Privacy notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

DR Deutsche Recycling Service GmbH
Bonner Straße 484–486
50968 Köln
Germany

E-mail: info@clearosystems.com
Telephone: +49(0)221 99967800 - 0

Our data protection officer is Ms Rechtsanwältin Nicole Motiee Tehrani, ap-datenschutz GmbH, Hohenstaufenring 8, 50674 Köln, e-mail: info@ap-datenschutz.de.

2. Overview: which data do we process?

This website is an information service on the EPR and environmental compliance obligations of companies selling products in the Netherlands. When you visit the website, we process personal data only to the extent that this is technically necessary — essentially the technical access data generated when the website is called up (server log files, section 4) — as well as the data you provide when contacting us directly by e-mail or telephone (section 5) or via the contact form (section 6). In addition we measure how the website is used (section 7): with your consent via Google Analytics 4 and via HubSpot, and without any consent — because it is cookieless and cannot recognise you — via an aggregated reach measurement.

3. Cookies and consent

Cookies are small files stored on your device. Storing information on your device, or accessing information already stored there, requires your prior consent unless it is strictly necessary to provide the service you requested (§ 25 Abs. 1 and Abs. 2 Nr. 2 TDDDG; for visitors in the Netherlands, art. 11.7a Telecommunicatiewet).

We therefore ask you before anything non-essential is loaded. When you first open this website, a cookie banner appears and no analytics service is contacted until you have answered it. You canaccept, decline, or open the details and decide per service. Declining is as easy as accepting, and it costs you nothing: the entire website works either way.

Strictly necessary and therefore not subject to consent: we store the choice you make in the banner in your browser's local storage (key clearo-cookie-consent), so that you are not asked again on every page. It contains your decision and its date, no identifier and nothing about you, it is never transmitted to us or to a third party, and it is exempt under § 25 Abs. 2 Nr. 2 TDDDG. You can delete it at any time through your browser settings, after which you will be asked again.

Consent-based: Google Tag Manager and Google Analytics 4 (section 7.1) and the HubSpot tracking code (section 7.2). Each is a separate row in the banner, so you can allow one and refuse the other, and neither is loaded before you have agreed to it.

Withdrawal: you can change or withdraw your decision at any time with effect for the future, using the "Cookie settings" link in the footer of every page. Withdrawing takes effect immediately; the lawfulness of the processing carried out up to that point remains unaffected (Art. 7(3) GDPR).

4. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA ("Vercel"). When the website is called up, Vercel automatically processes information on our behalf in so-called server log files, which your browser transmits:

• IP address of the requesting device,
• date and time of access,
• page called up / name of the file retrieved,
• volume of data transferred and HTTP status code,
• browser type and version, operating system,
• referrer URL (previously visited page).

The processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision, the stability and the security of the website (including the defence against attacks). The log data is not merged with other data sources and is automatically deleted after a short time.

We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the EU Commission (Art. 45 GDPR). In addition, EU standard contractual clauses (Art. 46(2)(c) GDPR) are used. We serve fonts, images and other static resources from our own servers; no fonts from third-party providers (e.g. Google Fonts) are loaded. The only third-party scripts on this website are the spam protection on the contact form (section 6) and, exclusively after your consent, the web analytics described in section 7.

5. Contact by e-mail or telephone

When you contact us by e-mail, we store your e-mail address, your name and — if you provide it — your telephone number. The sole purpose of this storage is the contact itself, in order to answer your questions. The legal basis is our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR).

When you reach us by telephone via a number stated on the website, your telephone number — provided caller ID is activated — is displayed in full on our end devices and stored in our telephone system as an incoming call together with the respective call duration. The stored data is accessible only to a small, defined group of people within our company and is deleted regularly. The storage is based on our legitimate interest in reviewing the cost efficiency of our communication structure (Art. 6(1)(f) GDPR).

