​

1. Controller
The following information explains how personal data is processed when you visit our website, contact us or apply for a job. The controller within the meaning of the General Data Protection Regulation (GDPR) is:

​

CABA-BLIND Antriebsaggregate GmbH
Georg-Grether-Str. 6
77743 Neuried
Germany
Im Gewerbepark BASIC
Telephone: +49 7854 9668-0
Email: info@caba-blind.de
Data protection contact: datenschutz@caba-blind.de

​

2. Data Protection Officer

If you have any questions about the processing of personal data or wish to exercise your data protection rights, you can contact our external Data Protection Officer directly:

​

momentum. Managementberatung
Dennis Schwarz
Burdastraße 23
77746 Schutterwald
Telephone: +49 781 12552850
Email: dsb@momentum-managementberatung.de

​

3. Principles of Data Processing

Personal data means any information relating to an identified or identifiable person, such as contact details, IP addresses or information provided in a job application. We process such data only where there is a lawful purpose and a legal basis for doing so. In particular, we comply with the GDPR, the German Federal Data Protection Act (BDSG) and the provisions of the German Telecommunications and Digital Services Data Protection Act (TDDDG).

​

The applicable purposes, legal bases, recipients and retention periods or deletion criteria are explained in the following sections. The provisions of the TDDDG apply to the storage of and access to information on your device. If personal data is processed in this context, a legal basis under the GDPR is also required.

​

4. Website Operation, Hosting and Technical Log Data

4.1 Operation via Wix and Technical Website Service Provider

Our website is operated using the platform provided by Wix.com Ltd., Yunitsman 5 St, Tel Aviv, Israel (Wix Business Elite). Technical support, maintenance and administration are provided by TWO-IN-ONE DESIGN GmbH, Emmendinger Straße 4, 77975 Ringsheim. In the course of providing these services, authorised technical employees or technical specialists engaged by the service provider may access the data required for administration and troubleshooting.

​

Wix provides the technical infrastructure, including server operation, content delivery, security features and necessary system components. For this purpose, Wix may use its own group companies and technical subcontractors. Further information on processing by Wix and its subprocessors is available at:

​

https://www.wix.com/about/privacy

https://support.wix.com/de/article/liste-der-unterauftragsverarbeiter-von-wix

​

4.2 Processing When Pages Are Accessed

When the website is accessed, the following data in particular is processed for technical reasons, to the extent that it arises in connection with the request: IP address, time and duration of the request, page or file accessed, requested URL, browser type and version, operating system, referrer information where applicable, and technical connection, session, error and security data.

​

This processing is necessary to deliver content, manage sessions, ensure functionality, analyse errors, detect attacks and protect the website against misuse. The legal basis for the processing of personal data is Article 6(1)(f) GDPR. Our legitimate interest is to provide a secure, stable and usable website. Section 25(2) TDDDG applies to strictly necessary storage of or access to information on devices.

​

4.3 Technical Storage and Integrated Infrastructure

Depending on the purpose, technical session and connection information is processed during the session or for short periods required for technical purposes. Where Wix also stores security, error or operational logs, their retention depends on what is necessary for functionality, error analysis and security; the data is subsequently deleted or anonymised unless overriding legal grounds prevent this. Different retention periods may therefore apply to different types of technical logs.

​

Wix may use technical cloud and content delivery infrastructure, as well as platform-internal error, performance and security systems, to deliver the website reliably worldwide. According to our website service provider, no separately integrated Google Analytics, map, video or CAPTCHA services are used.

​

5. Cookies and Similar Storage Technologies

Cookies are small pieces of text information stored on your device. Similar technologies, such as local browser storage and technical identifiers, may also be used. We use necessary functions to provide our website securely. Non-essential marketing technologies are activated only after you have given your consent.

​

5.1 Technically Necessary Technologies

The technically necessary cookies observed on our website or provided by Wix include, in particular:

• hs – Wix security function; retention period: session.

• server-session-bind – protection of technical interfaces; retention period: session.

• XSRF-TOKEN – protection against abusive requests; retention period: session.

• ssr-caching – technical caching for page rendering; retention period: generally up to 24 hours.

• svSession – website stability, security and core functions; retention period: generally up to 12 months according to Wix.

