Heilind Electronics Privacy Statement

Privacy Policy

We are very delighted that you have shown interest in our enterprise. Data protection is of a particularly high priority for the management of Heilind Electronics GmbH.

Heilind Electronics GmbH (also referred to in this document as “Heilind”, “we”, “us”, “our”, etc.) acts as the controller responsible for collecting and storing personal data when you visit and use the website on which this Privacy Policy is displayed.

Heilind is a member of a global group of companies that includes the parent company Heilind Electronics, Inc. (based in the USA). Protecting the security and privacy of your personal data is important to us.

To ensure fair and transparent processing of your personal data, and compliance with applicable data protection laws, we provide you with the following information:

1. Heilind’s general commitment to data privacy

The processing of personal data of a data subject shall always be in line with the General Data Protection Regulation (also referred to in this document as “GDPR”), and in accordance with the country-specific data protection regulations applicable to Heilind. By means of this Privacy Policy, our enterprise would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this Privacy Policy, of the rights to which they are entitled.

While our primary infrastructure is located in the European Union, we may engage service providers located in countries outside the EU/EEA, including the United States. In such cases, we ensure that appropriate safeguards, such as Standard Contractual Clauses or adequacy decisions, are in place to protect your personal data.

As the controller, Heilind has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.

2. Definitions

This Privacy Policy is based on the terms used by the GDPR. Our Privacy Policy should be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would like to first explain the terminology used.

In this Privacy Policy, we use, inter alia, the following terms:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

Data subject is any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.

c) Processing

Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

f) Pseudonymization

Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g) Controller or controller responsible for the processing

Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or  Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient

Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

j) Third party

Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

k) Consent

Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

3. Name and Address of the controller

The controller responsible for the collection and processing of your personal data when you visit and use the website is:

Heilind Electronics GmbH
Robert-Bosch-Straße 1
83052 Bruckmühl Germany
Phone: +49 32211216150
Email: info@heilind.eu
Website: www.heilind.eu
VAT: DE 131 190 049
Data Protection Official: Thomas Umina (privacy@heilind.eu )

4. Processing activities and lawful bases

The table below summarizes and outlines the general processing activities and the corresponding legal bases and retention periods related to the collection and processing of your personal data when you visit and use our website:

We minimize data (only what’s needed) and anonymize or pseudonymize where possible.

5. What personal data is collected and/or processed by Heilind?

The description below outlines the general processing activities related to the collection and processing of your personal data when you visit and use our website:

5.1 Web server logs and website security

a) Web server logs

When you visit and use the website of Heilind, the website collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.

When using these general data and information, Heilind usually does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimize the content of our website as well as its advertisement, (3) ensure the long-term viability of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. Therefore, Heilind analyzes anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise, and to ensure an optimal level of protection for the personal data we process. The data of the server log files are stored separately from all personal data provided by a data subject.

b) Website security and performance monitoring

To maintain the availability, confidentiality, and integrity of our website and services, we use third-party service providers for security monitoring and protection, including Web Application Firewall (WAF) and Distributed Denial-of-Service (DDoS) mitigation.

These services may process limited personal data such as IP addresses, device information, and request metadata. One of our key service providers in this area is Imperva, Inc., a company headquartered in the United States, which acts as our data processor under a GDPR-compliant Data Processing Agreement.

While our website infrastructure is hosted within the European Union (Germany), certain security-related traffic may be inspected or logged by Imperva’s infrastructure in the United States. We ensure that any such transfers of personal data are conducted under appropriate safeguards, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission (please see also section 8 below).

5.2 Cookies and Tracking Technologies

A **browser cookie** (also known as an **HTTP cookie** or **web cookie**) is a small piece of data that a web server sends to a user’s web browser. The browser stores it locally and sends it back to the server with subsequent requests to the same site.

We use cookies and similar tech (e.g., pixels) to improve your experience. Essential cookies (e.g., session maintenance) are always on. Non-essentials require consent.

