Information for Contractual Partners on privacy
Privacy Notice Video Surveillance at the ZGM Parking Lot

1. Introduction

With the following information, we would like to provide you as the "data subject" with an overview of the processing of your personal data by us and your rights under data protection laws. As a rule, using our website is possible without entering personal data. However, if you wish to use special services provided by our company via our website, processing of personal data may become necessary. If the processing of personal data is necessary and there is no statutory legal basis for such processing, we generally obtain consent from you.

The processing of personal data, such as your name, address, or email address, always takes place in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to "Zimmermann-Graeff & Müller GmbH". By means of this privacy policy, we would like to inform you about the scope and purpose of the personal data collected, used, and processed by us.

As the controller responsible for processing, we have implemented numerous technical and organizational measures to ensure the most complete protection possible for personal data processed through this website. Nevertheless, internet-based data transmissions can fundamentally have security vulnerabilities, so absolute protection cannot be guaranteed. For this reason, you are free to submit personal data to us via alternative means, such as by telephone or by post.

You can also take simple and easy-to-implement measures to protect yourself against unauthorized third-party access to your data. Therefore, we would like to give you some advice here on the secure handling of your data:

• Protect your account (login, user, or customer account) and your IT system (computer, laptop, tablet, or mobile device) with secure passwords.

• Only you should have access to the passwords.

• Ensure that you always use your passwords for only one account (login, user, or customer account).

• Do not use a password for different websites, applications, or online services.

• Especially when using publicly accessible IT systems or systems shared with other people: You should always log out after every login on a website, application, or online service.

• Passwords should consist of at least 12 characters and be chosen in such a way that they cannot be easily guessed. Therefore, they should not contain common everyday words, your own name, or names of relatives, but rather uppercase and lowercase letters, numbers, and special characters.

2. Controller The controller within the meaning of the GDPR is: Zimmermann-Graeff & Müller GmbH Barlstraße 35, 56856 Zell / Mosel, Germany Phone: +49(6542) 419 0 Fax: +49(6542) 419 150 Email: info@zgm.de Representatives of the controller: Joseph Helfrich, Frédéric Helfrich, Matthias Schwunk, Pascal Martin

3. Data Protection Officer You can reach the Data Protection Officer as follows: Stefan Auer Phone: +49 (0) 911 148986 50 Fax: +49 (0) 911 148986 59 Email: office@ascon-datenschutz.de You can contact our Data Protection Officer directly at any time with all questions and suggestions regarding data protection.

4. Definitions The privacy policy is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our privacy policy should be legible and understandable for the general public as well as for our customers and business partners. To ensure this, we would like to explain the terminology used in advance.

In this privacy policy, we use, among others, the following terms:

• Personal Data: Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

• Data Subject: A data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing (our company).

• Processing: Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

• Restriction of Processing: Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.

• Profiling: Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

• Pseudonymization: Pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
• Processor: Processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

• Recipient: Recipient means a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

• Third Party: Third party means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

• Consent: Consent of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

5. Legal Basis for Processing Art. 6(1)(a) GDPR (in conjunction with Section 25(1) TDDDG (formerly TTDSG)) serves as the legal basis for our company for processing operations for which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which you are a party, as is the case, for example, with processing operations necessary for the supply of goods or the provision of another service or consideration, the processing is based on Art. 6(1)(b) GDPR. The same applies to processing operations necessary for carrying out pre-contractual measures, such as in cases of inquiries regarding our products or services.

If our company is subject to a legal obligation by which processing of personal data becomes necessary, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1)(c) GDPR.

In rare cases, the processing of personal data might be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance details, or other vital information had to be passed on to a doctor, hospital, or other third party. In this case, processing would be based on Art. 6(1)(d) GDPR.

Finally, processing operations could be based on Art. 6(1)(f) GDPR. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if processing is necessary for the purposes of a legitimate interest pursued by our company or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Such processing operations are particularly permitted to us because they were specifically mentioned by the European legislator. In this respect, the legislator considered that a legitimate interest could be assumed if you are a customer of our company (Recital 47, Sentence 2 GDPR).

