Data privacy information for the CLAAS Collection Shop

As at 07/06/2024

CLAAS Service and Parts GmbH (“CLAAS”) uses the following data privacy statement to inform you about how it processes your personal data on the CLAAS Collection Shop website collection.claas.com.

Content of this Data Privacy Information

A. General Data Privacy Information

B. Specific data privacy information for the provision of our website for the general public

C. Specific data privacy information for the processing of orders in the shop

D. Specific data privacy information for the provision of special functionalities and services for registered users

E. Specific data privacy information for the processing of (general) enquiries and complaints and related communication (e.g. request for information, order, or support, callback request)

F. Specific data privacy information for direct marketing (including customer satisfaction surveys, market and opinion research)

A. General Data Privacy Information

I. Controller's name and contact details

The controller is:

CLAAS Service and Parts GmbH
Mühlenwinkel 1
33428 Harsewinkel
shop@claas.com

II. Contact details of the data protection officer

The data protection officer can be contacted at:

CLAAS KGaA mbH
Attn: The Data Protection Officer at CLAAS Service and Parts GmbH
Mühlenwinkel 1
33428 Harsewinkel, Germany
group.dpo@claas.com

III. Storage period

CLAAS stores your personal data for only as long as is necessary to achieve the purpose of their collection or processing. To the extent necessary, CLAAS stores your data for the duration of the business relationship. This encompasses, in particular, the establishment and performance of the contract.

In addition, CLAAS stores your personal data to the extent and for the duration necessary for compliance with contractual or legal obligations. For instance, we process your data for compliance with commercial or tax law obligations concerning documentation and storage. The periods of retention or documentation stipulated in these regulations are six years under commercial law pursuant to Section 257 of the German Commercial Code (HGB) and up to ten years under tax law pursuant to Section 147 of the German Fiscal Code (AO). The periods begin at the end of the calendar year in which the document was created.

When the data are no longer required for compliance with contractual or legal obligations, they are ordinarily erased unless you have given CLAAS your consent to process your data and/or further processing is necessary based on CLAAS' legitimate interests, e.g., to win back customers or for defense of legal claims in legal disputes. When data are processed for defense against legal claims in legal disputes, the storage period also depends on the statutory limitation periods. According to Sections 195 et seq. of the German Civil Code (BGB), these can be up to 30 years whereby the regular limitation period is 3 years beginning at the end of the calendar year in which the claim arises. In this case, the processing is restricted, i.e., limited to the minimum which is necessary and blocked for other purposes.

The above shall not apply if anything to the contrary is specified in the specific data privacy information.

IV. Categories of recipients

1. Processor (Article 28 GDPR): Service providers commissioned by CLAAS who support CLAAS in the execution of the business relationship are granted access to the data. These are companies in the following categories: hosting providers, tracking service providers, web agencies, IT services, consultants, service providers in the areas of first, second, and third level support, call center services, customer administration, lettershops, marketing, media technology, compliance, telecommunications, CRM, and lead management. Refer to the specific data privacy information for each case insofar as other categories of processors are used.
2. Transfer to third parties: We shall also transfer your data to third parties if this is permitted by legal or contractual provisions and/or you have given your consent. On this condition, the data can be transferred to the following categories of recipients: Public bodies and institutions (such as the public prosecutor's office, police, tax authority, data protection supervisory authority) to process official requests provided that this is in your interest or we are legally obligated to do so. The legal basis for this is Article 6(1) 1 f) or c) GDPR.
3. Transfer of data within the CLAAS Group: We transfer your data to other companies within the CLAAS Group or grant them access to your data. Where we do so for administrative purposes, such transfer is based on our legitimate interest in internal administrative purposes and Group reporting. The legal basis is Article 6(1) 1 f GDPR. Where it is necessary for the initiation of a contract upon your initiative or for the fulfilment of contractual obligations, or the data are transferred with your consent, the legal basis is Article 6(1) 1 b GDPR or Article 6(1) 1 a GDPR. Where we are entitled to transfer the data by law, the legal basis is Article 6(1) 1 c GDPR. Please refer to the specific data privacy information concerning any other transfer of data to third parties.
4. Third parties with whom we have an ongoing business relationship: Where the transfer of data is necessary for the implementation of steps prior to entering into a contract, for compliance with contractual obligations or takes place with your consent, the legal basis is Article 6(1) 1 b GDPR or Article 6(1) 1 a GDPR. Where we are obliged to transfer the data by law, the legal basis is Article 6(1) 1 c GDPR.

