As of October 2026
Privacy Policy
Information on the processing of personal data under the GDPR and the TDDDG.
A. Privacy Policy under the GDPR
This English version is a convenience translation. In the event of any discrepancy, the German version shall prevail.
I. Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection provisions, is:
SURPRO GmbH
Rumflether Straße 13
25554 Wilster
Germany
Tel.: +49 4823 77-0
Email: kontakt@surpro.de
Website: www.surpro.de
II. Name and address of the data protection officer
The data protection officer of the controller is:
Anna Brandt
SURPRO GmbH
Rumflether Straße 13
25554 Wilster
Germany
Tel.: +49 4823 77-0
Email: brandt@surpro.de
Website: www.surpro.de
III. General information on data processing
1. Scope of processing of personal data
As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of our users’ personal data regularly takes place only with the user’s consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.
2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or of another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or of a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
3. Data erasure and storage period
The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.
IV. Provision of the website and creation of log files
1. Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
Information about the browser type and version used
The user’s operating system
The user’s internet service provider
The user’s IP address
Date and time of access
Websites from which the user’s system reaches our website
The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
The website is operated by an external hosting provider, which processes this data solely on our behalf and on our instructions (data processing on behalf pursuant to Art. 28 GDPR).
2. Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR.
3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.
Storage in log files is carried out to ensure the functionality of the website. In addition, the data helps us to optimise the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR.
4. Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended. In the case of data stored in log files, this is the case after six weeks at the latest. Storage beyond this period is possible. In this case, the users’ IP addresses are deleted or anonymised so that the accessing client can no longer be identified.
5. Possibility of objection and removal
The collection of data to provide the website and the storage of data in log files is essential for the operation of the website. Consequently, the user has no possibility to object.
V. Use of cookies
a) Description and scope of data processing
Apart from one technically necessary exception, our website only sets cookies with your consent. Cookies are text files that are stored in or by the internet browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. All cookies other than “userConsent” described below – such as those set by Google Analytics (see section VIII) – are only set on the basis of your consent pursuant to Section 25(1) TDDDG.
The only technically necessary cookie is “userConsent”. It stores your choice in the cookie notice – which categories you allowed or declined, with date and version – so that the notice does not reappear on every page view. It contains no identifier that could be used to identify you and is not passed on to third parties.
In addition, your browser keeps technical helper values in its so-called session storage for the duration of the session: the scroll position per page, so that you return to the same place when going back, and, after an update of the website, a marker that reloads the page once instead of showing an error message. These entries contain no identifier, are not transmitted to us and are deleted automatically when the tab is closed (Section 25(2) no. 2 TDDDG).
b) Legal basis for data processing
Where consent is obtained: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. For the “userConsent” cookie: Section 25(2) no. 2 TDDDG; storing your choice serves our obligation to demonstrate consent under Art. 7(1) GDPR (Art. 6(1)(c) GDPR).
c) Purpose of data processing
The “userConsent” cookie stores your choice in the cookie notice and records whether and for what you have given consent.
d) Storage period, possibility of objection and removal
The “userConsent” cookie is deleted automatically after 12 months, after which we ask again. You can delete it at any time in your browser settings. You can withdraw your consent at any time via the “Cookie settings” link in the footer.
VI. Contact form and email contact
1. Description and scope of data processing
You can send us an enquiry via the contact form on our website. The data you enter – name, email address, your area of interest, optionally your telephone number and your message – is transmitted to us and processed in order to handle your enquiry. The form is only sent once you have expressly consented to the processing by ticking the checkbox provided for this purpose (Art. 6(1)(a) GDPR). For the technical dispatch of the enquiry by email we use a service of our web agency Target KI GmbH, Dubenhorst 9, 24114 Kiel, Germany, which processes the data solely on our behalf and forwards it to us (data processing on behalf pursuant to Art. 28 GDPR). The data is not passed on to any other third parties.
Alternatively, you can contact us via the email address provided. In this case, the user’s personal data transmitted with the email will be stored.
In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation.
2. Legal basis for data processing
Where the user has given consent, the legal basis for processing the data is Art. 6(1)(a) GDPR.
The legal basis for processing data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. If the email contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR.
3. Purpose of data processing
In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.
4. Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved.
5. Possibility of objection and removal
The user may withdraw their consent to the processing of personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
Withdrawal of consent and objection to storage must be made in text form to the contact details given under section I, “Name and address of the controller”.
In this case, all personal data stored in the course of contacting us will be erased.
6. Applications
We accept applications – including unsolicited applications – by email to bewerbung@surpro.de or to the address stated in the respective job advertisement. We process the data and documents you send (e.g. contact details, CV, references) solely to carry out the application process. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into an employment relationship). Only the persons involved in the selection process have access; the data is not passed on to third parties.
You can also apply using the application form on the respective job page. Your details (name, email address, optionally phone number and message, your answers to the questions about the position) and the uploaded files are transmitted in encrypted form to a service run by our web service provider Target KI GmbH, Dubenhorst 9, 24114 Kiel, Germany. It checks the application for completeness and permitted file formats and forwards it by email to the application address of the position. Your details and files are not stored there; they are only held in memory for as long as forwarding takes. To prevent misuse, your IP address is kept for no more than ten minutes in order to block too many requests in a short time. The web service provider acts solely on our behalf and on our instructions (processing on behalf of the controller under Art. 28 GDPR). The legal basis here is also Art. 6(1)(b) GDPR.