Our offer is generally aimed at adults. Persons under 16 years of age may not transmit personal data to us without the consent of their parents or legal guardians. We do not request personal data from children and young people, nor do we collect it or pass it on to third parties.

6. Transfer of Data to Third Parties Your personal data will not be transferred to third parties for purposes other than those listed below.

We only transfer your personal data to third parties if:

• You have given your explicit consent to this pursuant to Art. 6(1)(a) GDPR,

• The disclosure pursuant to Art. 6(1)(f) GDPR is permissible to safeguard our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,

• In the event that there is a legal obligation for disclosure pursuant to Art. 6(1)(c) GDPR, and

• This is legally permissible and necessary pursuant to Art. 6(1)(b) GDPR for the processing of contractual relationships with you.

To protect your data and, if necessary, enable data transmission to third countries (outside the EU/EEA), we have concluded data processing agreements based on the Standard Contractual Clauses of the European Commission. If the Standard Contractual Clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR can serve as the legal basis for transmission to third countries. This sometimes does not apply to data transmission to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only transfer your personal data to third parties if:

• You have given your explicit consent to this pursuant to Art. 6(1)(a) GDPR,

• The disclosure pursuant to Art. 6(1)(f) GDPR is permissible to safeguard our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,

• In the event that there is a legal obligation for disclosure pursuant to Art. 6(1)(c) GDPR, and

• This is legally permissible and necessary pursuant to Art. 6(1)(b) GDPR for the processing of contractual relationships with you.

Within the scope of the processing operations described in this privacy policy, personal data may be transferred to the USA. Companies in the USA only have an adequate level of data protection if they have certified under the EU-US Data Privacy Framework, and thus the adequacy decision of the EU Commission pursuant to Art. 45 GDPR applies. We have explicitly mentioned this for the service providers concerned in the privacy policy. To protect your data in all other cases, we have concluded data processing agreements based on the Standard Contractual Clauses of the European Commission. If the Standard Contractual Clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR can serve as the legal basis for transmission to third countries. This sometimes does not apply to data transmission to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

7. Technology

7.1 Hosting by Hetzner We host our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter referred to as Hetzner).

When you visit our website, your personal data (e.g., IP addresses in log files) will be processed on Hetzner's servers.

The use of Hetzner is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable presentation, provision, and security of our website.

We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with Hetzner. This is a contract required by data protection law, which ensures that Hetzner processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

For further information on Hetzner's data protection regulations, please visit: https://www.hetzner.com/legal/privacy-policy

8. Cookies

8.1 General Information on Cookies Cookies are small files that your browser automatically creates and that are stored on your IT system (laptop, tablet, smartphone, etc.) when you visit our site.

Information is stored in the cookie, which results in each case in connection with the specific end device used. However, this does not mean that we gain direct knowledge of your identity as a result.

The use of cookies serves to make the use of our service more pleasant for you. For instance, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted after leaving our site.

In addition, to optimize user-friendliness, we also use temporary cookies that are stored on your end device for a specified period. If you visit our site again to use our services, it is automatically recognized that you have already been with us and what entries and settings you made so that you do not have to enter them again.

On the other hand, we use cookies to statistically record the use of our website and to evaluate it for you for the purpose of optimizing our service. These cookies enable us to automatically recognize that you have already visited us when you visit our website again. The cookies set in this way are automatically deleted after a defined period. The respective storage period of the cookies can be found in the settings of the consent tool used.

8.2 Legal Basis for the Use of Cookies The data processed by cookies required for the proper functioning of the website are necessary to safeguard our legitimate interests as well as those of third parties pursuant to Art. 6(1)(f) GDPR.

For all other cookies, your consent given via our opt-in cookie banner pursuant to Art. 6(1)(a) GDPR applies.

9. Validity and Changes to this Privacy Policy This privacy policy is currently valid and was last updated in: September 2026.

Due to the further development of our website and services or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed and printed out by you at any time on the website under "https://www.zgm.de/kontakt/datenschutz".

This privacy policy was created with the support of the data protection software: audatis MANAGER.