Privacy Policy

Data Protection Policy

Privacy Notice

Data protection is a matter of trust, and your trust is important to us. We respect your privacy. The protection and lawful processing of your personal data are therefore of great importance to us. To ensure that you feel secure when visiting our websites, we strictly comply with the applicable legal requirements when processing your personal data. This Privacy Notice explains how we collect and use your personal data.

I. The controller for the processing of personal data within the meaning of Article 4(7) GDPR is:

TOTO Europe GmbH
Kesselstraße 5-7
40221 Düsseldorf
Germany

Telephone: +49 (0) 211 - 27308-200
Fax: +49 (0) 211 - 27308-202

Email: teu.information(at)toto.com

Managing Director:
Mr. Tatsuhiko Yasaka

Data Protection Officer

If you have any questions regarding data protection, please contact our Data Protection Officer:

Mr. Stefan Kleinermann
Kleinermann & Sohn GmbH
Max-Planck-Str. 9
52499 Baesweiler
Germany

Telephone: +49 (0) 2401 6054-0
E-Mail: dsb(at)das-datenschutz-team.de

II. Scope and Purpose of Data Processing

Provision of the Website

Each time you visit our website, our hosting provider automatically processes information that your browser transmits to the server. This includes, in particular, the IP address of the requesting device, the date and time of access, the page or file requested, the referrer URL, insofar as it is transmitted by your browser, the browser used, the operating system, the user agent and, where applicable, the volume of data transmitted and the notification of successful retrieval or the HTTP status code.

This data is processed in so-called server log files. The processing is carried out to ensure the technical provision of our website and its content, to ensure the security and stability of our information technology systems, and to detect, analyse and prevent attacks, malfunctions and misuse.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interests lie in the secure, stable and functional provision of our online services and in the protection of our information technology systems.

The server log files are stored for 30 Days and are subsequently deleted or anonymised. Longer retention will occur only in individual cases where this is necessary to investigate and prevent specific attacks, to analyse errors, or to establish, exercise or defend legal claims.

For the hosting and technical provision of our website, we use a hosting service provider in Germany. We have entered into an agreement governing the processing of personal data on behalf of the controller with the hosting service provider in accordance with Article 28 GDPR.

We use the TYPO3 content management system for the technical creation and administration of our website.

2. Processing of Personal Data

We process personal data when you use our website, for example when you contact us, enquire about or make use of our products or services, register a user account, participate in events or webinars, apply for a position with us, or otherwise enter into a business or contractual relationship with us.

Personal data means any information relating to an identified or identifiable natural person. Depending on the occasion and purpose of the processing, this may include, in particular, the following categories of data:

Identification and contact details, for example name, address, email address, telephone number, company and job title
Contract, order, delivery, service, complaint and warranty data
Communication data, for example the content of emails, contact form enquiries, letters or telephone notes
Usage and technical data, for example IP address, device and browser information, access times and information regarding the use of our website
Registration and access data, where you create or use a user account on our website
Applicant data, where you apply for a position with us
Information that you voluntarily provide to us in connection with an enquiry, a contractual relationship, registration or other communication

We process personal data only where there is a legal basis for doing so under data protection law. Depending on the relevant processing activity, processing is carried out in particular on the following legal bases:

Article 6(1)(a) GDPR, where you have given us your consent for a specific purpose, for example for the use of certain optional technologies on our website, subscription to a newsletter or inclusion in an applicant pool
Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract
Article 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation to which we are subject
Article 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests include, in particular, the secure and efficient provision of our website and services, the handling of enquiries, communication with prospective customers, customers and business partners, information technology security, the prevention and investigation of misuse, and the establishment, exercise or defence of legal claims.

The specific data processed, purposes, legal bases, recipients and retention periods are set out in the following sections of this Privacy Notice.

Where the provision of personal data is required by law or under a contract, or is necessary for entering into a contract, we will inform you accordingly in the relevant individual case. Without the necessary data, we may be unable to process or perform the relevant service, enquiry or contract, or may only be able to do so to a limited extent.

We delete personal data as soon as it is no longer required for the relevant purposes and no statutory retention obligations or other legitimate grounds for longer retention apply. Further details regarding individual retention periods are set out in the relevant sections of this Privacy Notice.

3. Complaints and Warranty Claims

If you submit a complaint or make a warranty claim, we process the personal data required to review, process and handle your complaint or warranty claim.

This includes, in particular:

Identification and contact details, for example name, address, email address and telephone number
Contract, order and delivery data, for example order number, purchase date and delivery address
Product, service and complaint data, for example product description, serial number, description of the fault, photographs and information relating to the warranty claim or complaint
Communication data, for example the content of correspondence and records of conversations and case handling
Where applicable, data relating to appointment scheduling, collection, repair, replacement or delivery

The processing is carried out to review and handle your complaint, to provide warranty and service-related assistance, to communicate with you and, where necessary, to arrange a repair, replacement, collection or delivery.

The legal basis for the processing is Article 6(1)(b) GDPR where processing is necessary for the performance of contractual warranty or service obligations, or voluntarily assumed warranty or service commitments. Where processing is necessary for compliance with legal obligations, it is carried out on the basis of Article 6(1)(c) GDPR. Where we process data for the establishment, exercise or defence of legal claims, to investigate misuse or for quality assurance purposes, the processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the proper handling of complaints and warranty claims, ensuring the quality of our services and defending against unfounded claims.