• bSession – monitoring of technical system effectiveness; retention period: generally up to 24 hours.

• consent-policy – storage or recognition of a cookie choice in the website context; a lifetime of approximately twelve months was identified in the technical inventory.

These cookies serve to ensure secure and functional operation or to store privacy settings. To the extent that these technologies are strictly necessary for the service expressly requested, access is based on Section 25(2) TDDDG. The processing of personal data for operation and security is based on Article 6(1)(f) GDPR; where it concerns documenting privacy decisions and meeting evidentiary obligations, it is based on Article 6(1)(c) GDPR. Our legitimate interest is the secure and stable operation of the website. The cookies actually used and their lifetimes may change as a result of technical updates to the platform.

​

5.2 Technologies Requiring Consent

Meta marketing technologies are used on certain recruitment landing pages with your prior consent. In particular, the “_fbp” cookie may be set to recognise browser interactions; its typical lifetime is up to three months. Other cookies or identifiers set by Meta depend, among other things, on the particular use and the browser.

​

Section 25(1) TDDDG applies to storage or access operations requiring consent. The associated processing of personal data for marketing purposes is based on Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

​

6. Consent Management with Usercentrics

We use Usercentrics, provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, to manage and document your consent. When you visit our website, you can select the categories and services offered in the consent banner, reject non-essential technologies or consent to their use.

​

For this purpose, the following data in particular may be processed: a pseudonymous consent identifier (Consent ID), the time and content of your decision, consent and rejection status, information on the legal framework used and the banner version, device/platform information and a masked or truncated IP address. Your choice may also be stored on your device in a technically necessary form.

​

This processing serves to manage your choice in compliance with the law and to provide evidence of consent given or refused. The legal basis for processing for evidentiary and documentation purposes is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR; technically necessary storage or access takes place in accordance with Section 25(2) TDDDG. According to the technical service provider, consent records held by Usercentrics are generally retained for twelve months.

​

You can access and change your choice at any time using the “Cookie settings” link permanently available on our website. Withdrawal takes effect for the future; it does not affect the lawfulness of processing carried out before withdrawal.

​

Further information on processing by Usercentrics:

https://usercentrics.com/de/datenschutzerklaerung/

​

7. Recruitment Advertising: Meta Pixel and Conversions API

7.1 Provider, Scope of Use and Purposes

For our recruitment campaigns on Facebook and Instagram, we use the Meta Pixel (Pixel ID 4076474345936915) and, additionally, the Meta Conversions API on the associated landing pages. The provider and recipient is Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin D04 X2K5, Ireland.

​

We use these technologies only with the relevant marketing consent to measure the success of our recruitment advertisements (in particular, whether an application form is submitted after exposure to an advertisement), to optimise the delivery of job advertisements and to show recruitment advertisements again to interested website visitors on Facebook and Instagram through remarketing. According to our website service provider, we do not use the Meta Pixel for separate general web analytics.

​

7.2 Data Processing and Server-Side Event Transmission

Where marketing consent is active, technical browser and device information, IP address, page and referrer information, cookie or online identifiers (in particular “_fbp”), the time and type of website interactions and conversion events, such as submitting an application form, may be processed and transmitted to Meta in this context. The data actually transmitted depends on the particular event and the technical integration.

​

The Meta Pixel transmits event data from your browser to Meta. In addition, event data is transmitted from a server to Meta via the Meta Conversions API. Both transmission methods serve to attribute, measure and optimise our recruitment advertisements.

​

The data and documents submitted through application forms are processed to conduct the recruitment process. The use of marketing technologies is separate from this and is not necessary for an application. Refusing marketing consent does not affect your ability to apply for a job with us.

​

7.3 Legal Bases and Controls

Processing for the advertising and marketing purposes described is based on your voluntary consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to the setting of or access to cookies or similar technologies requiring consent. Consent is obtained through Usercentrics and controls both the browser-based pixel and the associated server-side event transmission via the Conversions API.

​

You can withdraw your consent at any time via “Cookie settings”. Following refusal or withdrawal, no further marketing events requiring consent will be transmitted to Meta for these purposes. Where applicable, you can also influence your advertising preferences through the privacy and advertising settings of your Meta account.

