Data privacy policy

(Status: 25 Sept. 2019 v1.3)

1. Scope

1.1 The following data privacy policy applies for the use of the digital solution WMF CoffeeConnect ("web portal"), the services offered via this solution and the coffee machines with telemetry module ("WMF CoffeeConnect INSIDE") offered for this purpose. This web portal is provided by WMF GmbH, WMF Platz 1, D-73312 Geislingen an der Steige, e-mail: info@wmf.de (hereafter referred to as "WMF") as the data controller as defined by Art. 4 EU General Data Protection Regulation ("GDPR"). You can contact our Data Protection Officer via our contact form under "Inquiry to the Data Protection Officer" or under our postal address, adding "the Data Protection Officer".

1.2 The protection of your personal data is important to us, particularly with respect to the preservation of your right to privacy during the processing and use of your data. The following section contains information on the collection of personal data when you use our web portal. Personal data are all data which refer to you personally, for example your name, address, e-mail addresses, user behaviour.

2. Automated data collection and processing

2.1 Like every web service, our server automatically and temporarily stores data in the server log files unless you have deactivated this function. If you wish to view our web portal, we collect the following data which we require for technical reasons in order to display our web portal to you and to ensure its stability and security (legal basis: Art. 6 Para. 1 lit f) GDPR):

  • IP address of the requesting computer
  • file request of the client
  • the http response code
  • the website from which you are visiting us (referrer URL),
  • date and time of the server request
  • browser type and version
  • operating system of the requesting computer

No person-related analysis of the server log files takes place. At no time can these data be traced back to specific persons by the provider. These data are not merged with data from other data sources.

2.2 This website uses Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics uses so-called "cookies," text files which are stored on your computer and enable analysis of your use of the website. As a rule, the information on your use of the website generated by the cookie is transferred to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, the user’s IP address will first be truncated by Google within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate use of the website, compile reports on website activity and provide other services relating to website activity and internet usage for the website operator.

Google states that the IP-address transmitted by your browser within the scope of Google Analytics will not be associated with any other data held by Google.

You can prevent the storage of cookies by changing your browser settings accordingly; however, we would like to point out that in this case, you may not be able to use the full functionality of this website. You can also prevent transmission of the data generated by the cookies and relating to your use of the website (including your IP address) to Google and the processing of these data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

This website uses Google Analytics with the extension "_anonymizeIp()". This means that IP addresses are only processed further in abbreviated form and can therefore not be traced back to a particular individual. Any collected data which could allow identification of a specific person are thus immediately excluded and the personal data deleted without delay.

We use Google Analytics to analyse the usage of our website and to regularly improve it. The information it provides enables us to improve our offering and make it more interesting for you, the user. In order to cover exceptional cases where personal data are transferred to the USA, Google complies with the EU-US Privacy Shield (https://www.privacyshield.gov/EU-US-Framework). The legal basis for the use of Google Analytics is Art. 6 Para. 1 Sentence. 1 lit. f GDPR.

Third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: http://www.google.com/analytics/terms/de.html, Data privacy overview: http://www.google.com/intl/de/analytics/learn/privacy.html and the Data Privacy Policy: http://www.google.de/intl/de/policies/privacy.

2.3 This website also uses the online advertising service Google AdSense, which allows us to offer advertising tailored to your specific interests. Our aim here is to make our website more attractive by presenting advertising which might be of interest to you. In order to do this, statistical information is collected and processed by our advertising partners. Their advertisements are displayed marked as "Google Ads."

When you visit our website, Google receives the information that you have accessed our site. Google does this using a web beacon to place a cookie on your computer. The information listed under section 2.1 of this data privacy policy is transferred. We have no influence on the data collected, nor are we aware of the full scope of the data collected or for what period the data are stored. Your data are transferred to the USA and evaluated there. If you are logged on to your Google account, your data can be directly linked to that account. If you do not wish your data to be linked to your Google profile, you must log out from your Google account. These data may be passed on to Google contract partners, third parties and public authorities. The legal basis for the processing of your data is Art. 6 Para. 1 Sentence. 1 lit. f GDPR. This website does not display advertisements from third-party suppliers via Google AdSense.

You can prevent the installation of cookies by Google AdSense in various ways: a) by selecting the corresponding setting in your browser software; in particular, the suppression of third-party cookies means that you will not receive advertising from third-party suppliers; b) by deactivating Google interest-based advertising via the link http://www.google.de/ads/preferences, whereby it is important to note that this setting will be cancelled if you delete the cookies in your browser; c) by deactivating interest-based advertising from suppliers participating in the self-regulation campaign "About Ads" via the link http://wwwaboutads.info/choices, whereby it is important to note that this setting will be cancelled if you delete the cookies in your browser; d) by means of permanent deactivation in the browsers Firefox, Internet Explorer or Google Chrome via the link http://www.google.com/settings/ads/plugin. We would like to point out that in this case, you may not be able to use the full functionality of this web portal.

Further information on the purpose and scope of data collection and data processing, on your rights and setting options for the protection of your privacy can be obtained from: Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; Data privacy policies for advertising: http://www.google.de/intl/de/policies/technologies/ads.