6. Contact form and spam protection

Our contact page provides a contact form. If you use it, we process the data you enter there: first name, surname, e-mail address, your message and — if you provide them — company and telephone number. We use this data solely to handle your enquiry and to contact you about it. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a possible contract, and otherwise our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR). Sending the form requires your express confirmation that we may process the data entered for this purpose. Your enquiry is transmitted to the enquiry-management system we use for handling contact requests, operated for us by a service provider bound by a data processing agreement pursuant to Art. 28 GDPR.

To protect the form against automated abuse we use the verification serviceCloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"). When you use the form, Turnstile processes technical information about your device and browser (including the IP address) to distinguish human visitors from automated programs. Turnstile does not set cookies and is used exclusively for this protection purpose. The legal basis is our legitimate interest in protecting the form against abuse and in the security of the website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the EU Commission (Art. 45 GDPR).

7. Web analytics

We want to know which pages of this website are read and which links are followed, so that we can improve the content. We use three services for this. They differ fundamentally, and so does what we need from you.

7.1 Google Tag Manager and Google Analytics 4 — only with your consent

Subject to your consent we use Google Tag Manager and, loaded through it, Google Analytics 4, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Tag Manager is an administrative tool that loads the analytics tags; it performs no analysis of its own and sets no cookies of its own. Google Analytics 4 is the analytics service.

Neither service is loaded before you have agreed in the cookie banner. If you decline, or simply do not agree, no connection to Google is established at all — not even to load the program code.

Once you have consented, the following data is processed:

• the pages you call up, and when,
• how you reached the website (referrer URL, search terms where transmitted),
• interactions with buttons and links — specifically which of our calls to action you use and at which position on the page they were shown, and whether the contact form was successfully sent (never its content),
• approximate location (country/region level, derived from a shortened IP address), browser, operating system and device type,
• a randomly generated identifier in the cookies below, by which your browser is recognised on a return visit.

Google Analytics 4 stores this information using the following cookies on your device:

What we have switched off. We transmit to Google the signal that only measurement is permitted ("Consent Mode"). The signals for advertising, advertising personalisation, sharing user data for advertising purposes and content personalisation remain deactivated. We do not run advertising, remarketing or conversion tags, we have not linked Google Analytics to a Google Ads account, and we do not use Google Signals or cross-device tracking. Google Analytics 4 does not log or store IP addresses: the IP address is used only to derive the approximate location and is then discarded. We do not merge the analytics data with other data sources, and we never transmit your name, e-mail address, telephone number or the content of your message to Google.

Legal basis for storing and reading the cookies is your consent under § 25 Abs. 1 TDDDG (in the Netherlands: art. 11.7a Telecommunicatiewet), and for the subsequent processing of the personal data your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via "Cookie settings" in the footer; this does not affect the lawfulness of processing carried out beforehand.

Transfer to third countries. Our contractual partner is Google Ireland Limited in the EU, with which we have concluded a data processing agreement pursuant to Art. 28 GDPR. Processing may nevertheless also take place on servers of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under theEU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision of the EU Commission (Art. 45 GDPR); in addition, EU standard contractual clauses (Art. 46(2)(c) GDPR) are used. You should be aware that US authorities may, under certain conditions, be able to access such data.

Storage period. The cookies expire after the periods stated in the table. The event and user data collected in Google Analytics is deleted automatically after 14 months at the latest.

Further information on Google's handling of data is available in Google's privacy policy atpolicies.google.com/privacy. Independently of our banner, you can prevent collection by Google Analytics with the browser add-on available attools.google.com/dlpage/gaoptout.

7.2 HubSpot — only with your consent

Subject to your consent we use the tracking code of HubSpot, the customer relationship management (CRM) system in which we handle enquiries. For visitors in the European Economic Area the contracting entity is HubSpot Ireland Limited, Dublin, Ireland, a subsidiary of HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA ("HubSpot"), which processes the data as our processor under a data processing agreement pursuant to Art. 28 GDPR. The account used for this website is hosted in HubSpot's EU data region (Frankfurt am Main, Germany).