Where necessary for handling and resolving the relevant matter, we may transfer your data to TOTO service and repair partners appointed by us, as well as to shipping, freight forwarding and logistics companies. Where such service providers process personal data on our behalf, we have entered into an agreement governing the processing of personal data on behalf of the controller with them in accordance with Article 28 GDPR. Data will only be transferred to other recipients where this is necessary for compliance with legal obligations or for the establishment, exercise or defence of legal claims.

We generally retain data relating to complaints and warranty claims for the duration of the handling of the relevant matter and thereafter for the period during which claims arising from the underlying contractual relationship, statutory warranty rights or a warranty may be asserted. Longer retention will occur only where statutory retention obligations apply or where the data is required for the establishment, exercise or defence of legal claims.

4. Registration and User Account

You have the option to register a user account on our website. In the course of registration, we process the data that you provide in the registration form. This includes, in particular, identification and contact details, such as your name, email address and, where applicable, postal address, as well as registration and access data, such as username, password stored in encrypted form, the date and time of registration, and information relating to the administration of your user account.

To ensure the security of the user account and to prevent misuse, we also process the IP address, the date and time of registration and, where applicable, further technical log data.

Processing is carried out to set up, provide and administer the user account, and to provide the associated content and services. Where the user account is required in order to use certain content or services, processing is carried out on the basis of Article 6(1)(b) GDPR. Where we process data to ensure information technology security, to prevent and investigate misuse, or to establish, exercise or defend legal claims, processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the secure and functional provision of the user account and in protection against misuse.

Where you give us consent in connection with your user account to process your personal data for certain additional purposes, processing is carried out on the basis of Article 6(1)(a) GDPR. You may withdraw any consent you have given at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Where necessary for the provision and administration of the user account, we may transfer your data to information technology, hosting and technical service providers engaged by us. Where such service providers process personal data on our behalf, we have entered into an agreement governing the processing of personal data on behalf of the controller with them in accordance with Article 28 GDPR. Data will only be transferred to other recipients where this is necessary for compliance with legal obligations or for the establishment, exercise or defence of legal claims.

We retain the data relating to your user account for the duration of your registration and use of the user account. Once the user account has been deleted, the data will be deleted unless statutory retention obligations prevent this or retention is necessary for the establishment, exercise or defence of legal claims. This does not affect data that must continue to be retained in order to comply with statutory retention obligations.

You may amend the data stored in your user account yourself at any time, where this is technically possible. You may also request the deletion of your user account. Please note that complete deletion may not be possible where we are required to continue processing data due to statutory retention obligations or for the establishment, exercise or defence of legal claims.

5. Blog and Comment Function

We operate a blog on our website. Where you subscribe to notifications about new blog posts, we process your email address and, where applicable, any further data you provide when subscribing. In addition, we process the IP address and the date and time of subscription and subscription confirmation in order to document your subscription and to protect against misuse.

The processing is carried out in order to send you the requested notifications about new blog posts and to administer your subscription. The legal basis is your consent pursuant to Article 6(1)(a) GDPR. Subscription takes place using a double opt-in procedure. You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link included in each notification or by contacting us using the contact details provided in the legal notice or in this Privacy Notice. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Where necessary for the provision and administration of notifications, we may transfer your data to information technology, hosting and communications service providers engaged by us. Where such service providers process personal data on our behalf, we have entered into agreements governing the processing of personal data on behalf of the controller with them in accordance with Article 28 GDPR.

We retain your data for the duration of your subscription. Following withdrawal of your consent or unsubscribing, we delete your data unless statutory retention obligations or legitimate grounds for further retention apply. In order to demonstrate that consent was previously given, we may retain the data required for this purpose for the duration of the applicable statutory limitation periods.

You may also comment on blog posts published by us. In this context, we process the data you enter, in particular your name or pseudonym, your email address, the content of your comment, the date and time at which the comment is submitted and the IP address of your device. Your email address will not be published. Your name or pseudonym and your comment may be publicly visible on our website once approved by us. Please note that published comments and the information contained in them may also be indexed by search engines.

The processing is carried out to provide and moderate the comment function and to prevent and investigate misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests lie in providing a user-friendly comment function, ensuring a constructive exchange of views and protecting our website and its users against abusive or unlawful content.

Where necessary for the provision and moderation of the comment function, we may transfer your data to information technology, hosting and technical service providers engaged by us. Where such service providers process personal data on our behalf, we have entered into agreements governing the processing of personal data on behalf of the controller with them in accordance with Article 28 GDPR. Data will only be transferred to other recipients where this is necessary for compliance with legal obligations or for the establishment, exercise or defence of legal claims.

We generally retain comments and the associated data for as long as the relevant comment is published on our website. We retain the email address and IP address only for as long as necessary for processing, moderation and the prevention of misuse. Longer retention will occur only where statutory retention obligations apply or where the data is required for the establishment, exercise or defence of legal claims.

6. Cookies and Similar Technologies

We use cookies and similar technologies on our website. Cookies are small text files that are stored on your device. They may be used to provide a website from a technical perspective, store settings, enable certain functions or, where you have given your consent, analyse the use of our website and tailor content or advertising to your interests.

Where cookies or similar technologies are strictly necessary in order to provide you with a service expressly requested by you, the storage of information on your device or access to information already stored on your device is carried out on the basis of Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed in connection with technically necessary cookies, this is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the secure, stable and functional provision of our website and its functions.