2.4 In connection with various services and forms on our website, we use Google reCAPTCHA, a service provided by Google Inc., Mountain View, USA ("Google"). Google reCAPTCHA is used to distinguish whether data on online forms has been entered by a human being or via an automated program, script or similar means. To do this, Google reCAPTCHA analyses the actions of the person entering the data based on various characteristics. This analysis begins automatically as soon as the corresponding website is accessed. Google reCAPTCHA performs this analysis by evaluating various items of information (e.g. IP address, identification data of the browser used, browser settings, browser plug-ins, URL of the referring website, mouse movements, behaviour of the person entering the data such as input speed, order and selection of entries etc., Google cookies). The data captured during analysis are transferred to a Google server in the USA, where they are stored and evaluated. Personal data from the online forms are not read out or stored.

The legal basis for the use of Google reCAPTCHA is Art. 6 Para. 1 lit. f) GDPR, which permits the processing of personal data for the purpose of our legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Our legitimate interests are the protection of our website and online forms against automated use, data leakage and spam.

Google complies with the EU-US Privacy Shield; see following link: https://policies.google.com/privacy/frameworks?hl=de. Further information on Google reCAPTCHA and the Google Data Privacy Policy can be found at https://www.google.com/recaptcha/intro/android.html or at https://policies.google.com/privacy?hl=en.

2.5 As an AdWords customer, this website uses Google conversion tracking, an analysis service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). Google AdWords stores a cookie on your computer ("conversion cookie") if you accessed our website via a Google ad. These cookies expire after 30 days and are not used to identify persons. If you visit certain of our web pages before the cookie expires, we and Google can see that someone has clicked the advertisement and been redirected to our website. Each AdWords customer receives a different cookie. This means that cookies cannot be traced via the websites of AdWords customers. The information obtained with the help of the conversion cookie is used to compile conversion statistics for AdWords customers who have selected conversion tracking. These AdWords customers are informed of the total number of users who have clicked their ad and been redirected to a web page with a conversion tracking tag. However, they do not receive any information which would enable them to establish the user’s identity. If you do not wish to participate in conversion tracking, you can block the setting of the necessary cookie – for example, by deactivating the automatic installation of cookies in your browser settings. You can also deactivate cookies for conversion tracking by setting your browser to reject cookies from the domain "googleadservices.com".

If you do not wish to receive interest-based advertising, you can deactivate the use of cookies for this purpose by accessing https://www.google.de/settings/ads. Alternatively, users can deactivate cookies from third-party suppliers on the Deactivation page of the Network Advertising Initiative.

By using our web pages, you are granting your consent to the processing of your data by Google as described here and for the purpose named above. The legal basis for usage is Art. 6 Par. 1 Sentence. 1 lit. f GDPR.

We would like to point out that Google has its own data privacy directives, which are independent of our directives. We can accept no responsibility or liability for these directives and processes. Please read the Google Privacy Policy before using our website.

Personal data collected via Google Analytics and Google AdWords conversion tracking are deleted immediately on anonymisation of the IP addresses. Via an agreement with Google, we have restricted the storage duration of the anonymised data collected via Google Analytics to a maximum of 26 months.

3. Collection and processing of data provided voluntarily

3.1 As a general rule, personal data supplied by you via our web portal (surname, first name, e-mail address, postal address) are provided on a voluntary basis. These data are used by us for performance of our contract with you, to process your inquiries and orders and for the purposes of market research and opinion polling. Your data will not be used for any purpose above and beyond this; in particular, they will not be disclosed to third parties for the purpose of advertising, market research or opinion polls. Once storage is no longer required, we delete the data collected in this context or restrict the processing of such data where statutory storage requirements apply. The legal basis here is Art. 6 Para. 1 lit. b) GDPR or Art. 6 Para. 1 lit. f) GDPR.

3.2 If you register on our web portal, we collect your data (surname, first name, e-mail address, postal address) for performance of our contract with you. In as far as you incorporate a coffee machine into your profile, the technical data transmitted by the coffee machine in accordance with section 4 are linked with your profile. The legal basis for the processing of these data is Art. 6 Par. 1 Sentence. 1 lit. b GDPR.

If you conclude a service agreement with us, we will also process your data in order to perform repairs and maintenance, in order to improve our service and for the purpose of product improvement and development. The legal basis for processing of the user’s personal data is the performance of the respective contract (Art. 6 Para. 1 Sentence 1 lit. b GDPR) and the legitimate interests of WMF (Art. 6 Para. 1 Sentence 1 lit f GDPR).

3.3 If you wish to order goods via the web portal, a contract can only be concluded with us if you provide the personal data we require in order to process your order. Mandatory information is labelled as such; all other information is voluntary. We will use the data you provide in order to process your order. In this context, we are entitled to pass on your payment information to our bank or an online payment service. The legal basis here is Art. 6 Para. 1 Sentence. 1 lit. b GDPR.

Your data will only be used for as long as is required for the existing customer relationship. Irrespective of this, we are required under commercial and fiscal law to store your address, payment and order data for a period of ten years.

