Privacy policy

a) The controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states of the European Union as well as other data protection provisions is:

UEBE Medical GmbH
Bgm.-Kuhn-Straße 22
97900 Külsheim
Germany

b) The data protection officer

You can reach the controller's data protection officer as follows:

SiDIT GmbH
Website: www.sidit.de (opens in a new tab)
Email: info@sidit.de

We have designed our privacy policy according to the principles of clarity and transparency. Should anything nevertheless be unclear regarding the use of particular terms, the corresponding definitions can be found in Art. 4 GDPR (opens in a new tab).

a) Processing of personal data under the GDPR

We only process your personal data, such as your first and last name, your email address and IP address, if there is a legal basis for doing so. Under the General Data Protection Regulation, the following provisions in particular come into consideration:

• Art. 6(1)(a) GDPR: The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Art. 6(1)(b) GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Art. 6(1)(c) GDPR: Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Art. 6(1)(d) GDPR: Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
• Art. 6(1)(e) GDPR: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Art. 6(1)(f) GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

At the relevant points of this privacy policy, we always point out once more the legal basis on which your personal data is processed.

b) Consent of holders of parental responsibility under Art. 8(1) sentence 2 alt. 2 GDPR

A holder of parental responsibility must consent to all data processing within this website that requires the consent of a minor who has not yet reached the age of 16. Information on the individual processing operations, their purposes and the categories of data concerned for which the data subject's consent is required can be found in this privacy policy.

You can withdraw your consent at any time by sending a declaration of withdrawal in text form to the controller's contact details. Processing carried out until the withdrawal remains lawful.

c) Processing of information under Section 25(1) TDDDG

We also process information pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) by storing information on your terminal equipment or accessing information already stored on it. This may be personal information as well as non-personal data, e.g. cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. Terminal equipment is any device directly or indirectly connected to the interface of a public telecommunications network for sending, processing or receiving messages, Section 2(2) no. 6 TDDDG.

As a rule, we process this information on the basis of your consent, Section 25(1) TDDDG.

Where an exception under Section 25(2) nos. 1 and 2 TDDDG applies, we do not require consent. Such an exception applies if we access or store the information solely in order to transmit a message over a public telecommunications network, or if this is strictly necessary for us to provide a digital service you have expressly requested. You can withdraw your consent at any time.

We inform you that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The disclosure of personal data is also processing within the meaning of section 3 above. At this point, however, we would like to inform you separately about the disclosure of data to third parties. Protecting your personal data is very important to us. For this reason, we are particularly careful when it comes to passing your data on to third parties.

Data is therefore only passed on to third parties if there is a legal basis for the processing. For example, we pass on personal data to persons or companies that act as processors for us pursuant to Art. 28 GDPR. A processor is anyone who processes personal data on our behalf – in particular under our instructions and control.

In accordance with the requirements of the GDPR, we conclude a contract with each of our processors obliging them to comply with data protection regulations and thus to provide comprehensive protection for your data.

We delete your personal data as soon as it is no longer necessary for the purposes for which it was collected or otherwise processed, and the processing is not required for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

For security reasons and to protect the transmission of confidential content, such as the enquiries you send to us as the website operator, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Our website does not set any cookies. We also only use other technologies that store information on your terminal equipment or read it from there (e.g. your browser's local storage or scripts for audience measurement) where this is strictly necessary (Section 25(2) no. 2 TDDDG) or you have given your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). What matters is not the technology used but whether your terminal equipment is accessed.

Section 10 explains which services requiring consent we use. You can withdraw your consent at any time via the “Privacy settings” link at the bottom of every page. We inform you that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

For each service, this privacy policy states the legal basis on which the data is processed.

To obtain your consent to the use of statistics services (section 10), we use our own consent banner that does not rely on any third-party services. Your choice is stored together with its time in your browser's local storage so that you are not asked again on every page view. If you decline, we ask for your consent again after six months at the earliest. This storage is technically necessary and is based on Section 25(2) no. 2 TDDDG and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent).