Where cookies or similar technologies are not technically necessary, in particular for analytics, marketing or personalisation purposes, the storage of information on your device or access to information already stored on your device is carried out exclusively on the basis of your consent pursuant to Section 25(1) TDDDG. Where personal data is processed in this context, this is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR.

You may change or withdraw your consent at any time with effect for the future via the “Cookie Settings” or the cookie notice banner used on our website. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Details of the cookies and similar technologies used, their providers, purposes, legal bases and retention periods can be found in the Cookie Settings or in the cookie notice provided there.

Cookies and settings are generally assigned to the device and web browser you use. If you use several devices or different web browsers, you may need to set your preferences separately for each device or web browser. You may also delete cookies or restrict their storage through your web browser settings. This may mean that certain functions of our website are not available, or are only available to a limited extent.

Technically non-essential cookies and tracking technologies, in particular for analytics and personalised advertising, require prior consent. The storage of information on, or access to information from, devices is governed independently by Section 25 TDDDG, irrespective of whether personal data is subsequently processed.

Information on the Cookies Used

The following cookies are used on the website:

Cookie type	Cookie name	Validity	Description
Session cookie	PHPSESSID	End of the session	Browser session
Performance cookie Third party cookies	_gat	1 minute	Google Analytics uses this cookie to monitor the request rate of company servers. This cookie tells us which areas of our website need improvement. The _gat cookie does not allow us to personally identify users because it does not collect any personal data.
Performance cookie Third party cookies	__ga	2 years	Google Analytics uses this cookie to distinguish between users when collecting information about accessed websites. This cookie tells us which areas of our website need improvement. The _ga cookie does not allow us to personally identify users because it does not collect any personal data.
Performance cookie Third party cookies	_gid	1 day	Google Analytics uses this cookie to distinguish between users.
Performance cookie Third party cookies	CONSENT	20 years	Google saves this cookie in the event that the user consents to tracking.
Performance cookie Third party cookies	OTZ	1 month	Google provides this cookie to make its services available to you.
Performance cookie	cookieConsent	2 years	This cookie saves the value “CookieOkay” if the user has already actively consented to the use of cookies. This prevents the request for consent to cookies from appearing if the user returns to the website.
Session cookie	be_typo_user	End of the session	Session ID for logged in backend users.

7. Use of Tools and Plugins on Our Website

Cookiebot by Usercentrics

We use Cookiebot CMP, a consent management service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (“Usercentrics”), on our website. Cookiebot enables us to inform you about the cookies and similar technologies used on our website, to obtain, manage and document your consent, and to ensure that, from a technical perspective, services requiring consent are activated only after you have given your consent.

In connection with the use of Cookiebot, we process, in particular, your consent decision, the date and time and scope of your consent or withdrawal of consent, a consent ID, the consent status, the user agent of the web browser used and, where applicable, further technical information. For this purpose, Cookiebot uses a technically necessary cookie or comparable technology to store your selection on your device. The consent ID and consent status are also stored in a consent log in order to enable us to demonstrate that consent has been given. Cookiebot does not use this information to create user profiles or to track users across websites.

The processing is carried out in order to comply with our legal obligations, in particular to demonstrate that valid consent has been obtained, pursuant to Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. Where processing is necessary for the technically secure and functional provision of consent management, it is also carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the legally compliant management of the technologies used on our website. The storage of information on your device or access to information already stored on your device is carried out on the basis of Section 25(2) no. 2 TDDDG.

Usercentrics processes the data on our behalf. We have entered into an agreement governing the processing of personal data on behalf of the controller with Usercentrics in accordance with Article 28 GDPR. Recipients include Usercentrics and, where applicable, sub-processors engaged by Usercentrics, insofar as this is necessary for the provision of the service. According to Usercentrics’ current information, transfers of personal data to countries outside the European Union or the European Economic Area are not envisaged. Should this change in the future, any transfer will take place only where the legal requirements pursuant to Articles 44 et seq. GDPR are met.

The retention period for consent information depends on the Cookiebot configuration and the statutory requirements for demonstrating consent. You can view the cookies and similar technologies used, their providers, purposes, legal bases and retention periods at any time in the Cookie Settings or in the cookie notice provided there. Further information on data processing by Usercentrics is available at: https://www.cookiebot.com/en/privacy-policy/.

Accessibility Widget by Equally AI

We use an accessibility widget provided by Equally AI (“Equally AI”) on our website. The widget provides additional functionality which may support the more accessible use of our website, for example by enabling adjustments to its display and operation.

In order to provide the widget, technical content and scripts are loaded from Equally AI’s servers. In this context, technically necessary connection data may be processed, in particular the IP address, the date and time of access, the page accessed, and information about the browser and device used. Where you make settings in the widget, those settings may also be processed insofar as this is necessary to provide the selected functionality.

Processing is carried out in order to provide a user-friendly and, as far as possible, accessible website and to ensure the technical functionality of the widget, on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in ensuring that our website is accessible, functional and designed to meet users’ needs. Where operation of the widget requires access to information stored on your device or the storage of information on your device, this is carried out pursuant to Section 25(2) no. 2 TDDDG, provided that such access is strictly necessary in order to provide a service explicitly requested by you.

Where personal data are transferred to countries outside the European Union or the European Economic Area in connection with the use of the widget, such transfers will take place only where the legal requirements pursuant to Articles 44 et seq. GDPR are met. Further information on data processing by Equally AI is available at https://www.equally.ai/privacy.

Google Analytics 4

Where you have given your consent via the Cookie Settings, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyse the use of our website and to improve our online offering from both a technical and content perspective.