The tracking code is not loaded before you have agreed to it in the cookie banner. It is a separate choice from the one about Google in section 7.1: you may allow one service and refuse the other. If you decline, no connection to HubSpot is established and none of the cookies below is set.

Once you have consented, the following data is processed:

• the pages you call up on this website, and when,
• how you reached the website (referrer URL) and which website you go to next,
• technical information about the request (IP address, browser, operating system, device type),
• a randomly generated identifier in the cookies below, by which your browser is recognised on a return visit.

What this is for, in plain terms. Besides counting visits, the identifier allows us to see which pages someone read beforethey contacted us — so that we can tell which content actually helps businesses with their EPR questions. It only ever becomes connected to a person if you contact us yourself and thereby give us your data.

HubSpot stores this information using the following cookies on your device:

What we do not do with it. We do not use HubSpot on this website for advertising, remarketing or the building of advertising audiences, and we do not merge the data with other data sources. The contact form on this website does not submit to HubSpot: it is sent to our own server and from there to our enquiry-management system (section 6). Declining HubSpot therefore has no effect whatsoever on your ability to contact us.

Legal basis for storing and reading the cookies is your consent under § 25 Abs. 1 TDDDG (in the Netherlands: art. 11.7a Telecommunicatiewet), and for the subsequent processing of the personal data your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via "Cookie settings" in the footer; this does not affect the lawfulness of processing carried out beforehand.When you withdraw, we delete the four cookies named above from your device and the tracking code is not loaded again.

Transfer to third countries. The data is held in the EU data region. Processing may nevertheless also take place at HubSpot, Inc. in the USA, for instance for support and maintenance. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision of the EU Commission (Art. 45 GDPR); in addition, EU standard contractual clauses (Art. 46(2)(c) GDPR) are used. You should be aware that US authorities may, under certain conditions, be able to access such data.

Storage period. The cookies expire after the periods stated in the table.

Further information on HubSpot's handling of data is available in HubSpot's privacy policy atlegal.hubspot.com/privacy-policy.

7.3 Aggregated reach measurement without cookies

Independently of your consent decision we use Vercel Web Analytics, a service of our hosting provider Vercel Inc. (address in section 4), to count page views. This service is deliberately built without cookies: it stores no information on your device and reads none from it, sets no identifier, and creates no profile. From the request it derives an aggregated, anonymous statistic (page, referrer, country, device class) from which no conclusion about your person can be drawn, and it is used for no purpose other than this statistic.

Because no information is stored on or read from your device, § 25 Abs. 1 TDDDG does not apply and there is nothing here for you to consent to — which is why the service is declared in the banner rather than offered as a choice. The legal basis for processing the technical request data is our legitimate interest in a statistically sound assessment of the website's reach and in its needs-based development (Art. 6(1)(f) GDPR). You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR, section 10).

8. Recipients and transfers to third countries

External recipients are the processors named in sections 4, 6 and 7. Insofar as a processor processes data in the USA, the transfer is based on the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and/or on EU standard contractual clauses (Art. 46(2)(c) GDPR).

9. Retention period

We store personal data only for as long as is necessary for the purposes stated or as long as statutory retention obligations (in particular §§ 147 AO, 257 HGB) exist. After that, the data is deleted.

10. Your rights

You have the following rights against us with regard to the personal data concerning you:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent given (Art. 7(3) GDPR) with effect for the future.

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

An informal message to info@clearosystems.com or to our data protection officer (info@ap-datenschutz.de) is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). A list of data protection officers and their contact details is available via the following link:www.bfdi.bund.de.

11. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

12. Obligation to provide data

The provision of personal data is neither required by law nor by contract. You can visit our website without actively providing data; without the technical data named in section 4, however, delivery of the website is not possible.

13. Changes to this privacy notice

We adapt this privacy notice when the legal situation or our processing activities change. The version published on this page at the time applies.