V. Transfer to third countries

Data will be transferred to third countries (countries outside the EU or the European Economic Area – EEA) if, for example, this is:

• for the performance of a contract to which you are a party or in response to your enquiries,
• if necessary to safeguard our legitimate interests,
• if required by law or if you have given your consent,
• for contract processing purposes where service companies are involved.

In cases where no decision of the European Commission exists regarding a level of privacy that adequately meets European privacy requirements in the relevant country, we ensure via appropriate contracts that your rights and freedoms are properly safeguarded. Such an agreement either ensures that there is an adequate level of privacy on the part of the recipient of the data or that standard contractual clauses of the European Union are agreed with the recipient or that transfer is on the basis of your express consent. You may withdraw your consent at any time with effect for the future (cf. Part A. VII). We will provide you with more detailed information at no cost if you send us a request using the contact details provided above.

Kindly take note that the following risks exist insofar as we use your consent as the sole basis for processing by recipients that do not provide an adequate level of data privacy: there may not be sufficient rules for the adequate protection of your personal data; there is no supervisory authority for data privacy; the exercise of your data privacy rights may be difficult or disregarded; there are no controls over the processing and transfer of data to third parties.

You can find further details in the specific data privacy information.

VI. Obligation to provide personal data

Unless otherwise specified in the specific data privacy information, you are under no legal or contractual obligation to provide your data.

VII. Rights of the data subject

According to Article 15 GDPR, you have a right of access to the stored data concerning yourself. Should incorrect personal data have been processed, you have the right to rectification according to Article 16 GDPR. If the legal requirements are met, you can demand erasure of your personal data or restriction of their processing and lodge an objection to the processing of your data (Articles 17, 18, and 21 GDPR). According to Article 20 GDPR, you can enforce your right to data portability with regard to the data which are processed by automated means based on your consent or on a contract with you.

Information regarding your right to object in accordance with Art 21 GDPR

1. You have the right to object on grounds relating to your particular situation at any time to the processing of personal data concerning you which is based on Article 6(1) 1 f GDPR (data processing based on a balancing of interests). Where you lodge an objection, CLAAS will no longer process your personal data unless CLAAS can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or the processing serves the establishment, exercise, or defense of legal claims.

2. CLAAS processes your personal data for the purpose of direct marketing. You have the right to object at any time to the processing of data concerning you for the purpose of such advertising. If you object to processing for direct marketing purposes, CLAAS will no longer process your personal data for these purposes. The objection can be made informally and should preferably be addressed to: privacy@claas.com.

Right to withdraw your consent in accordance with Article 7(3) GDPR

Where you have given your consent to the processing of your personal data, you have the right to withdraw this consent at any time. Withdrawal of consent does not require any specific form and may be sent to the contact addresses provided in Part A. II. Should CLAAS provide additional options for withdrawing consent (e.g., unsubscribe link in every newsletter email) you will be advised of this in the specific data privacy information.

You can exercise your rights vis-à-vis CLAAS using the contact details provided in Part A. II. but wherever possible by sending notices to privacy@claas.com.

If you believe that any processing of your data infringes data privacy law, you have the right to lodge a complaint with a supervisory authority for data protection of your choice (Article 77 GDPR).

You can of course also submit a complaint to the CLAAS data protection officer at any time (group.dpo@claas.com).

If you exercise data subject rights under data protection law, we will process your data to fulfil our legal obligations in accordance with Article 6(1) 1 c GDPR in conjunction with Articles 15–22, 12 (3–6) GDPR and Article 7(3) GDPR. This includes processing your data for the purpose of clearly identifying the data subject affected by the data processing and requesting additional information to confirm your identity. We transfer data concerning data subjects to data recipients within the meaning of Article 19 GDPR where this relates to requests for rectification or erasure of data or restriction of processing (Articles 16, 17(1), 18 GDPR) and to the extent necessary to enable you to exercise your rights effectively (Article 6(1) c and f GDPR) and to notify you as the data subject (Article 12 GDPR). We do this based on our legal obligation according to Article 12(6) GDPR.