In this context, the following data are processed in particular: usage data, online identifiers, device and browser information, pages accessed, the referrer URL, interactions on the website and approximate location information. According to Google, IP addresses are not logged or stored in Google Analytics 4; however, they may be processed briefly for technical purposes in order to determine an approximate location.

The processing of data and access to information stored on your device take place exclusively on the basis of your consent, pursuant to Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR. Your consent also covers the processing of the data referred to above for analytics and optimisation purposes. You may withdraw your consent at any time with future effect via the “Cookie Settings”. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Google Ireland Limited processes the data on our behalf. For this purpose, we have concluded a data processing agreement with Google in accordance with Article 28 GDPR. Recipients of the data may include Google Ireland Limited, Google-affiliated companies and service providers engaged by Google, insofar as this is necessary for the provision of Google Analytics.

A transfer of personal data to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU–US Data Privacy Framework (“EU–US DPF”). Where data are transferred to Google LLC or its certified US subsidiaries, the transfer is based on the European Commission’s adequacy decision pursuant to Article 45 GDPR. Where, in individual cases, data are transferred to recipients in third countries for which no adequacy decision exists, the transfer will take place only where appropriate safeguards pursuant to Article 46 GDPR are in place, in particular the standard contractual clauses adopted by the European Commission. According to Google, transfers of personal data from the EEA to Google LLC and its US subsidiaries are based on the EU–US DPF.

User-level and event-level data are retained in Google Analytics 4 for a period of 14 months and are subsequently deleted. This does not affect data whose further retention is necessary in order to comply with statutory retention obligations or for the establishment, exercise or defence of legal claims.

Further information on data processing by Google is available at: https://policies.google.com/privacy?hl=en-GB.

Pinterest Conversion Tracking

Where you have given your consent via the Cookie Settings, we use the Pinterest Tag on our website, a conversion tracking technology provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”).

The Pinterest Tag enables us to determine whether, and to what extent, users take particular actions on our website after clicking on an advertisement placed by us on Pinterest. This serves to measure and evaluate the effectiveness of our Pinterest advertising campaigns, optimise our advertisements and create target audiences for interest-based advertising on Pinterest.

In this context, the following data may be processed in particular: usage data, online identifiers, cookie IDs, the IP address, browser and device information, operating system, user agent, referrer URL, pages accessed, times of access, information concerning interactions on our website and—where configured and triggered by us—information about completed or initiated actions, such as product views, contact enquiries or other conversion events. Where you are logged in to Pinterest, Pinterest may be able to associate the data collected with your Pinterest user account and process it for its own purposes, in particular for the delivery of interest-based advertising.

To the extent that personal data are processed in connection with the collection and transmission of usage or activity data via the Pinterest Tag, Pinterest Europe Ltd. and we act as joint controllers in respect of that processing. The joint processing covers, in particular, the collection of the above-mentioned data on our website and their transmission to Pinterest. Any further processing of the data by Pinterest is carried out in accordance with Pinterest’s privacy policy. You may view the essential content of the joint controller arrangement on Pinterest’s website.

The storage of information on your device or access to information already stored on your device takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG. To the extent that personal data are processed, this is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with future effect via the “Cookie Settings”. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Recipients of the data include Pinterest Europe Ltd. and, where applicable, Pinterest, Inc., Pinterest-affiliated companies and service providers engaged by Pinterest, insofar as this is necessary for the provision and implementation of the Pinterest Tag. A transfer of personal data to Pinterest, Inc. in the United States cannot be ruled out. Pinterest, Inc. is certified under the EU–US Data Privacy Framework (“EU–US DPF”). Where data are transferred to Pinterest, Inc. in the United States, the transfer is based on the European Commission’s adequacy decision pursuant to Article 45 GDPR.

The retention period depends on the specific cookies or comparable technologies used and the configuration of the Pinterest Tag. The retention periods of the technologies used can be found in the Cookie Settings or in the cookie notice provided there. Pinterest states that cookies used by the Pinterest Tag generally have a retention period of up to one year.

Further information on data processing by Pinterest is available at: https://policy.pinterest.com/en/privacy-policy/.

Meta Pixel (formerly Facebook Pixel)

Where you have given your consent via the Cookie Settings, we use the Meta Pixel, formerly known as the “Facebook Pixel”, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), on our website.

The Meta Pixel enables us to determine whether, and to what extent, users take particular actions on our website after clicking on an advertisement placed by us on Facebook or Instagram. This serves to measure and evaluate the effectiveness of our advertising campaigns, optimise our advertisements and create target audiences for interest-based advertising on Facebook and Instagram.

In this context, the following data may be processed in particular: usage data, online identifiers, cookie IDs, the IP address, browser and device information, operating system, user agent, referrer URL, pages accessed, times of access, information concerning interactions on our website and - where configured and triggered by us - information about completed or initiated actions, such as product views, contact enquiries or other conversion events. Where you are logged in to Facebook or Instagram, Meta may be able to associate the data collected with your user account and process it for its own purposes, in particular for the delivery of interest-based advertising.

To the extent that personal data are processed in connection with the collection and transmission of event data via the Meta Pixel, Meta Platforms Ireland Limited and we act as joint controllers in respect of that processing. The joint processing covers, in particular, the collection of the above-mentioned data on our website and their transmission to Meta. Any further processing of the data by Meta is carried out in accordance with Meta’s privacy policy. You may view the essential content of the joint controller arrangement at: https://www.facebook.com/legal/controller_addendum.

