Data privacy statement (general)

1.       General information

1.1      Personal data (Art. 4 No. 1 of the GDPR)
The subject for data protection is personal data (hereinafter also referred to as data). This means all information relating to an identified or identifiable natural person. This includes, for example, details such as name, address, occupation, e-mail address, state of health, income, marital status, genetic characteristics, telephone number and if applicable also user data such as the IP address.

1.2      Controller (Art. 4 No. 7 of the GDPR)
The party responsible for processing your personal data as part of utilising this website www.progroup.ag (hereinafter referred to as the website) is Progroup AG (hereinafter referred to as the operator or controller). The contact details are:

Progroup AG
Horstring 12
76829 Landau in der Pfalz
Board: Mr Jürgen Heindl, Dr. Volker Metz, Mr Maximilian Heindl, Mr Philipp Kosloh
Phone: +49 (0) 6341 / 5576-0
Fax: +49 (0) 6341 / 5576-109
E-mail: info@progroup.ag

1.3      Data protection officer

The controller has appointed a data protection officer. This officer can be contacted by e-mailing datenschutz@progroup.ag.

1.4      Possibility to object
If you want to object to the processing of your data by the operator in accordance with this data privacy statement as a whole or for individual measures, you can do this using the contact details specified in the legal notice. Please note that, in the event of such an objection, in some circumstances it may only be possible to use the website and access the services which are offered on it to a limited extent or not at all.

2.       Scope and purposes of the data processing

2.1      Accessing and using the website
Each time the website and its subpages are accessed, use data is transferred by the relevant internet browser and saved in log files (server log files). The data records which are saved in the process contain the following data:

  • Date and time of access
  • Name of the subpage which is accessed
  • IP address
  • Referrer URL (source URL from which you arrived at the website
  • Quantity of data transmitted
  • Product and version information for the browser which is used 

2.2      E-mail at a click
If you want to contact the operator, you have the opportunity to open an e-mail addressed to the operator with just one click. The e-mail address which is linked to your e-mail program is automatically used as the sender. If you do not wish your e-mail address to be used in this way, you can amend this in the settings for your particular e-mail program.

2.3      Advertising
If you have given your consent or a statutory provision permits it, the operator will use your data for advertising purposes.

As a customer of the operator, you will regularly be e-mailed product recommendations which are based on the products or services which you have previously ordered. The operator wishes to use this method to provide you with information about its services which you might be interested in based on your last order or booking.

If you do not wish to receive any more recommendations or any advertising messages at all, you can object to this at any time. Notifying the operator in text form is sufficient for this. In addition, each e-mail contains an unsubscribe link.

2.4      Use of cookies
The operator uses what are known as cookies. These are small data packets which normally consist of letters and numbers and which are saved in a browser when you visit certain websites. The cookies allow the website to recognise your browser, track you as you browse different sections of the website and identify you when you return to the website. Cookies do not contain any data that identifies you personally, but the information about you which is stored by the operator may be assigned to the data which is obtained from the cookies and is stored in them.

Information which the operator receives from you through the use of cookies can be used for the following purposes: 

  • Recognising the user’s computer when visiting the website
  • Tracking the user's browsing activities on the website
  • Improving the user-friendliness of the website
  • Evaluating the use of the website
  • Operating the website
  • Preventing fraud and improving the security of the website
  • Individual configuration of the website, taking account of the needs of users

Cookies do not cause any damage to a browser. They do not contain viruses and also do not permit the operator to spy on you. Two types of cookies are used:

  • Temporary cookies are automatically deleted when your browser is closed (session cookies).
  • By contrast, persistent cookies have a longer life span. This type of cookies makes it possible for you to be recognised when you next access a website once you have left it.

The cookies allow the operator to track your user behaviour for the abovementioned purposes and to the appropriate extent. They are also intended to enable you to browse the operator's website in an optimised way. The operator also collects this data only in an anonymised form.