B. Specific data privacy information provision of our website to the general public

I. Provision of our website to the general public

When you use the website for informational purposes only, i.e., if you do not register or otherwise provide CLAAS with information (e.g., via a contact form), CLAAS only collects the personal data that your browser sends to our server. The collection of data is technically necessary in order to be able to show you the website. The legal basis is Article 6(1) 1 b GDPR. Storage of data in log files even after your visit is necessary to ensure the functionality of the website and the security of the information technology systems. The legal basis for data processing is Article 6(1) 1 f GDPR. You can object to data processing based on legitimate interests at any time with effect for the future (cf. Part A. VII). The aforementioned purposes constitute our legitimate interest in data processing.

The following categories of data are collected when you visit the website: usage and traffic data, technical documentation, and protocol data, e.g.:

• date and time of access
• time zone difference to Greenwich Mean Time (GMT)
• IP address
• host name of the accessing computer
• referrer website
• websites that are accessed via the website (content of the request)
• pages visited on the website
• notification of whether the access was successful
• volume of data transferred
• information about the browser type, language, and version used
• operating system

The data are erased as soon as they are no longer necessary for the purpose for which they were collected. With regard to the provision of the website, this is the case at the end of each session. If data are stored in log files, this is the case after 30 days at most. The data are not stored together with other personal data of yours.

II. Use of services (e.g., cookies, analytical, and remarketing tools)

CLAAS uses services (e.g., cookies, analysis tools, and remarketing tools) on this website. CLAAS uses these services to store information on your device (e.g., in your browser) and/or access information that is already stored on your device. This information may include personal data as well as data that is not related to a specific person. Where applicable after storing or accessing the information, personal data may be processed further in accordance with your choice of category.

CLAAS uses the following services in the following categories:

If the use of the service (i.e., storing information on your device and/or accessing information stored on your device) is required for a technical reason, the legal basis for this is Section 25(2) of the German Telecommunications Telemedia Data Protection Act (TTDSG) in conjunction with Article 6(1) 1 b, c, f GDPR. This information may include personal data as well as data that is not related to a specific person. If after storing or accessing the information, personal data relating to you is processed, this processing is performed only if it:

• is necessary for the performance of a contract to which you are a party (Article 6(1) 1 b GDPR) or
• is required by law (Article 6(1) 1 c GDPR)
• for the protection of our legitimate interests (Article 6(1) 1 f GDPR).

You can object to data processing based on legitimate interests at any time with effect for the future (cf. Part A. VII). You can delete cookies by means of your browser settings.

The legal basis for the use of the services (i.e., storing information on your device and/or accessing information stored on your device) in the Statistical Analysis, Marketing, and Additional Functions categories is Section 25(1) 1 of the German Telecommunications Telemedia Data Protection Act (TTDSG) in conjunction with Article 6(1a) GDPR subject to your consent. This information may include personal data as well as data that is not related to a specific person. If after storing or accessing the information, personal data relating to you is processed in accordance with your category selection, we process this on the basis of Article 6(1) 1 a GDPR subject to your consent. You have the right to withdraw your consent (see Section A.VII). Withdrawing your consent does not affect the legality of storing information on your device and/or accessing information on your end device or the further processing of personal data in accordance with your choice of category that has been performed with your consent. Your consent is voluntary.

Using the "Change data protection settings" option, you can revoke your consent or make changes to your data protection settings:

Your consent remains valid for six months. After this period expires, we will ask you to renew your consent. We will also ask you to renew your consent to the display of cookie banners if new services are added to this website or if the services are changed in such a way that we need further consent from you to continue providing the services (e.g., in the event of changes in purpose).

Please note that your individual browser settings can potentially prevent your settings (e.g., your consent) from being saved long-term and we shall ask you to reconfirm your consent each time you visit our website.

C. Specific data privacy information for processing orders in the shop

You are welcome to use our shop even without a user account (cf. Part D.). To do so, you have the option of placing orders as a “Guest”. Irrespective of whether you wish to order products in our online shop as a guest or a registered user, the conclusion of a contract necessitates that you provide personal data which CLAAS requires to process your order.