On first visit, our banner lets you accept/reject categories or customize. Manage via browser settings or our Cookie Preferences Tool (CookieYes). Refer to CookieYes  tool on this website for a full list of essential and non-essential cookies. Revoke consent anytime—won’t affect prior processing (Art. 7(3) of the GDPR).

5.3 Ordering products and services on our online webshop

Our website includes an online webshop operated by Heilind, which enables you to order products and services directly online.

To use the webshop, you must register by creating a customer account. For this purpose, we collect and process the registration data you provide (e.g. name, contact details, company name, and login credentials). This information is used to set up and manage your customer account and to provide you with its functionalities, e.g. to save your registration data and settings and to retrieve your order and shipping information.

When you place an order via our webshop, we additionally collect the information necessary to process and fulfill your order (e.g. name, billing and delivery address, telephone number, email address, bank or payment details as well as any further information you provide to us in the course of your order). We process this data to perform our contractual obligations, in particular to deliver the products and services you have ordered and to handle payment and shipping.

We may also process your data to comply with statutory retention obligations (e.g. under commercial and tax law) and, where applicable, to assert or defend legal claims. Where necessary, we share your data with third parties involved in processing your order (e.g. shipping service providers, payment service providers (see Section 18 below), banks, IT service providers), which.

The legal basis for the processing of your personal data is Art. 6(1)(b) GDPR (performance of a contract) and, where we are legally obliged to store certain data, Art. 6(1)(c) GDPR (legal obligation). The provision of your data is necessary to conclude and perform the contract; without it, we cannot process your order.

5.4 Contact possibility via the website

The website of Heilind contains information that enables quick electronic contact to our enterprise, as well as direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If a data subject contacts the controller by e-mail or via a contact form, the personal data transmitted by the data subject are automatically stored. Such personal data transmitted on a voluntary basis by a data subject to the controller are stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties.

Depending on how you contact us, the following registration data will be collected and processed:

• Username
• Company name
• Salutation, title (if applicable)
• First and last name
• Telephone number, fax number
• Email address
• Address
• IP address

 

5.5 Data protection for applications and the application  procedures

The controller may collect and process the personal data of applicants for the purpose of the processing of the application procedure. The processing may also be carried out electronically. This is the case, in particular, if an applicant submits corresponding application documents by e-mail or by means of a web form on the website to the controller. If the controller concludes an employment contract with an applicant, the submitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If no employment contract is concluded with the applicant by the controller, the application documents shall be automatically erased two months after notification of the refusal decision, provided that no other legitimate interests of the controller are opposed to the erasure. Other legitimate interest in this relation is, e.g. a burden of proof in a procedure under the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz – AGG), enacted on 14 August 2006 (BGBI/ I S. 1897), as amended.

6. Routine erasure and blocking of personal data

Heilind processes and stores the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.

If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

7. Your rights under the GDPR

As a data subject in the European Union (or when we process your data under EU jurisdiction), you have the following rights regarding your personal data:

a) Access You can request confirmation on whether we process your personal data and access to that data, along with relevant information. Exercising your rights is free of charge. However, a reasonable fee may apply if your request is excessive, repetitive, or clearly unfounded.

b) Correction You can request that we correct or complete inaccurate or incomplete personal data.

c) Deletion You can ask us to delete your personal data when it is no longer needed, you withdraw consent, you object to processing, or the data was processed unlawfully or must be erased to comply with legal obligations.

d) Restriction You can request that we temporarily limit processing in certain cases – for example, while a dispute about accuracy or lawfulness is being resolved.

e) Portability Where our processing is based on consent or contract and carried out by automated means, you can request a copy of your personal data in a portable format or ask us to transfer it to another provider.

f) Objection You can object to the processing of your data when it is based on our legitimate interests, or for direct marketing. We will stop processing unless we can demonstrate compelling reasons or are legally required to continue. For direct marketing, your objection is always honored.

g) Withdrawal of Consent Where our processing relies on your consent, you can withdraw it at any time. This does not affect processing that occurred before withdrawal.

h) No Automated Decisions You have the right not to be subject to decisions made solely by automated means, including profiling, that have legal or similarly significant effects on you.

i) Notification of Changes If you exercise your rights to correct, delete, or restrict your personal data, and we have shared that data with others, we will inform those recipients where legally required and where it is feasible to do so.

j) Complaint You can lodge a complaint with a data protection authority if you believe your rights have been violated.