You can change your choice at any time via the “Privacy settings” link at the bottom of every page, or reset it by deleting the website data in your browser.

a) External hosting

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). For this reason, all personal data collected on our website is processed on our host's servers unless an external third-party service is integrated. This may include your IP address, email address, communication data or similar. You can find out which specific personal data is involved in the description of the individual functions and services below. Where we use an external third-party service, this is made clear in the description of the respective service or tool.

The content of our website is delivered via Vercel's worldwide server network (content delivery network); your request is usually answered by a server near you. Server-side functions such as processing the contact form run in a data centre in Frankfurt am Main (EU).

The host processes your data only on our instructions and to the extent necessary to provide the services on the website. We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in providing our website reliably and securely (Art. 6(1)(f) GDPR).

Vercel is based in the USA. Where personal data is transferred to the USA, this is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Vercel is certified, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information can be found in Vercel's privacy policy: vercel.com/legal/privacy-policy (opens in a new tab)

b) When you visit the website

When you access our website, the browser on your terminal device automatically sends information to our website's server. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer
• date and time of access
• name and URL of the file retrieved
• website from which access is made (referrer URL)
• browser used and, if applicable, your computer's operating system

We process this data for the following purposes:

• ensuring a smooth connection to the website
• ensuring convenient use of our website
• evaluating system security and stability
• error analysis
• other administrative purposes

The log files are stored by our host and automatically deleted after one day.

The legal basis for the data processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes of data collection listed above. Under no circumstances do we use the collected data to draw conclusions about you personally.

c) Contact form

We provide a form on our website so that you can contact us at any time. To use the contact form, you need to provide a name for a personal salutation and a valid email address so that we know who the enquiry is from and can process it.

If you send us enquiries via the contact form, the information from the form, including the contact details you provide there, as well as your IP address will be processed pursuant to Art. 6(1)(b) and (f) GDPR to take pre-contractual steps at your request or to pursue our legitimate interest, namely conducting our business. To limit abusive repeated submissions, our server uses your IP address only as a hash value and for no more than 10 minutes; in addition, the firewall of our host Vercel (section 9 a) counts form submissions per IP address. So that the same message does not reach us more than once, we also keep a hash value of your email address and message for no more than 10 minutes. Your IP address is not transmitted or stored with your message.

To send and process form messages, we use the Microsoft 365 mailbox of UEBE Medical GmbH. Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) acts as our processor pursuant to Art. 28 GDPR on the basis of the Microsoft Data Protection Addendum; processing generally takes place within the EU Data Boundary. Where, in individual cases, data is transferred to a third country, this is based on the European Commission's Standard Contractual Clauses.

Enquiries and the associated data are deleted no later than 3 months after receipt, unless they are required for a further contractual relationship.

Note: We forward reports of product complaints internally to our quality management to the extent necessary to fulfil statutory market surveillance obligations for medical devices (Art. 6(1)(c) GDPR).

d) Job applications

You can apply to us by email, for an advertised position or speculatively via our careers page. We process the application data you send us (e.g. contact details, cover letter, CV, references and other certificates) solely to carry out the application process and to decide on establishing an employment relationship. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). If you voluntarily provide special categories of personal data (e.g. information about a severe disability), we only process it where this is necessary for exercising rights or fulfilling obligations under employment law (Art. 9(2)(b) GDPR).

Your application reaches us via the Microsoft 365 mailbox of UEBE Medical GmbH (for the processor, see section 9 c). Only the persons involved in the application process have access to your documents. Your data is not passed on to third parties. Please note that emails may not be encrypted throughout their transmission; alternatively, you can send us your documents by post.

If you are hired, we transfer your data to your personnel file to carry out the employment relationship. If you are not hired, we delete your application documents no later than six months after the application process has been completed. Keeping them until then serves to defend against possible claims, in particular under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). We only store your data for longer, for example to consider you for future vacancies, with your express consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Providing your data is voluntary; without it, however, we cannot consider your application.

e) Pharmacy finder

Our pharmacy finder is a service of UEBE Medical GmbH itself, operated at apothekenfinder.uebe.com and embedded on this website. When you open the page, your browser loads the application from this server; in doing so, your IP address and the technical data listed in section 9 b) are processed. We process your search queries (e.g. postcode or town) to show you suitable points of sale. Only if you expressly use the “My location” function and allow this in your browser is your device's location used once for a radius search; it is not stored.