4. Use of data transmitted by a coffee machine with WMF CoffeeConnect INSIDE

4.1 As a fundamental rule, the telemetry module allows a bidirectional data exchange which permits continuous remote retrieval of data for efficient monitoring, control and optimisation of economic and service-relevant processes.

On start-up of a coffee machine with WMF CoffeeConnect INSIDE, operating and status details of the coffee machine ("technical data") are transmitted to WMF. In particular, these technical data include:

  • the type and number of devices connected to the coffee machine with WMF CoffeeConnect INSIDE, e.g. cooling unit with compatible sensor system
  • counter readings and statistics on brewing processes, beverage and maintenance counters, milk temperature (in the case of add-on equipment or an add-on cooling unit), boiler temperature etc.
  • commands and functions executed via the portal, including time of operation
  • status of the coffee machine (on, off and time of change in status)
  • data on radio transmission, including signal strength, selected provider and the radio cell within which the coffee machine with WMF CoffeeConnect INSIDE is located
  • diagnostic and error messages of the coffee machine with WMF CoffeeConnect INSIDE and connected devices
  • cleaning operation types and times at which cleaning was carried out
  • software versions and times at which software and software log files were updated
  • beverage and machine settings

4.2 The technical data listed above do not allow WMF to identify a specific user unless WMF CoffeeConnect is used. The technical data are only linked to the user profile when the user incorporates a coffee machine with WMF CoffeeConnect INSIDE. Where the technical data thus allow identification of a specific user as defined by Art. 4 No. 1 GDPR, we process the data for the purpose of performance of the contractual services arising from the use of the web portal by the user. The legal basis here is Art. 6 Para. 1 lit. b GDPR. The personal data are stored for the duration of the user relationship and will be deleted within one month after termination of the user relationship. Statutory storage requirements remain unaffected by this.

Where further users are enabled as secondary users for a networked coffee machine in addition to the primary users, we also process the data listed above on use of the coffee machine by one or more secondary users within the same context in order to allow operation of the networked coffee machine by the further secondary users in accordance with the service to be provided. (Art. 6 Para. 1 lit. b GDPR).

4.3 We have access to the technical data within the context of customer service. The data are used in pseudonymised form for this purpose. Personal data will be used exclusively to render the services arising from the contract concluded with the customer on the use of the WMF CoffeeConnect web portal or from an existing service agreement (Art. 6 Para. 1 lit b GDPR). We reserve the right to use the services of third parties to carry out maintenance work and to grant such third parties access to the user’s data within the context of commissioned data processing. Above and beyond this, the data will not be disclosed to third parties.

4.4 We reserve the right to use the technical data as well as anonymised or pseudonymised usage data, in particular for statistical purposes and for the further development of products. This also applies if the user terminates the use of WMF CoffeeConnect. These data are exclusively technical, device-specific data. No person-related analysis is performed.

5. Disclosure to third parties

As a fundamental rule, no personal data you supply to us will be disclosed to third parties. Such data will only be disclosed

  • where you have consented to this (cf. section 3.2). When the data are collected, you will be informed of the recipients or categories of recipients.
  • to subcontractors commissioned by us within the framework of the processing of your inquiries or orders and the use of our services. These subcontractors receive the necessary data from us and use them solely to carry out the tasks they are commissioned to perform and exclusively for the intended purpose.
  • in the course of processing by external service providers as defined by Art. 28 GDPR. These external processors have been carefully selected and commissioned by us, are bound by our instructions and the provisions of the GDPR and are monitored on a regular basis.
  • in order to fulfil our legal obligations to authorities entitled to receive such information.

6. Cookies

6.1 The web portal uses cookies. Cookies are small text files that are saved locally in your browser cache. Cookies of the following types are used on this web portal, and their scope and functionality is described below:

– transient cookies (see 6.2)
– persistent cookies (see 6.3).

6.2 Transient cookies are automatically deleted when you close your browser window. In particular, they include session cookies. Session cookies store a so-called session ID with which different requests from your browser can be assigned to one common session. This allows our web portal to recognise your computer on your next visit. Session cookies are automatically deleted when you log out or close your browser.

6.3 Persistent cookies are automatically deleted after a set time, which can differ from cookie to cookie. You can delete the cookies in the security settings of your browser at any time.

6.4 You can configure your browser to suit your wishes, for example by setting it to reject third-party cookies or all cookies. We would like to point out, however, that in this case, you may not be able to use all functions of this web portal.

6.5 We use cookies to allow us to identify you when you visit our website again if you have an account with us. If you do not have an account, you have to log in again each time you access the site.

7. Your rights

7.1 You have the following rights with respect to your personal data:

– the right of access and information,
– the right of rectification or erasure,
– the right to restriction of processing,
– the right to object to processing, in particular on grounds of legitimate interest
– the right to data portability.

Please send your written inquiry to WMF GmbH, WMF Platz 1, 73312 Geislingen an der Steige, or via the contact form.

7.2 You also have the right to lodge a complaint against our processing of your personal data with a data protection supervisory authority.