Recipients of the data include Meta Platforms Ireland Limited and, where applicable, Meta Platforms, Inc., Meta-affiliated companies and service providers engaged by Meta, insofar as this is necessary for the provision and implementation of the Meta Pixel. A transfer of personal data to Meta Platforms, Inc. in the United States cannot be ruled out. Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework (“EU–US DPF”). Where data are transferred to Meta Platforms, Inc. in the United States, the transfer is based on the European Commission’s adequacy decision pursuant to Article 45 GDPR.

The retention period depends on the specific cookies or comparable technologies used and the configuration of the Meta Pixel. The retention periods of the technologies used can be found in the Cookie Settings or in the cookie notice provided there.

Further information on data processing by Meta is available at: https://www.facebook.com/privacy/policy/.

Google reCAPTCHA

Where you have given your consent via the Cookie Settings, we use Google reCAPTCHA, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on our website.

Google reCAPTCHA is used to verify whether entries submitted through forms on our website are made by a natural person or improperly by automated programmes. This is intended to safeguard the security of our website and the functionality of our forms, and to prevent misuse, in particular spam and automated attacks.

In this context, the following data may be processed in particular: the IP address, the webpage accessed and/or the referrer URL, the date and time of access, browser and device information, operating system, language settings, mouse movements, keyboard inputs, time spent on the website, cookies or online identifiers, and further technical information, insofar as this is necessary for the operation and security assessment carried out by Google reCAPTCHA.

Google processes the data in connection with Google reCAPTCHA on our behalf. We have concluded a data processing agreement with Google in accordance with Article 28 GDPR. Recipients of the data may include Google Ireland Limited, Google LLC, Google-affiliated companies and service providers engaged by Google, insofar as this is necessary for the provision and safeguarding of Google reCAPTCHA.

The retention period depends on the specific configuration of Google reCAPTCHA and Google’s deletion periods applicable to the service.

Further information on data processing by Google is available at: https://policies.google.com/privacy?hl=en-GB.

Google Maps

Where you have given your consent via the Cookie Settings, we use Google Maps, a mapping service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on our website. Google Maps is used as part of our dealer locator to display the locations of our dealers and to facilitate travel to those locations.

When Google Maps is loaded and used, the following data may, in particular, be transmitted to Google and processed by Google: the IP address, the date and time of access, the webpage accessed and/or the referrer URL, browser and device information, operating system, language settings, approximate location information, where enabled by you, and further technical information. Where you are logged in to Google, Google may be able to associate the data collected with your Google user account and process it for its own purposes in accordance with Google’s Privacy Policy. In order to provide the map function, Google requires, among other things, the IP address, search terms and—where used—location coordinates.

The storage of information on your device or access to information already stored on your device takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG. To the extent that personal data are processed, this is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR. Google Maps is loaded only after you have given your consent via the “Cookie Settings”. You may withdraw your consent at any time with future effect via the “Cookie Settings”. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Recipients of the data may include Google Ireland Limited, Google LLC, Google-affiliated companies and service providers engaged by Google, insofar as this is necessary for the provision and operation of Google Maps. Google processes the data in accordance with its own Privacy Policy and the terms of service applicable to Google Maps.

The retention period depends on the specific use of Google Maps and the retention periods determined by Google. We have no influence over the retention period of data processed by Google. Further information can be found in Google’s Privacy Policy.

Further information on data processing by Google is available at: https://policies.google.com/privacy?hl=en-GB.

The Google Maps/Google Earth Additional Terms of Service are available at: https://www.google.com/help/terms_maps/.

Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on our website. Google Tag Manager is used for the technical management and deployment of website tags. Tags are small snippets of code that can be used, for example, to technically integrate and manage services for audience measurement, analytics, the embedding of external content or marketing purposes.

According to Google, Google Tag Manager does not generally set cookies or create user profiles itself. As a rule, it does not itself process personal data of visitors to our website where it is used solely for the technical management of the implemented tags. This does not include technical log data that may be generated in the course of providing the service. Google states that standard HTTP log data are generally deleted within 14 days; in addition, aggregated diagnostic data may be processed for the purposes of system stability, performance and installation quality.

However, additional tags or services may be integrated through Google Tag Manager which, in turn, process personal data or access information stored on your device. The services concerned are set out in the relevant sections of this Privacy Notice and in the Cookie Settings or the cookie notice provided there.

Where tags for analytics, marketing or other purposes that are not technically necessary are triggered via Google Tag Manager, they are activated only after you have given your consent via the “Cookie Settings”. The storage of information on your device or access to information already stored on your device is carried out pursuant to Section 25(1) TDDDG; where personal data are processed, this is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR. Google Tag Manager is configured accordingly so that tags requiring consent are triggered only after the relevant consent has been given. Google Consent Mode enables the technical control of tags on the basis of the consent decision you have communicated.

Where personal data are processed in the course of the technical provision of Google Tag Manager, such processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the efficient, secure and reliable and low-error management of the technologies used on our website.

Recipients of the data may include Google Ireland Limited, Google LLC, Google-affiliated companies and service providers engaged by Google, insofar as this is necessary for the provision and operation of Google Tag Manager. A transfer of personal data to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU–US Data Privacy Framework (“EU–US DPF”). Where data are transferred to Google LLC or its certified US subsidiaries, the transfer is based on the European Commission’s adequacy decision pursuant to Article 45 GDPR.