To display the map, your browser loads map tiles from the servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). In doing so, your IP address is transmitted to the OpenStreetMap Foundation. An adequacy decision of the European Commission exists for the United Kingdom (Art. 45 GDPR). Further information: osmfoundation.org/wiki/Privacy_Policy (opens in a new tab)

The legal basis is our legitimate interest in providing you with the search for points of sale, including the map, that you have opened (Art. 6(1)(f) GDPR); for access to your device's location, Section 25(2) no. 2 TDDDG.

We use the statistics service described below on our website. It serves to ensure the continuous optimisation of our website and to design it according to demand.

We only use this service on the basis of your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the “Privacy settings” link at the bottom of every page. Processing carried out until the withdrawal remains lawful.

Vercel Web Analytics

For the statistical analysis of the use of our website, we use Vercel Web Analytics, a service of Vercel Inc. (address, see section 9 a). Vercel Web Analytics does not set any cookies. When a page is viewed, a script in your browser transmits information such as the page viewed, the referrer URL, browser, operating system, device type and country of origin to Vercel. To distinguish visitors, a hash value is formed from request data and discarded after 24 hours; this makes it impossible to recognise visitors across several days or websites. We only receive aggregated statistics.

As the script accesses information on your terminal equipment, it is only loaded after you have given your consent in the consent banner. We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. For the transfer to the USA, see section 9 a. Further information: vercel.com/docs/analytics/privacy-policy (opens in a new tab)

We maintain a company page on the social network LinkedIn. Information on data processing on this page can be found in our separate LinkedIn privacy notice (in German).

On our website, we merely link to LinkedIn; no LinkedIn plugins or scripts are embedded. Data is only transmitted to LinkedIn when you click on such a link.

You have the following rights:

a) Access

Pursuant to Art. 15 GDPR, you have the right to request information about your personal data processed by us. This right of access includes information about

• the purposes of processing
• the categories of personal data
• the recipients or categories of recipients to whom your data has been or will be disclosed
• the envisaged storage period or at least the criteria for determining it
• the existence of a right to rectification, erasure, restriction of processing or objection
• the existence of a right to lodge a complaint with a supervisory authority
• the source of your personal data if it was not collected by us
• the existence of automated decision-making, including profiling, and, where applicable, meaningful information about its details

b) Rectification

Pursuant to Art. 16 GDPR, you have the right to have inaccurate or incomplete personal data stored by us rectified without undue delay.

c) Erasure

Pursuant to Art. 17 GDPR, you have the right to request the erasure of your personal data stored by us without undue delay, unless further processing is necessary for one of the following reasons:

• the personal data is still necessary for the purposes for which it was collected or otherwise processed
• for exercising the right of freedom of expression and information
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right referred to in a) is likely to render impossible or seriously impair the achievement of the objectives of that processing
• for the establishment, exercise or defence of legal claims

d) Restriction of processing

Pursuant to Art. 18 GDPR, you can request the restriction of the processing of your personal data for one of the following reasons:

• You contest the accuracy of your personal data.
• The processing is unlawful and you oppose the erasure of the personal data.
• We no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims.
• You object to the processing pursuant to Art. 21(1) GDPR.

e) Notification

If you have requested the rectification or erasure of your personal data or a restriction of processing pursuant to Art. 16, Art. 17 or Art. 18 GDPR, we will communicate this to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You can request that we inform you about these recipients.

f) Data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.

You also have the right to request the transmission of this data to a third party, provided the processing was carried out by automated means and is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR.

g) Withdrawal of consent

Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. In future, we may no longer continue the data processing based on your withdrawn consent.

h) Complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR.

i) Objection

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR on grounds relating to your particular situation, or where the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to state a particular situation. If you wish to exercise your right of withdrawal or objection, simply send an email to datenschutz@uebe.com.

j) Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for entering into, or the performance of, a contract between you and us,
2. is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
3. is based on your explicit consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in nos. 1 and 3, we implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

Should we change this privacy policy, this will be indicated on the website.