Privacy notice for our website

Scope, Data Subject and controller

This Privacy Notice exclusively applies to the collection and processing of Personal Data of users of the Website with the domain hydac.com or affiliated Websites of HYDAC International GmbH. The responsible data controller (i.e. the 'responsible party' in terms of POPIA) for any Personal Data collected and processed in connection with the use of the Website is HYDAC. Should another controller process Personal Data about how you use this Website, you will be provided with a separate privacy notice.

How to contact Us and Our Data Protection Officer

You can contact Us via mail at HYDAC International GmbH, Industriestraße, 66280 Sulzbach/Saar, Germany, or at the following email address: info@hydac.com. You can contact Our data protection officer via mail at the following address: HYDAC Verwaltung GmbH, Data Protection Department, Industriestraße, 66280 Sulzbach/Saar, Germany or at the following e-mail address: privacy@hydac.com.

Categories of Personal Data, purposes of processing and legal bases

Appendix 1 "Personal Data" to this Privacy Notice contains detailed information on (i) the categories of Personal Data We collect from you; (ii) the purposes for which We process these Personal Data; and (iii) the legal bases for the collection and processing of your Personal Data. If processing for another purpose takes place, We will provide you with additional information.

Recipients and categories of recipients of the Personal Data

We share your Personal Data with other entities of the HYDAC Group. We use internal and third-party service providers to provide services and products on Our behalf and We will share your Personal Data with them for the provision of the services and products. Within HYDAC and such recipients any access to your Personal Data in relation to your use of the Website is restricted to those individuals who have a 'need to know' in order to fulfill their job responsibilities. We share your Personal Data with governmental authorities, courts, external advisors

Data transfers outside the European Economic Area ("EEA") or South Africa

The recipients of your Personal Data are located outside the EEA or South Africa (e.g., USA). By way of entering into appropriate data transfer agreements or by other adequate means, We have established that all such recipients located outside the EEA or South Africa will provide an adequate level of protection for the Personal Data as required by the GDPR and/or POPIA as applicable and that appropriate technical and organizational security measures are in place to protect Personal Data. Any onward transfer is subject to appropriate onward transfer requirements as required by applicable law.

Scope and duration of storage

Your Personal Data are stored by HYDAC and/or Our service providers, strictly to the extent necessary for the performance of Our obligations to you respectively, the performance of the service providers' obligations to Us and strictly for the time necessary to achieve the purposes for which the Personal Data are processed, in accordance with applicable data protection laws. When HYDAC and/or Our service providers no longer need to process your Personal Data, the Personal Data will be erased from the systems and/or records and/or steps will be taken to properly anonymize the Personal Data so that you can no longer be identified from the Personal Data unless We and/or Our service providers need to keep your information

• to comply with legal or regulatory obligations to which HYDAC and/or Our service providers are subject; and/or,
• with regard to a judicial action; and/or;
• are otherwise authorized to retain Personal Data;

Your rights

Under the conditions set out under applicable data protection law (e.g., the GDPR and POPIA), you may have the following rights, which We have categorized based on the applicable data protection law where the right is stipulated:

• Stipulated under the GDPR and under the POPIA: (i) the right of access; (ii) the right to obtain a copy of your Personal Data undergoing processing; (iii) the right to rectification; (iv) the right to restriction of processing; (v) the right to object
• Stipulated specifically under the GDPR: (vi) the right to erasure ("right to be forgotten"); (vii) the right to data portability; (viii) the right to lodge a complaint with the competent data protection supervisory authority;
• Stipulated specifically under the POPIA: (ix) the right to deletion; and (x) the right to lodge a complaint with the Information Regulator via email at POPIAComplaints@inforegulator.org.za.

If you have given your consent to the processing of Personal Data, you may withdraw such consent at any time. Such withdrawal will not affect the lawfulness of the processing that took place prior to the withdrawal of consent.