The legal basis for data processing for the processing of your order is Article 6(1) 1 b GDPR.

The data that are required for the order are marked with an asterisk (*) as compulsory data. You can also provide us with additional data:

• personal identification data (e.g. title, first name, surname, street, house number, town/city, post code, country) • contact details (e.g. email address, telephone number)

We use the data you provide to us voluntarily for the purpose of direct marketing. cf. Section G.

In addition to the data you provide in connection with your order, we process usage and traffic data relating to you (e.g. IP address, date and time of your request) as well as technical documentation and log data. We process this data for the purpose of ensuring the safety of IT systems and to log your order. The legal basis is Article 6(1) 1 f GDPR. You have the right to object to data processing at any time, see Part A. VII.

To process your order, we transmit the data that is required in each case to the online payment service PayPal (Europe) S.à r.l. & Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). PayPal processes your data as a separate controller.PayPal’s current Privacy Policy can be accessed on the PayPal website at www.paypal.com. PayPal processes your data as a separate controller.

The data required for delivery or order processing are forwarded to logistics and shipping companies as well. The legal basis for transfer is Article 6(1) 1 b GDPR, i.e. the legal basis for data transfer is Article 6(1) 1 f GDPR. You have the right at any time to object to processing insofar as the legal basis for data processing is Article 6(1) 1 f GDPR, cf. Part A. VII.

D. Specific data privacy information for the provision of special functions and services to registered users I. Completion of registration

To access the CLAAS Collection Shop, which is accessible to registered users only, it is necessary to register with CLAAS ID or log in with an existing CLAAS ID user account. We ensure that, when you use your CLAAS ID user account, you can log in to all online services that use CLAAS ID with the same access data without having to go through the registration process again each time. The legal basis is Article 6(1) 1 b GDPR. We forward your data to the operator of the CLAAS ID user account who is responsible for identity management. This is CLAAS KGaA mbH, Mühlenwinkel 1, 33428 Harsewinkel. The legal basis for usage of the CLAAS ID user account as identity management for the CLAAS Collection Shop is Article 6(1) 1 f GDPR. Our legitimate interest lies in our economic interest in the use of central identity management within the CLAAS Group. You can object to data processing which is based on our legitimate interest at any time with effect for the future, cf. Part A. VII. For the initial registration in the CLAAS Collection Shop, the CLAAS Collection Shop accesses the following data of your CLAAS ID user account: Personal identification data (e.g. surname, first name) and contact details (e.g. email address, telephone number) as well as your electronic identification data (e.g. user name [your email address] and your password) and the country. Your email address and password are your subsequent access data. However, your password cannot be retrieved by CLAAS and is stored in encrypted form on the server of your CLAAS ID user account. We process the country that is stored in your CLAAS ID user account, as we do not provide identical online services in every country. We do so to ensure that we give you access to the website settings available for your country. The legal basis is Article 6(1) 1 b GDPR.

II. Logging in

If you wish to log in to the CLAAS Collection Shop with your credentials, the CLAAS Connection Shop will transfer the log-in process to the operator of your CLAAS ID user account, who will then verify whether you are actually a registered user and transmit the result of the verification (via OAuth2 protocol) to CLAAS. After successful verification, you will have access to the CLAAS Collection Shop. If any data, consent or approvals are still missing for the online service, you may be asked to complete or supplement your details accordingly.

III. Resetting your password

You can use the function “Forgotten your password?” to reset your password. You will be asked to enter your email address. This is to ensure that you are the registered user and that you wish to reset your password. We process the following personal data concerning you when you wish to reset your password: Electronic identification data (email address, password), as well as technical log file and documentation data. The legal basis is Article 6(1) 1 b GDPR insofar as you wish to reset your password. The legal basis is Article 6(1) 1 f GDPR insofar as unauthorized users attempt to use the function. Our legitimate interests are to protect our online services, verify users and prevent access by third parties. You have the right to object to the processing of data at any time, cf. Part A. VII.

IV. Provision of benefits and services to registered users

You have access to benefits and services (e.g. order history) that are reserved for registered users if you are registered with CLAAS Collection and have a user account. The legal basis for data processing is Article 6(1) 1 b GDPR.

E. Specific data privacy information for the processing of (general) enquiries and complaints, as well as related to communication (e.g. request for information, order or support, callback requests).