Further information on data processing by Google is available at: https://policies.google.com/privacy?hl=en-GB.

YouTube Videos

Where you have given your consent via the Cookie Settings, we embed videos from our own YouTube channel on our website. The provider of the YouTube video platform is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

The embedding of videos serves to present our online offering in an engaging manner and to make video content available. Where technically possible, we use the privacy-enhanced mode provided by YouTube for embedded videos. In this case, the videos are embedded via the youtube-nocookie.com domain. According to Google, privacy-enhanced mode means that views of embedded videos are not used to personalise the use of YouTube or to personalise advertising outside our website.

When an embedded video is loaded and, at the latest, when it is played, the following data may, in particular, be transmitted to Google and processed by Google: the IP address, the date and time of access, the webpage accessed and/or the referrer URL, browser and device information, operating system, language settings, online identifiers, information about interactions with the video, such as the start of playback, playback duration or other user interactions, and, where applicable, information relating to an existing Google or YouTube user account. Even in privacy-enhanced mode, a connection to Google’s servers may already be established when the embedded player is loaded.

The storage of information on your device or access to information already stored on your device takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG. To the extent that personal data are processed, this is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR. YouTube videos are loaded only after you have given your consent via the “Cookie Settings”. You may withdraw your consent at any time with future effect via the “Cookie Settings”. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Recipients of the data may include Google Ireland Limited, Google LLC, Google-affiliated companies and service providers engaged by Google, insofar as this is necessary for the provision and operation of YouTube. Google processes the data in accordance with its own Privacy Policy and the terms of service applicable to YouTube.

The retention period depends on the specific cookies or comparable technologies used and the specific use of the YouTube player. The retention periods of the technologies used can be found in the Cookie Settings or in the cookie notice provided there. We have no influence over the further retention period of data processed by Google.

Further information on data processing by Google is available at: https://policies.google.com/privacy?hl=en-GB.

Links to Our Social Media Pages
- Facebook is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta Platforms Ireland Limited is generally the controller responsible for the processing of personal data in connection with Facebook for users in the European Economic Area.
  - Facebook’s Privacy Policy is available at: https://www.facebook.com/privacy/policy/
- Instagram is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta Platforms Ireland Limited is generally the controller responsible for the processing of personal data in connection with Instagram for users in the European Economic Area.
  - Instagram’s Privacy Policy is available at: https://privacycenter.instagram.com/policy/.
- Pinterest is a service provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. For users in the European Economic Area, Pinterest Europe Ltd. and Pinterest, Inc. may act as joint controllers in respect of certain processing activities.
  - Pinterest’s Privacy Policy is available at: https://policy.pinterest.com/en/privacy-policy/.
- YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is generally the point of contact for users in the European Economic Area in relation to the processing of personal data in connection with YouTube.
  - Google’s Privacy Policy, which also applies to YouTube, is available at: https://policies.google.com/privacy?hl=en-GB.

Our website contains social media logos linking to our respective Facebook, Instagram, Pinterest and YouTube profiles. These links enable you to follow us on those platforms, communicate with us and other users, and obtain information about our company and our offerings.

For data protection reasons, we use links only to our social media profiles. Consequently, no personal data are transmitted to the respective providers when you access our website. You will be redirected to the website or platform of the relevant provider only when you click on a social media logo. From that point onwards, the relevant provider processes personal data under its own responsibility.

Where you are already logged in to the relevant provider when clicking on a link, that provider may be able to associate your visit to our profile directly with your user account. In this context, the following data may be processed in particular: the IP address, the date and time of access, browser and device information, the referrer URL, information about your interactions with the platform and, where applicable, further data. We have no influence over the nature, scope, purposes, legal bases, recipients or retention periods of the processing carried out by the providers.

The links to our social media profiles are provided on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in providing information about our company and our offerings, and in communicating with interested parties, customers and other users via the respective social media platforms.

Embedding of Third-Party Services and Content

Where third-party services or content are embedded on our website, such as videos, maps, graphics, fonts or other content, personal data may be transferred to the relevant third-party provider. This applies in particular to the IP address, as this is technically necessary in order to deliver the content to your device. Depending on the service concerned, further usage, device and browser information, online identifiers, and information concerning access to and use of our website may also be processed.

Where the embedding of third-party content is not technically necessary, the storage of information on your device or access to information already stored on your device takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG. To the extent that personal data are processed, this is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR. The relevant content is embedded only after you have given your consent via the “Cookie Settings”. You may withdraw your consent at any time with future effect via the “Cookie Settings”. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Where services or content are technically necessary in order to provide you with a function of our website expressly requested by you, the storage of information on your device or access to information already stored on your device takes place on the basis of Section 25(2) no. 2 TDDDG. To the extent that personal data are processed, this is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the secure, functional and user-friendly provision of our website and its functions.

The relevant third-party providers, the data processed in each case, the purposes, legal bases, recipients, possible transfers to third countries and retention periods are set out in the respective sections of this Privacy Notice and in the Cookie Settings or the cookie notice provided there.

8. Applications and Applicant Management

You may apply for vacancies advertised by our company. The application process is managed using the HRworks applicant management software, provided by HRworks GmbH, Waldkircher Straße 28, 79106 Freiburg im Breisgau, Germany. Online applications are submitted via the application portal provided by HRworks.