​

7.4 Responsibilities and Further Processing by Meta

For the processing operations subject to joint controllership under the applicable Meta Business Tools terms, we and Meta Platforms Ireland Limited are joint controllers pursuant to Article 26 GDPR. Joint controllership concerns the collection and transmission to Meta of the event data covered by those terms. In particular, we are responsible for providing information about the use of these tools on our website and obtaining the necessary consent. Further processing by Meta is governed by Meta’s privacy information and takes place outside this joint controllership under Meta’s own responsibility. You may exercise your data protection rights in relation to the jointly controlled processing against both us and Meta.

​

Information on the allocation of responsibilities and Meta’s data protection terms is available at:

https://www.facebook.com/legal/terms/businesstools

https://www.facebook.com/legal/controller_addendum

https://www.facebook.com/privacy/policy/

​

7.5 Retention Periods and Third-Country Processing

The retention period for Meta cookies depends on the particular identifier; for “_fbp”, it is typically up to three months. Meta processes and stores the event data it receives in accordance with the applicable terms and its own retention and deletion rules. Details are explained in the Meta information linked above.

​

Meta may also process data outside the EU or the EEA, in particular in the United States. The requirements of Articles 44 et seq. GDPR apply. Where the conditions of an applicable adequacy decision, including appropriate certification under the EU-US Data Privacy Framework, are met for the particular transfer and data category, the transfer may be based on that decision. Otherwise, appropriate safeguards, in particular EU Standard Contractual Clauses, are required. You can request information on the transfer safeguards used through our data protection contacts.

​

8. Contacting Us and the Contact Form

If you contact us using the contact form, by email or by telephone, we process the information you provide, in particular your name, contact details, message and any additional information you provide voluntarily. We process this information to handle your enquiry, respond to you, document the communication and, where applicable, take further steps related to your enquiry.

​

Where contact is necessary for a contract or pre-contractual measures with you, Article 6(1)(b) GDPR applies. For other business or general enquiries, Article 6(1)(f) GDPR applies; our legitimate interest is to handle and respond to the enquiry appropriately and maintain business contacts.

​

Enquiries submitted through the contact form are technically processed via Wix, additionally stored in the Wix backend and transmitted to the internal mailbox designated for general enquiries, info@caba-blind.de. Access is granted only to the responsible departments and necessary technical service providers. These website form data are not routinely forwarded to companies within the SEW Group.

​

Once an enquiry has been dealt with, copies of contact enquiries in the Wix backend that are no longer needed are generally deleted within three months at the latest. If data remains in internal business communications, it is deleted when its purpose no longer applies and there are no longer any statutory retention obligations or legitimate interests in retaining evidence. Mandatory fields are marked in the form. Without the necessary information, we may be unable to process the enquiry.

​

9. Job Applications via the Website

You can apply for advertised vacancies or submit an unsolicited application through our careers and recruitment pages. In this context, we process, in particular, your name, contact details, information on qualifications and employment history, submitted application documents, answers to application questions and data arising from subsequent applicant communications and assessments.

​

The processing serves to review your application, conduct the selection process and decide whether to enter into an employment relationship. The legal bases are, in particular, Article 6(1)(b) GDPR in conjunction with Section 26(1) BDSG, insofar as the respective provision is applicable, and Article 6(1)(c) GDPR where statutory obligations apply. The establishment or defence of legal claims may be based on Article 6(1)(f) GDPR. Where special categories of personal data are exceptionally required, the conditions of Article 9 GDPR and, where applicable, Section 26(3) BDSG are also observed.

​

Online applications are technically received via Wix, processed in the Wix backend and forwarded to our company’s designated application mailbox. Within our company, access is granted only to the departments involved in the recruitment process. Applicant data submitted through the website is not routinely shared with companies within the SEW Group.

​

For unsuccessful applications, data is generally deleted no later than six months after the recruitment process has ended, unless there are lawful grounds for longer retention. If an application is successful, the data required for this purpose may be transferred to the personnel file. Retention for future vacancies takes place only on the basis of separate valid consent with its own retention period.

​

The information necessary to conduct the recruitment process must be provided; otherwise, we may be unable to process the application. Separate consent to marketing tracking, however, is voluntary and is not a prerequisite for an application.