You have the option of contacting CLAAS using the contact details or contact form provided on this website. We process your personal data in order to manage your request, send you our response or to track a complaint.

This is based on our legitimate interest according to Article 6(1) f GDPR in the management of concerns that you address to us, in the settlement and tracking complaints and in communicating with customers and interested parties. You have the right at any time to object to data processing, cf. Part A. VII. Where processing is necessary to take steps prior to entering into a contract, the legal basis is Article 6(1) 1 b GDPR. We process the data you provide in connection with your contact request in order to respond to your enquiry or concern:

• personal identification data (e.g. title, first name, surname)
• contact details (e.g. email address, telephone number)
• communication content data

Where you use the contact form provided on this website to make contact with CLAAS, the data that are required so that we may contact you are marked with an asterisk (*) as compulsory data.

We also process usage and traffic data (e.g. IP address, date and time of your request). The legal basis for this data processing is Article 6(1) 1 f GDPR, based on our legitimate interest in ensuring the functionality of this website and the security of the IT systems.

We use the data for the purpose of direct marketing, in addition to the management of enquiries and complaints, cf. Part F. of this data privacy information.

Your personal data are stored for the purpose of responding to your enquiry and then erased, unless we are entitled or obliged by law, contract or your consent to store the data for a longer period. Refer to Part A. III. for more details.

CLAAS saves your data in order to best advise you. Your personal data shall be saved for the purposes of responding to your enquiry, and then erased, unless we are legally or contractually obliged to save the data for longer or we are permitted to do so on the basis of your consent. For more detailed information, see Section A.III. of this Data Privacy Information. On the basis of your consent and/or another legally recognized form of permission, including but not limited to our legitimate interest in accordance with Article 6(1) 1 f GDPR, your data can continue to be stored, e.g. for the purpose of customer loyalty or retention and in relation to the defense of legal claims. In the case of your data being processed to defend against legal claims in legal disputes, the storage period shall also be based on the legal limitation periods (e.g. in accordance with civil law and the German Product Liability Act). As regards storage of your data, our technical infrastructure is designed along the basic principles of necessity and purpose limitation. As such, the affiliates and trading partners are granted access to such data as is required for the performance of their tasks. For more detailed information, see Section A.IV.

F. Specific data privacy information for direct marketing (including customer satisfaction surveys, market and opinion research)

CLAAS would like to keep you abreast of the latest and most exciting promotions and new developments regarding CLASS merchandising products. To do so, CLAAS processes your contact details and personal identification data as well as information on your interests for the purposes of direct marketing. Direct marketing also includes customer satisfaction surveys, as well as market and opinion research.

The legal basis for processing your personal data for the purpose of direct postal marketing is Article 6(1) 1 f GDPR. This purpose also constitutes our legitimate interest in data processing. You have the right to object to the processing at any time. For further information on your right to object, refer to Part A. VII of the General Data Privacy information.

Where you subscribe to our newsletter, we process your personal data on the basis of your consent (Article 6(1) 2 a GDPR). We use the double opt-in procedure to subscribe to our newsletter. This means that after you have registered, we will send you an email to the email address provided, in which we ask you to confirm that you are the owner of the email address provided and that you wish to receive the notifications.

In individual cases and only after careful consideration will CLAAS contact you for marketing purposes in relation to CLAAS merchandising products (e.g. offers for additional services, marketing correspondence about products and services, invitations to events such as product launches, market and opinion research, customer satisfaction surveys) via email or telephone/messenger, even when no consent for marketing has been given. The legal basis is Article 6(1) 1 f GDPR. You can object to data processing based on legitimate interests at any time with effect for the future, cf. Part A.VII. Direct marketing based on legitimate interests is only permitted if the applicable legal requirements for this purpose are fulfilled and you have not objected to the processing of your data for the purpose of marketing correspondence and with knowledge of your right of objection on the basis of Article 21 GDPR (cf. Part A. VII. of this data privacy information).

Should you withdraw your consent for marketing purposes and/or object to advertising, the data will no longer be processed for marketing purposes from that point onwards, but will, in accordance with general principles, remain stored with a blocked flag. Part A. III. paragraphs 2 to 4 of the General Date Privacy Information apply analogously.