If you apply via our application portal, by email to teu.hr@toto.com, or by post, we process the personal data you provide to us in connection with your application. This includes, in particular:

Personal and contact details, such as your name, address, email address and telephone number;
Application and communication data, such as cover letters, CVs, certificates, evidence of qualifications, information concerning professional experience, and the content of communications during the application process;
Where applicable, information provided voluntarily, such as a photograph, information concerning particular knowledge or skills, salary expectations or preferred start date; and
Technically necessary log and usage data when using the application portal, such as the IP address, the date and time of access, the browser used, operating system, and the dates and times of processing and transmission.

We process your application data for the purpose of conducting the application process, assessing your suitability for the advertised position, communicating with you, and deciding whether to establish an employment relationship. The legal basis is Section 26(1), first sentence, of the German Federal Data Protection Act (Bundesdatenschutzgesetz – “BDSG”) in conjunction with Article 88(1) GDPR.

Where you voluntarily provide us with special categories of personal data within the meaning of Article 9(1) GDPR in connection with your application, such as health data, we process such data only where a legal basis under Article 9(2) GDPR applies. This may be the case, in particular, where processing is necessary for the exercise of rights or compliance with legal obligations arising under employment law, social security law or social protection law. Where processing is based on your explicit consent, it is carried out on the basis of Article 9(2)(a) GDPR.

HRworks processes personal data solely on our behalf in connection with the provision and technical operation of the application portal. We have concluded a data processing agreement with HRworks in accordance with Article 28 GDPR. Access to your application data is granted only to those persons and specialist departments within our company responsible for the specific application process and, where applicable, to IT and technical service providers acting on our instructions, insofar as this is necessary for the conduct of the application process.

Where your application results in an employment relationship, the data required for the employment relationship will be included in your personnel file and processed for the duration of the employment relationship and thereafter in accordance with the applicable statutory retention periods.

Where no employment relationship is established, we will generally delete your application data no later than six months after completion of the relevant application process. Data will be retained for a longer period only where this is necessary for the establishment, exercise or defence of legal claims, where statutory retention obligations apply, or where you have expressly consented to longer retention in a talent pool.

Where you consent to inclusion in a talent pool, we process your application data for up to twelve months after completion of the application process in order to consider you for further suitable positions, where applicable. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 26(2) BDSG. You may withdraw your consent at any time with future effect. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

9. Webinars

As part of our range of services, we provide information in the form of webinars. For the organisation, delivery and follow-up of our webinars, we process the personal data that you provide when registering or participating, or that are generated technically when you use the webinar platform.

This includes, in particular:

Personal and contact details, such as your first and last name, company, email address and, where applicable, role or position;
Registration data, such as the date and time of registration, the webinar booked, and registration and attendance confirmations;
Attendance data, such as the date, time and duration of attendance and, where applicable, information concerning participation in surveys;
Communication and interaction data, such as chat messages, questions, answers, survey results and, where applicable, audio or video data voluntarily provided by you; and
Technically necessary usage and log data, such as the IP address, browser and device information, operating system, user agent and connection data.

Processing is carried out for the organisation, delivery and follow-up of webinars, for communication with participants, to answer questions and to provide information about the relevant event. Where participation in a webinar is connected with a contractual relationship or takes place at your request, the legal basis is Article 6(1)(b) GDPR. In all other cases, processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the delivery, organisation and ongoing development of our information and events programme in line with users’ needs.

For the administration of webinars, we use ieQ-systems GmbH & Co. KG, Fridtjof-Nansen-Weg 8, 48155 Münster, Germany. Where ieQ-systems processes personal data on our behalf, we have concluded a data processing agreement with the service provider in accordance with Article 28 GDPR.

The technical delivery of webinars is carried out via the GoToWebinar webinar platform, provided by GoTo Technologies Ireland Unlimited Company, The Reflector, 10 Hanover Quay, Dublin 2, D02R573, Ireland (“GoTo”; formerly LogMeIn). Recipients of the data may therefore include ieQ-systems GmbH & Co. KG, GoTo Technologies Ireland Unlimited Company, GoTo-affiliated companies and service providers engaged by GoTo, insofar as this is necessary for the organisation and delivery of the webinar. In connection with a webinar, GoToWebinar processes, in particular, registration, participant, device and connection data.

Where personal data are transferred to countries outside the European Union or the European Economic Area in connection with the use of GoToWebinar, in particular to the United States, such transfers will take place only where the legal requirements pursuant to Articles 44 et seq. GDPR are met. Where data are transferred to a GoTo entity in the United States certified under the EU–US Data Privacy Framework (“EU–US DPF”), the transfer is based on the European Commission’s adequacy decision pursuant to Article 45 GDPR. Where, in individual cases, data are transferred to recipients in third countries for which no adequacy decision exists, the transfer will take place only where appropriate safeguards pursuant to Article 46 GDPR are in place, in particular the standard contractual clauses adopted by the European Commission.

We generally retain personal data processed in connection with webinars for the duration of the preparation, delivery and follow-up of the relevant webinar. Data will be retained for a longer period only where this is necessary to document attendance, respond to subsequent enquiries, establish, exercise or defend legal claims, comply with statutory retention obligations, or where separate consent has been obtained.

Where recordings are made in connection with a webinar, we will notify you of this separately before recording begins. Recordings will be made only where an appropriate legal basis exists.

10. Data Subject Rights

You have the right of access to the personal data concerning you that we process (Article 15 GDPR). You also have the right to rectification of inaccurate personal data or completion of incomplete personal data (Article 16 GDPR), erasure of your personal data (Article 17 GDPR), restriction of processing (Article 18 GDPR), and data portability (Article 20 GDPR).

