Privacy Policy

Contact Information for the Data Controller

Hirschbach GmbH
Windmühle 2
D-74429 Sulzbach-Laufen

Phone:. 07976 / 98 60-0
Fax 07976 / 98 60-60
c.hirschbach@hirschbach.de

Contact Information for the Data Protection Officer

Gerd Rückert, External Data Protection Officer
50 Erich-Sailer Street
74206 Bad Wimpfen
Phone: 07063 934815
Email: rueckert@grcon.de

Welcome to our website. Protecting your data is very important to us. That is why we have outlined below how we process your personal data.

General Processing of Visitor Data

In general, you can use our website without providing any personal information.

However, please note that even in this case, access data is collected and stored in the server log files. This includes, in particular, the following data:

• Browser type / Your browser version,
• Operating system,
• the website from which you are visiting us,
• Date and time of the visit,
• Your IP address.

Whenever possible, we analyze this information only in anonymized form to defend against attacks and to improve our services (processing of personal data based on a balancing of interests pursuant to Art. 6(1), sentence 1, lit. f) of the GDPR) and subsequently delete it. The data is generally not traceable back to you personally and is not combined with other data.

However, if there are concrete indications of unlawful use, we reserve the right to analyze the data retroactively.

Our website is hosted by lima-city (TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen). The server log files are stored there on our behalf; we have a contract with the provider for data processing on our behalf in accordance with Article 28 of the GDPR.

Data Categories; Data Sources

In general, we process the personal data that is transmitted in connection with your use of our website or that you provide to us in the context of an inquiry, a pre-contractual legal relationship, or a contractual relationship. In individual cases and to the extent necessary for the performance of the contract, we also process personal data that has been lawfully obtained from publicly accessible sources (e.g., commercial registers, debtors’ registries, the Internet) in a lawful manner or that has been lawfully provided to us by third parties (e.g., credit bureaus).

This may include technical data relating to you (IP address, browser type), personal data (name, date of birth, legal representatives), address data (address, email address, contact person), financial data (account holder’s name, IBAN, BIC), contractual data (contract term, services purchased, cancellations), communication data (correspondence, email exchanges), marketing data (marketing communications), and other comparable categories of personal data.

Processing of Personal Data Based on Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR)

In specific cases, we will obtain your consent for certain purposes that are explicitly stated in connection with the data collection.

In these cases, data processing is carried out exclusively on the basis of your consent. It may be that we cannot process your request without your consent and must therefore make it contingent upon your consent. The data is processed exclusively for the purposes explicitly stated.

You may revoke your consent at any time, effective for the future. The revocation does not affect the lawfulness of the processing that took place prior to the revocation.

Cross-Border Data Transfers (Art. 49(1), first sentence, subparagraph (a) of the GDPR)

If personal data is transferred to a third country, we comply with the applicable data protection requirements by ensuring that the data transfer is based on standard contractual clauses or by obtaining your consent in accordance with Article 49(1), sentence 1, subparagraph (a) of the GDPR.

Data will only be transferred to a third country if you click to play a video on our job listings pages (using the „Vimeo“ service; see below). When you do so, data is transferred to the United States of America. If you do not click the video, no connection to Vimeo will be established.

The transfer of data poses a risk to your personal data. In the United States of America, the level of data protection may not be comparable to that provided by EU law (GDPR) and/or national regulations (e.g., BDSG).

You may revoke your consent at any time, effective for the future. The revocation does not affect the lawfulness of the processing that took place prior to the revocation.

Processing of personal data for the purpose of contract performance or contract negotiations (Art. 6(1), first sentence, subparagraph (b) of the GDPR)

If a contract is concluded with us, we will use personal data to the extent necessary for the performance of the contract or for the implementation of precontractual measures. The purposes of data processing are determined by the specific terms of the contract, which you can find in the contract documents.

If you already have a contract with us, we process your data to verify that you are our contractual partner and to properly fulfill our contractual obligations.

Processing of Personal Data Based on a Balancing of Interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR)

We process personal data after weighing the interests involved, to the extent necessary to protect our interests or the interests of third parties.

Examples of such purposes include:

• Ensuring the IT security and integrity of our systems,
• Prevention or investigation of criminal offenses,
• Asserting or defending legal claims.

Contact Us

If you contact us by email or phone, we process the personal data you provide in order to respond to your inquiry. The legal basis for this is generally Article 6(1), sentence 1, subparagraph (b) of the GDPR; however, in exceptional cases where there is no contractual relationship, Article 6(1)(f) of the GDPR, in which case the legitimate interest lies in properly responding to your inquiry. We will delete the data after your inquiry has been fully processed, provided there is no contractual or legal obligation to retain it.