Use of cookies and similar technologies on the Website
We use cookies and similar technologies on Our Website. You can find detailed information about this in Our Cookie Notice

Personal Data required for the conclusion or fulfillment of the contract
You only have to provide the Personal Data that are marked as mandatory in the respective forms on Our Website. Without this Personal Data, the envisaged contract cannot be concluded or an existing contract can no longer be performed and may have to be terminated. Personal Data that are not marked as mandatory in the corresponding forms on Our Website do not have to be provided.;

2.1Categories of personal data, purposes of processing and legal bases

In Appendix 1 "Personal data" to this privacy policy, you will find detailed information about

• the categories of personal data that you actively provide to Us (e.g. by sending Us an email) and that We collect in addition to other personal data.
• the purposes for which We process these categories of personal data; and
• the legal basis applicable at the time of collection and processing of your personal data.

We also use cookies and similar technologies on our website. You can find detailed information on this at:

Please note that We will only process your personal data for other purposes if:

• We are obliged to do so due to legal requirements (e.g. transmission to courts or law enforcement authorities); if you have consented to the respective processing; or
• if the processing is lawful under other applicable law.
• If processing is carried out for another purpose, We will provide you with additional information.

2.2Recipients and categories of recipients

We transfer your personal data to the recipients and categories of recipients listed below for the respective purposes and to the extent necessary:

Within the companies of the group.

We share your personal data with other companies for the following purposes,

• for the implementation of marketing measures. Such data transfers are carried out on the basis of Art. 6 (1)(a) or (f) GDPR and section 72 of POPIA,
• for the (pre-)contractual execution and fulfilment of your enquiry to the location responsible for you on the basis of Art.6 (1)(f) GDPR and section 72(1)(c) of POPIA.,
• further enquiries to specific companies of the group of companies that have been received via central communication channels

(A list of these other HYDAC Group companies can be found here: https://www.hydac.com/en/locations)

Service providers (internal and external)

We use both external and internal service providers to provide services and products on our behalf and pass on your personal data to them for this purpose.

Our service providers are contractually obliged to process this personal data on our behalf under appropriate instructions, insofar as this is necessary for the respective processing purposes and to protect your personal data appropriately.

Our service providers may not otherwise process or disclose your personal data unless this is permitted by law. We share your personal data with the service providers listed in the "Service Providers" appendix to this Privacy Policy.

Public authorities, courts, external consultants and comparable third parties

• To the extent required or permitted by applicable law to ensure compliance with applicable laws,
• respond to official enquiries or requests from authorities to comply with applicable legal requirements,
• protect the rights, privacy, safety or property of our website visitors, guests, employees or the public,
• to enable us to take possible legal remedies or to prevent or limit possible bad debts or damages that we may suffer,
• enforce the terms of use of our websites (https://www.hydac.com/en/netiquette), and
• to respond to an emergency. Such data transfers are based on Art. 6 para. 1 lit. a), c) or f) GDPR.
• Within the group of companies and the service providers, access to your personal data in connection with your use of the website or other services is restricted to those persons who absolutely need this data to fulfil their professional duties.

2.3Data transfers outside the European Economic Area ("EEA")

Some of the recipients of your personal data are located outside the European Economic Area, where data protection laws may provide a different level of protection than the laws in your country. We will take necessary steps under applicable data protection law to ensure that transfers from the EEA are adequately protected.

By concluding appropriate safeguards based on the standard contractual clauses (2021/914/EU) pursuant to Art. 46 para. 2 lit. c) GDPR or by other appropriate means, which can be obtained on request from the contact information provided in section 2.7, We have ensured that all recipients located outside the EEA provide an adequate level of protection for personal data and that appropriate technical and organisational security measures are in place to protect such data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access and against all other unlawful forms of processing. Any transfer (including to our affiliated companies outside the EEA) is subject to the relevant legal requirements.

2.4Scope and duration of storage

Your Personal Data are stored by HYDAC and/or Our service providers, strictly to the extent necessary for the performance of Our obligations to you respectively, the performance of the service providers' obligations to Us and strictly for the time necessary to achieve the purposes for which the Personal Data are processed, in accordance with applicable data protection laws.

When HYDAC and/or Our service providers no longer need to process your Personal Data, the Personal Data will be erased from the systems and/or records and/or steps will be taken to properly anonymize the Personal Data so that you can no longer be identified from the Personal Data. However, We and/or Our service providers need to keep your information to comply with legal or regulatory obligations to which HYDAC and/or Our service providers are subject. Further, if a judicial action is initiated, the Personal Data will be stored until the end of such action, including any potential periods for appeal.