Where we process your personal data on the basis of Article 6(1)(e) or (f) GDPR, you have the right, pursuant to Article 21 GDPR, to object at any time to such processing on grounds relating to your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims.

Where we process personal data for direct marketing purposes, you have the right, pursuant to Article 21(2) GDPR, to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling insofar as it is related to such direct marketing. Following an objection, we will no longer process your personal data for these purposes.

We do not use decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

To exercise your data subject rights, you may contact the controller or our Data Protection Officer at the contact details provided above at any time.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular with the supervisory authority competent for us:

Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(The State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)

Kavalleriestraße 2–4

40213 Düsseldorf

Germany

Telephone: +49 (0) 211 38424-0

E-Mail: poststelle@ldi.nrw.de

You may also lodge a complaint with the data protection supervisory authority of your habitual residence, place of work or the place of the alleged infringement.

Right to Withdraw Consent (Article 7(3) GDPR)

Where you have given your consen to process your personal data, you may withdraw your consent at any time with future effect (Article 7(3) GDPR). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Following withdrawal, we will no longer process the personal data covered by your consent pursuant to that consent. Further processing may nevertheless be possible where it is based on another legal basis, for example for the performance of a contract, compliance with a legal obligation—including statutory retention obligations—or the establishment, exercise or defence of legal claims.

You may withdraw your consent using the contact details of the controller provided above. Withdrawal of consent is as easy as giving consent. Article 7(3) GDPR guarantees the right to withdraw consent at any time; processing carried out before withdrawal remains unaffected.

To exercise your data subject rights or withdraw consent, you may contact the controller or our Data Protection Officer using the contact details provided above.

Information, communication and action under the GDPR are generally provided free of charge. In the case of manifestly unfounded or—particularly in the case of frequent repetition—excessive requests, we may either charge a reasonable fee or refuse to act on the request (Article 12(5) GDPR).

Where we have reasonable doubts concerning your identity, we may request the additional information necessary to confirm your identity. Where we are unable to identify the data subject and are not required to obtain additional information solely for the purpose of identification, the exercise of individual data subject rights may be restricted. Where possible, we will inform you if we are unable to identify you (Articles 11 and 12(6) GDPR).

We will deal with requests to exercise your data subject rights without undue delay and, in principle, no later than one month after receipt of your request. Taking into account the complexity and number of requests, this period may be extended by a further two months. We will inform you of any extension and the reasons for it within one month of receipt of the request.

Where we do not take action in response to your request, we will inform you without undue delay and, at the latest, within one month of receipt of the request of the reasons for doing so. At the same time, we will inform you of the possibility of lodging a complaint with a data protection supervisory authority and seeking a judicial remedy (Article 12(3) and (4) GDPR). The standard response period is one month; an extension of no more than a further two months is permitted only where necessary.

Please note that the exercise of individual data subject rights may be restricted in the cases provided for by law, in particular where this is permitted under Union law or the law of a Member State pursuant to Article 23 GDPR.

11. Data Security

Taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing, we implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss or alteration, unauthorised disclosure or unauthorised access.

Where you transmit personal data to us via our website, in particular through contact forms, the transmission is encrypted using TLS. You can generally recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser’s address bar.

Please note that, despite appropriate security measures, data transmission over the internet cannot be completely protected against access by third parties.

Access to your user account is generally granted using personal login details. Please keep your login details confidential, do not disclose them to third parties, and use a secure, unique password. Always log out after using your user account. In particular, when using a public or shared computer, close the browser window afterwards and do not store your login details in the browser on such devices.

12. Erasure and Restriction of Processing of Personal Data

We retain personal data only for as long as this is necessary for the relevant processing purposes. Once the purpose no longer applies and no statutory retention obligations or other legal bases for further retention exist, the data will be erased or anonymised. Where erasure is not possible due to statutory retention obligations, processing of the relevant data will be restricted. The data will then be retained and further processed only to the extent permitted or required by law.

13. Contacting Us

You may contact us by email or via the contact forms provided on our website. Where you contact us, we process the personal data you provide, in particular your name, contact details, the content of your message and, where applicable, any attachments submitted. When you use a contact form, we additionally process the technically necessary data generated in the course of transmission, in particular the date and time of your enquiry and, where applicable, your IP address.

We process your data for the purpose of handling and responding to your enquiry, communicating with you and, where applicable, initiating, performing or administering a contractual relationship.

Where your enquiry relates to the conclusion or performance of a contract, or where you request pre-contractual measures, processing is carried out on the basis of Article 6(1)(b) GDPR. In all other cases, processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interests lie in the proper handling and response to incoming enquiries and in communicating with interested parties, customers and other contacts.

Your data will generally be erased once your enquiry has been conclusively dealt with and no further communication is required. Data will be retained for a longer period only where this is necessary to comply with statutory retention obligations, document communications, or establish, exercise or defend legal claims.

Your data will be disclosed to third parties only where this is necessary to handle your enquiry, where you have given your consent, where we are legally obliged to do so, or where service providers assist us in the processing of personal data on our behalf.

14. Amendments and Updates to This Privacy Notice

We will amend this Privacy Notice where this becomes necessary as a result of changes to data processing activities, legal requirements, requirements imposed by supervisory authorities, court decisions, technological developments or changes to contact details. The current version of this Privacy Notice is available on our website. The date stated in this Privacy Notice indicates its current version.

Last updated: 18 September 2026