Contact Form and Request for a Quote

If you send us an inquiry via our contact form or our quote request form, we will process the data you provide based on your consent in accordance with Article 6(1)(a) of the GDPR in order to handle your inquiry. The information is transmitted to us via email and stored on our web server; it is automatically deleted after 6 months. Otherwise, your data will be deleted after your inquiry has been processed, unless there is a contractual or legal obligation to retain it. If you provide us with contract-related information, we will transfer it to our customer management system.

Your IP address is not stored when you submit the forms. To protect against automated spam submissions, we use an invisible verification field; no data is transmitted to third parties in this process.

You may revoke your consent at any time, effective for the future, by contacting us using any of the contact details provided.

Application

To the extent that we process data in connection with your job application, please refer to the Privacy Policy for Job Applicants, Available at this link, as noted.

We process your data—specifically your name, contact information, resume, documentation of your academic, technical, and professional achievements to date, as well as the information you provide in your cover letter—for the purpose of entering into an employment contract. The legal basis for this data processing is Section 26 of the Federal Data Protection Act (BDSG). If your application is not successful, we will store your data for 6 months after the application process has ended. If your application results in a job offer, your data will be stored for the duration of the employment relationship.

Applications submitted via our online form and the documents uploaded with them are stored on our web server. They are not publicly accessible but are available only to authorized individuals after they log in, and are automatically deleted after 6 months. The relevant staff members will receive a notification via email.

We ask that you do not include any particularly sensitive information in your application. This includes data regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data that uniquely identifies a natural person; health data; and data concerning sex life or sexual orientation, see Art. 9(1) of the GDPR. We also ask that you do not include a photograph with your application.

Sending Emails via Emailit

To ensure the reliable delivery of emails triggered by this website, we use the „Emailit“ email delivery service. The provider is FunFirst s.r.o., Na louži 258/13, Vršovice, 101 00 Prague 10, Czech Republic.

The technical connection between our website and Emailit is established via the WordPress plugin FluentSMTP. When an email is sent, the data required for delivery is transmitted to Emailit. This may include, in particular, the sender’s and recipient’s email addresses, any reply-to address provided, names, the subject line and content of the message, as well as technical sending and delivery information. If the message is initiated via a form on our website, the data you enter into the form may also be included in the transmitted email.

Emailit processes this data on our behalf to send the relevant emails, ensure their delivery, and detect technical errors or misuse. Emailit acts as a data processor within the meaning of Article 28 of the GDPR. According to the provider, the mailing data is stored in the European Union.

The legal basis for processing depends on the specific purpose of the communication. If the communication is sent to fulfill a contract or to take steps prior to entering into a contract, the legal basis is Article 6(1)(b) of the GDPR. For general inquiries not related to a contract, as well as for the transmission of messages that are technically or organizationally necessary, processing is based on our legitimate interest in reliable and secure communication pursuant to Article 6(1)(f) of the GDPR. To the extent that processing is based on your consent, Article 6(1)(a) of the GDPR applies. Section 26 of the BDSG applies to the processing of job application data; in addition, please refer to the information in the „Job Applications“ section.

The retention period at Emailit depends on the type of data, the plan used, and the agreed-upon or configured retention periods. Message content and technical delivery logs may be stored for varying lengths of time. The data is deleted as soon as it is no longer required for the stated purposes, provided there are no legal retention obligations. The correspondence stored by us is subject to the deletion periods described in the respective section of this Privacy Policy.

For more information, see the Emailit Privacy Policy.

Cookies

Our website does not set cookies when you visit it and does not use any analytics or tracking tools. Technically necessary cookies are set only for registered editors; these are required for logging into the administrative area (Art. 6(1), sentence 1, lit. f) of the GDPR; § 25(2), No. 2 of the TDDDG).

Fonts and Videos

The fonts used on our website, as well as our promotional video, are loaded from our own web server. No data is transmitted to third parties in the process.

Vimeo

On our job listings pages, we embed videos from the Vimeo service. The provider is Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, New York 10001, USA („Vimeo“).

The videos are not loaded until you click on the thumbnail. No connection to Vimeo is established before that. By clicking, you consent to the processing of your data by Vimeo (Art. 6(1), sentence 1, subparagraph (a) of the GDPR); the transfer of data to the U.S. is based on this consent (Art. 49(1)(a) GDPR). In particular, Vimeo receives your IP address and information about which page you have visited. We embed the videos using the „Do Not Track“ setting, so that, according to Vimeo’s own statements, it does not set cookies to track user behavior.

For more information, please see Vimeo's Privacy Policy: https://vimeo.com/privacy.