If an employment relationship is established, the documents are transferred to the personnel file. Otherwise we delete them no later than six months after the process has ended (period for asserting claims under Section 15(4) of the German General Equal Treatment Act, AGG). We only keep them longer, for example for future vacancies, with your express consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
VII. Online appointment booking
1. Description and scope of data processing
On our website, you can book a consultation appointment with our contact persons online via the “Book appointment” button. Clicking the button opens the booking page of our service provider meetergo GmbH, Hauptstraße 44, 40789 Monheim am Rhein, Germany (hereinafter “meetergo”) in a new browser tab. Data is only transmitted to meetergo once this booking page is opened – merely visiting our website does not transmit any data to meetergo.
As part of the booking, the data you enter is processed: name, email address, telephone number, the selected appointment time and, where applicable, voluntary information about your request. meetergo processes this data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR; processing takes place on servers in the European Union. Further details can be found in meetergo’s privacy policy at www.meetergo.com/datenschutz.
2. Legal basis for data processing
The legal basis for processing the data is Art. 6(1)(b) GDPR, as the appointment booking serves to carry out pre-contractual measures or to initiate and conduct a business relationship.
3. Purpose of data processing
The data is processed exclusively for arranging, managing and holding consultation appointments with our contact persons.
4. Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected, but no later than after the booked appointment has been held and fully processed, unless statutory retention obligations apply.
5. Possibility of objection and removal
You can cancel a booked appointment at any time via the link in the confirmation email. In addition, you can object to the storage of your personal data at any time via the contact details given under section I, “Name and address of the controller”.
VIII. Web analytics with Google Analytics
1. Description and scope of data processing
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”), to statistically evaluate the use of our website and thereby continuously improve it. Google Analytics is loaded only after your express consent. As long as you have not agreed in the cookie notice, no Google scripts are loaded and no data is transmitted to Google.
Once consent has been given, the following data in particular is processed: pages visited and time spent on them, date and time of the visit, referring website, browser and device type used, approximate location based on the IP address, and individual interactions such as downloading data sheets or submitting the contact form. No content entered by you is transmitted in these interactions.
IP anonymisation is enabled: your IP address is truncated by Google within the European Union before it is processed further. It is not combined with other Google services (“Google signals”). A transfer to the USA cannot be completely ruled out; Google is certified under the EU-US Data Privacy Framework, and the Standard Contractual Clauses of the EU Commission apply in addition. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google.
2. Legal basis for data processing
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
3. Purpose of data processing
The analysis serves to understand how our website is used, to design its content and structure according to needs and to identify technical problems.
4. Storage period
User-related data is automatically deleted after 14 months. The cookies set by Google Analytics have a lifetime of up to 24 months.
5. Possibility of objection and removal
You can withdraw your consent at any time with effect for the future by reopening the cookie settings via the link in the footer and deactivating analytics. Alternatively, you can prevent data collection with Google’s browser add-on at tools.google.com/dlpage/gaoptout. Further information on data protection at Google is available at policies.google.com/privacy.
IX. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
1. Right of access
You may request confirmation from the controller as to whether personal data concerning you is being processed by us. Where such processing takes place, you may request information from the controller about the purposes, categories, recipients, planned storage period, the rights to rectification, erasure, restriction and objection, the right to lodge a complaint with a supervisory authority, the source of the data and the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR. You also have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation.
2. Right to rectification
You have a right to rectification and/
3. Right to restriction of processing
Under the conditions of Art. 18 GDPR, you may request that the processing of personal data concerning you be restricted – in particular if you contest its accuracy, if the processing is unlawful, if storage is no longer necessary or if you have objected pursuant to Art. 21(1) GDPR. Where processing has been restricted, such data may only be processed further under the strict conditions of Art. 18(2) GDPR. You will be informed before the restriction is lifted.
4. Right to erasure
a) Obligation to erase. You may request the controller to erase the personal data concerning you without undue delay where one of the grounds listed in Art. 17(1) GDPR applies (including the purpose of collection no longer applying, withdrawal of consent, an objection having been lodged, unlawful processing, a legal obligation to erase, or data from information society services pursuant to Art. 8(1) GDPR).
b) Information to third parties. Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase it, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps to inform other controllers of your request for erasure.
c) Exceptions. The right to erasure does not apply to the extent that processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving, research or statistical purposes pursuant to Art. 89(1) GDPR or for the establishment, exercise or defence of legal claims.
5. Right to notification
If you have exercised your right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to each recipient to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
6. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format and to transmit it to another controller, provided that the processing is based on consent or a contract and is carried out by automated means. You also have the right to have the data transmitted directly from one controller to another, where technically feasible.
7. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions.
Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing; this also applies to profiling to the extent that it is related to such direct marketing.
In the context of the use of information society services, you may exercise your right to object by automated means using technical specifications.
8. Right to withdraw consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for entering into, or performance of, a contract between you and the controller, is authorised by Union or Member State law which also lays down suitable measures to safeguard your rights and freedoms, or is based on your explicit consent.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Withdrawal of consent / enquiries to: brandt@surpro.de