To exercise any of these rights, please contact us at privacy@heilind.eu. We may request proof of identity before responding to protect your privacy.

8. Recipients of your personal data and international data transfers

Heilind does not disclose personal data to third-parties unless such disclosure is necessary for the performance of our contractual obligations (Article 6 (1) (b) GDPR), is otherwise permitted by applicable data protection laws, or you have given us your consent.

Your personal data may be disclosed to the following recipients:

8.1 Processors pursuant to Article 28 GDPR

Please note that Heilind is entitled to fully or partially outsource the processing of personal data in the context of data protection law to external service providers who work on our behalf as data processors (Article 4 No. 8 GDPR).

In particular, we use external service providers to provide and operate the website and our respective services in order to (a) host the website and store its back-end database, (b) monitor the performance of the website and detect and resolve problems and errors on the website, (c) provide data reporting and analysis for our internal business purposes, and (d) provide marketing and marketing optimization services.

In all cases, we have entered into data processing agreements with the data processors involved in accordance with Article 28 DSGVO, which stipulate in particular that the data processing will be carried out exclusively in accordance with the instructions of Heilind and in compliance with the applicable data protection laws.

8.2 Other recipients

In addition, we may share your personal data with the following external recipients:

• When you make a purchase on our website, your payment and order information is processed by a third-party payment provider, Braintree. This payment provider may collect personal information from you, including your name, email address, billing address, and payment information in connection with your payment. The payment provider’s use of your personal information is governed by the payment provider’s terms and conditions and privacy policy. We recommend reviewing their privacy policies for more information: Braintree Privacy Policy
• When you make a purchase on our website, your shipping address is processed by third party shipping providers. These shipping companies use your information to ship the products you ordered. The shipping company’s use of your personal information is governed by the shipping company’s terms and conditions and privacy policy.
• We may disclose your information to third parties (e.g., courts or government agencies) to comply with legal obligations, to enforce and/or defend our rights, or to combat fraud on our website.

Please note: Each of the above recipients processes your personal data as an independent controller in the meaning of Article 4 no. 7 GDPR; i.e., Heilind has no influence on how your personal data is processed by these recipients.

You can find out more information about the recipients, by contacting Heilind.

8.3 International data transfers

The processing of your personal data may be carried out by Heilind in a Member State of the European Union (EU) or the European Economic Area (EEA) or, if an adequacy decision pursuant to Article 45 GDPR exists, in a third country outside of the EU or the EEA.

If a recipient is located outside of the EU or the EEA, and no adequacy decision pursuant to Article 45 GDPR exists in such country, Heilind will, where required by law, put in place appropriate safeguards in accordance with the requirements set by applicable data protection law (e.g. the execution of Standard Contract Clauses) to ensure that your personal data is duly protected through the recipient. You can find out more information about these safeguards, and obtain a copy of them, by contacting Heilind.

9. Provision of personal data as statutory or contractual requirement

We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when acting on behalf of their company in the context of entering into or fulfilling a contract with our organization. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded. Before personal data is provided by the data subject, the data subject must contact any employee. The employee clarifies to the data subject whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of non-provision of the personal data.

10. No automated decision-making

We do not use your personal data for any form of automatic decision-making or profiling that produces legal or similarly significant effects as described in Art 22 of the GDPR.

11. Changes to This Policy

We reserve the right to change this Privacy Policy at any time in accordance with the statutory provisions. Changes may, for example, be required for compliance with new statutory provisions, due to new technologies, or in case of new services.

Last Updated: November 2025