Data Sharing

We disclose data to other third parties if and to the extent that we have delegated the performance of tasks to them. Data is disclosed only to the extent necessary to fulfill the delegated tasks.

We work with the following companies:

• TrafficPlex GmbH, Lima-City Webspace, Konsul-Smidt-Str. 90, 28217 Bremen
• FunFirst s.r.o., Emailit email delivery service, Na louži 258/13, Vršovice, 101 00 Prague 10, Czech Republic
• NIRO-Media UG (limited liability), Performance Online Marketing, Kürzstraße 2, 74532 Ilshofen
• Avaya GmbH & Co. KG, Theodor-Heuss-Allee 112, 60486 Frankfurt am Main
• Netzstation Informationstechnik GmbH, Marie-Curie-Straße 19, 73529 Schwäbisch Gmünd

In addition, service providers may be entrusted with tasks in the following areas, for example:

• IT Maintenance
• IT Development
• IT Deployment
• Attorneys

Data is always transferred on the basis of a legal provision or an appropriate contract pursuant to Article 26 or 28 of the GDPR, which ensures compliance with all data protection requirements.

Furthermore, data is disclosed exclusively in the cases provided for by law, such as when there is a legal obligation to provide information to law enforcement authorities. In such cases, the disclosure of data is authorized under Article 6(1), sentence 1, subparagraph (c) of the GDPR.

Data Transfer to a Third Country

Data will only be transferred to a third country if you play a video on our career pages. In this case, the recipient is Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, New York 10001, USA. This transfer is based on your consent.

If data is transferred to a third country based on consent, without an adequacy decision or other appropriate safeguards being in place, the associated increased risk of data processing in connection with the transfer must be disclosed pursuant to Article 49(1), sentence 1, subparagraph (a) of the GDPR.

Data Retention Period

We will delete your personal data immediately as soon as it is no longer needed to fulfill our contractual and legal obligations or to pursue our legitimate interests.

Personal data is retained during a contractual relationship at least as long as necessary to fulfill contractual obligations and exercise contractual rights. This period may extend beyond the actual term of the contract, as the data may still be relevant after the contract ends due to the statute of limitations. In addition, data may not be deleted until any retention periods required by tax and commercial law have expired.

Rights of Affected Individuals

As a data subject whose personal data is being processed, you have the following rights:

You have the right to request confirmation as to whether personal data is being processed. If this is the case, you have the right to access your personal data and to receive the information specified in detail in Article 15 of the GDPR.

You have the right to request that the controller promptly rectify any inaccurate personal data concerning you and, where applicable, complete any incomplete personal data (Art. 16 of the GDPR).

You have the right to request that the controller immediately erase personal data concerning you if any of the grounds specifically listed in Article 17 of the GDPR apply, e.g., if the data is no longer necessary for the purposes for which it was collected (right to erasure).

You have the right to request that the controller restrict processing if any of the conditions listed in Article 18 of the GDPR are met, for example, if you have objected to the processing, for the duration of the controller’s review.

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that the processing of this data is based on your consent or on a contract and is carried out by automated means (Art. 20 GDPR). When exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller, to the extent that this is technically feasible (right to data portability).

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on our legitimate interest. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims (Art. 21 GDPR).

To exercise your rights, you can contact us at any time using the contact options provided on our website.

Right to Object to Direct Marketing

In certain cases, we process personal data for the purpose of direct marketing. In such cases, you have the right to object at any time to the processing of your personal data for the purpose of such marketing (Art. 21 GDPR).

If you object to the processing of your personal data for direct marketing purposes, your personal data will no longer be processed for those purposes.

You may object at any time, without having to follow any specific format, by using any of the contact options listed in this Privacy Policy or in our Legal Notice.

Right to File a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR). You may exercise this right with a supervisory authority in the Member State where you reside, where you work, or where the alleged infringement occurred. In Baden-Württemberg, the competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information.

For more information, please visit the following link: https://www.baden-wuerttemberg.datenschutz.de/beschwerde/

Of course, you can also contact us directly if you are dissatisfied or have questions about data protection. The quickest way to reach our internal contact person for data protection is via the contact information listed above.

Obligation to Provide Data

There is generally no obligation to provide data. However, providing data may be necessary to use certain features or to enter into a contract. If you do not provide the required data, you will not be able to use certain features or services, or a contract cannot be entered into.

Updates and Changes to This Privacy Policy

This privacy notice is current as of October 2026.

We reserve the right to update this privacy policy as needed to reflect changes in legal and technical developments or in connection with the introduction of new services or products. Should we make any changes to our privacy policy, we will post them directly in this statement on our homepage.