​

Further details, in particular on data categories, recipients, legal bases and data subject rights, can be found in our separate “Privacy Notice for Job Applicants”:

https://www.caba-blind.de/datenschutzhinweis

​

10. Recipients, Service Providers and Processing in Third Countries

In connection with the processing described, personal data may be processed by the responsible employees of CABA-BLIND and necessary external service providers. These include, in particular, TWO-IN-ONE DESIGN GmbH (technical website support), Wix.com Ltd., including relevant subprocessors (website platform and hosting), Usercentrics GmbH (consent management) and, with the relevant consent, Meta Platforms Ireland Limited (recruitment marketing). Authorities or other bodies receive data only where there is a legal basis or obligation to provide it.

​

Where external companies act as processors, the requirements of Article 28 GDPR apply. Where joint controllership exists, the allocation of responsibilities is governed by Article 26 GDPR. The nature and extent of data processing depend on the service actually used.

​

Wix’s infrastructure operates internationally. Processing or technical access from countries outside the EU/EEA is therefore possible, in particular from Israel and the United States. The European Commission has adopted an adequacy decision for Israel. For other third countries, the providers involved state that they use appropriate transfer mechanisms depending on the recipient and processing, in particular adequacy decisions or EU Standard Contractual Clauses. Lawfulness is governed by Articles 44 et seq. GDPR. You can obtain information on the relevant safeguards through our data protection contacts.

​

11. Retention Periods and Deletion

We process personal data for no longer than is necessary for the respective purpose, unless statutory retention periods or other lawful grounds require longer retention. In particular, the following periods or criteria apply to the individual processing activities:

• Technical session cookies: generally until the end of the session; other Wix system cookies in accordance with their purpose as explained in Section 5 and their respective lifetime.

• Technical server and security logs: until their purpose for operation, error analysis and security has been fulfilled, taking into account any applicable evidentiary obligations.

• Usercentrics consent records: generally twelve months, according to the provider or service provider.

• Meta marketing identifiers: depending on the specific identifier; “_fbp” typically up to three months. The storage of event data by Meta is governed by its terms.

• Contact enquiries: deletion after completion and once grounds for retention no longer apply; copies of completed enquiries in the Wix backend are generally deleted within three months at the latest.

• Unsuccessful applications: generally deleted no later than six months after the recruitment process has ended, unless there is a lawful ground for longer retention.

Where data is transferred to business-related documents or subsequent specialist systems, the applicable statutory retention periods and internal deletion rules apply.

​

12. Your Data Protection Rights

Subject to the statutory requirements, you have, in particular, the following rights:

• Access to information about the processing of your personal data (Article 15 GDPR);

• Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);

• Erasure of your personal data (Article 17 GDPR);

• Restriction of processing (Article 18 GDPR);

• Data portability (Article 20 GDPR);

• Objection to certain processing activities (Article 21 GDPR);

• Withdrawal of consent at any time with effect for the future (Article 7(3) GDPR).

Special information on the right to object: Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to the processing of personal data for direct marketing purposes at any time without having to provide such grounds. If you object, we will no longer process your data for those marketing purposes.

​

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To exercise your rights, you can contact us or our Data Protection Officer using the contact details in Sections 1 and 2. Where necessary, we will verify your identity before providing information or releasing data.

​

13. Right to Lodge a Complaint with a Supervisory Authority

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement. In particular, the following supervisory authority is competent for us:

​

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
PO Box 10 29 32
70025 Stuttgart
Telephone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de

https://www.baden-wuerttemberg.datenschutz.de/

​

14. Automated Decisions and Profiling

When handling contact enquiries and making our own selection decisions in the recruitment process, we do not engage in decision-making based solely on automated processing within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

​

Where you have consented to the Meta marketing technologies described, technical usage and event data may be used to create advertising audiences and deliver personalised recruitment advertisements. This is separate from our own decision on your application. Information on further profiling by Meta can be found in its privacy notices.

​

15. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, accidental alteration or unlawful disclosure. These include, in particular, encrypted website transmission using HTTPS/TLS, tiered access rights, technical security measures of the platform used and organisational oversight of authorisations and deletion procedures.

​

Despite the security measures taken, email communication may involve risks arising from transmission over public networks.

​

16. Updates to this Privacy Policy

We update this Privacy Policy when the services we use, processing activities or the legal situation change. The version