Insofar as a more detailed description is possible, you will find detailed information in Appendix1 "Personal Data"to this Privacy Notice.

2.5Your statutory rights

If you have declared your consent to any Personal Data processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

In accordance with applicable data protection laws (such as the GDPR and POPIA), you may have the following rights which you may exercise by contacting Us as stated in in Section 2.7, which We have categorized based on the applicable data protection law where the right is stipulated:

Stipulated under the GDPR and under the POPIA:

Right to information:

You have the right to obtain information as to whether and, if so, which of your personal data is processed by Us. The right of access includes, among other things, information about the purposes of the processing, the categories of personal data concerned and the recipients and categories of recipients of the personal data. However, this is not an unlimited right and the interests of other persons may restrict your right of access. You also have the right to receive a copy of the personal data that is the subject of the processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.

Right to rectification:

You have the right to request the rectification of inaccurate personal data concerning you. Depending on the purpose of the processing, you have the right to have incomplete personal data completed, which can be done by submitting a supplementary declaration.

Right to erasure ("right to be forgotten"):

In certain circumstances, you have the right to request the erasure of personal data concerning you and We may be obliged to erase such personal data for certain reasons.

Right to restriction of processing: Under certain circumstances, you have the right to request that We restrict the processing of your personal data. In this case, the data in question will be labelled and may only be processed by Us for certain purposes.

Right to restriction of processing:

Under certain circumstances, you have the right to request that We restrict the processing of your personal data. In this case, the data in question will be labelled and may only be processed by Us for certain purposes.

Right to data portability:

In certain circumstances, you have the right to receive the personal data concerning you, which you have provided to Us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another organisation without hindrance from Us.

Right to object:

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data by Us where such processing is necessary for the purposes of the legitimate interests pursued by Us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where the data subject is a child, including profiling based on those provisions. We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If your personal data is processed for direct marketing purposes where this is permitted without your prior consent, you also have the right to object at any time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing. In this case, your personal data will no longer be processed by Us for these purposes.

Right to lodge a complaint:

In addition to the above rights, you also have the right to lodge a complaint with the competent data protection supervisory authority.

2.6Personal data required for the conclusion or fulfilment of the contract

You only need to provide the personal data that We require to enter into and conduct a business relationship with you or that We are legally obliged to collect. Such personal data is labelled as mandatory information in the respective fields on Our website. Without this personal data, We will not be able to conclude the requested contract or - if you remove it at a later date - We will no longer be able to fulfil an existing contract and may have to terminate it.

Personal data that is not marked as mandatory in the corresponding fields on Our Website does not have to be provided.

In the following cases, We can only provide Our service and/or conclude a contract if You provide Us with the relevant data records:

• Purchase contracts: Company data (address, contact details, registration number, etc.), contact person (title, surname, first name, telephone and extension, e-mail address, position, department, location);
• Newsletter subscriptions: e-mail address, title, surname, first name, interests (industries, trends and topics) Further information on our newsletter can be found in Appendix 1 "Newsletter" to this privacy policy.

This privacy policy may be subject to change - e.g. due to the implementation of new technologies or the introduction of new services or functions. We reserve the right to amend or supplement this privacy policy at any time. We will publish the changes on https://www.hydac.com/privacy-policy.

5.1 Personal Data

We process the following personal data in connection with your use of the website, as follows:

5.2 Service Provider

Depending on the purpose of the processing for which we use the respective service provider, we share certain personal data (where necessary) with the following service providers:

1. maxcluster GmbH, Technologiepark 8, 33100 Paderborn, E-Mail: info (at) maxcluster.de als Hosting Provider.
2. KERN GmbH, In der Kölling 7, 66450 Bexbach as part of the dispatch of postal mailings
3. GuestOne GmbH, Hofaue 3942103 Wuppertal for guest management at events
4. LegalTegrity GmbH, Platz der Einheit 2, 60327 Frankfurt as the operator of the whistleblower system

5.3 Processing for video surveillance

We process the following personal data in connection with the monitoring of our work areas, properties or buildings, if marked accordingly on site