under which the processing of personal data becomes necessary; such as, for example, to fulfil tax obligations, then the processing is based on Art. 6 I lit. c GDPR.
In rare cases, the processing of personal data might be necessary in order to protect vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were to be injured at our company and subsequently his name, his age, his health insurance details or other vital information had to be forwarded to a doctor, a hospital or some other third party. Then the processing would be based on Art. 6 I lit. d GDPR.
Finally, processing activities might be based on Art. 6 I lit. f GDPR. Processing activities not covered by any of the above legal bases would rely on this particular legal basis, where such processing is necessary in order to safeguard a legitimate interest of our company or of a third party; provided, however, that the interests, basic rights and basic freedoms of the data subject do not prevail. If the processing of personal data is based on Article 6 I lit. f GDPR our legitimate interest is to carry out our business activity for the benefit of the wellbeing of all of our employees and our customer.
Rights of Data Subjects
Right of Access: Under Article 15 of the GDPR, data subjects have the right to request confirmation regarding whether we are processing data relating to them. They can request information about this data as well as the additional information listed in Art. 15 (1) GDPR, as well as a copy of their data.
Right of Rectification: Under Art. 16 GDPR, data subjects have the right to request the rectification or completion of data concerning them and processed by us.
Right to Erasure: Data subjects have the right under Art. 17 GDPR to demand immediate erasure of the data concerning them. Alternatively, under Art. 18 GDPR, they may request us to restrict the processing of their data.
Right to Data Portability: Under Art. 20 of the GDPR, data subjects have the right to request that the data they have supplied to us be made available and transferred to another data controller.
Right to lodge a complaint: Data subjects also have the right to lodge a complaint with the competent supervisory authority in accordance with Article 77 of the GDPR.
Right to Object: If personal data is processed based on legitimate interests under Article 6 (1) sentence 1 lit. f) GDPR, data subjects have the right to object to the processing of their personal data under Article 21 GDPR, inasmuch as there are grounds for doing so arising from their particular situation or the objection is directed against direct advertising. In the latter case, data subjects have a general right to object, which will be acted on by us without the particular situation being stated.
Revocation
A number of data processing activities are only possible with your express consent. You have the option of being able, at any time, to revoke consent that you have already granted. For this purpose, it would be sufficient to e-mail us an informal notice, using the following address: datenschutz@etrusco.com. The lawfulness of any data processing carried out prior to the time at which consent is revoked remains unaffected by the revocation.
External Links
On our website you will find links to the online offers of other providers. We would like to point out here that we have no influence over the content of linked websites or, indeed, over the level of compliance with data protection regulations practised by the providers of those websites.
Changes
We reserve the right to adapt this privacy notice at any time in the event of changes to our online offering and in compliance with applicable data protection rules, so that it then meets legal requirements.