You can of course also view the website without cookies. If you do not want the operator to recognise your computer, you can prevent cookies from being stored on your hard disk by selecting “Accept no cookies” in your browser settings. For details of how this works, please consult your browser manufacturer’s instructions. You should also read the instructions for your browser for details of how to delete cookies which have already been set by your browser.

If you do not accept cookies or delete cookies which have already been set, this may impair the way that the website works.

2.5      Use of Google Analytics
The operator uses Google Analytics, a web analytics service of Google Inc., 1600 Amphitheatre, Parkway?Mountain View, CA 94043?USA. Google Analytics uses cookies, text files which are stored on your computer and allow the way that you use the website to be analysed. The information about the way you use the website which is generated by the cookie is generally transmitted to a Google server in the USA and stored there. However, in the event of IP anonymisation being enabled on the website, your IP address will be shortened by Google beforehand within member states of the European Union or in other states party to the Agreement on the European Economic Area.

Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator, Google will use this information to evaluate your use of the website, to compile reports on the website activities and to provide further services associated with the use of the website and use of the internet to the website operator. The IP address which is transmitted from your browser as part of Google Analytics will not be combined with other data by Google.

You can prevent the installation of cookies by adjusting an appropriate setting in your browser software; but the operator points out that if you do this you may not be able to use all the functions of the website to their full extent. In addition, you can prevent the collection of the data (including your IP address) which is generated by the cookie and relates to your use of the website by Google and the processing of this data by Google by downloading and installing the browser plugin which is available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de

You can find more information about how data is handled by Google in Google’s privacy statement.

2.6      Investor relations
Under the menu item Investor relations, interested investors can gain access with a user name and password. The following details are required for this:

  • E-mail address
  • Password
  • Title
  • First name
  • Last name
  • Company
  • Street
  • Postcode
  • City
  • Country 

Registration is done using what is known as the double opt-in process, i.e. activation can only take place once you have explicitly confirmed this beforehand. For this purpose, you will receive an e-mail containing a confirmation link. Activation can only take place once you have clicked on this link. After this, the registered investors are able to log in with their e-mail address and password. This gives them access to the investor website. There the investors are provided with relevant information such as quarterly and annual reports.

2.7      Customer magazine
The operator publishes the magazine PROfil at regular intervals and in it reports on current topics in the paper, corrugated board and packaging industry. Both the latest edition and future editions of the magazine can be ordered through the post. In addition, it is also possible to order it as a download link via e-mail. The magazine is produced with a great deal of effort and expense, which is why the magazine can only be provided if you specify the following personal details:

  • Title
  • First name
  • Last name
  • Company
  • E-mail

In addition, the following details can be provided voluntaril

  • Sector
  • Street
  • Postcode
  • City
  • Country
  • Phone

When you order the magazine, you consent to the magazine being dispatched (form of advertising). This consent given to the operator can be withdrawn at any time.

2.8      e-box
Customers that have already registered can log in via the e-box with their user name and password. The login details are assigned via the respective sales manager. The customer master data such as name and address are logged in the customer section. In this section, the customers can then submit orders and track the production and delivery details in relation to these orders. The order details and possible delivery dates are to be entered for each order. Existing orders can also be amended by entering the order details. The order status can be tracked using the existing order details. In addition, it is possible to view the route planning and track the precise delivery time. Orders which are delayed are likewise displayed to the customers. It is also possible for the customers to view the warehouse movements and the production planning.

3.       Legal bases

3.1      Accessing and using the website (Art. 6 para. 1 f) of the GDPR)
The admissibility of this processing is based on Art. 6 para. 1 f) of the GDPR, which states that the processing is lawful if it is necessary for the purpose of preserving the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. It is the operator’s legitimate interest to provide a website containing information and to offer services to its customers and to optimise the operation of the website.

3.2      E-mail at a click (Art. 6 para. 1 b) of the GDPR)
The operator processes the data which you provide in order to respond to your contact request and to communicate with you. This is data that is absolutely essential for the specified processes. The admissibility of this processing is based on Art. 6 para. 1 b) of the GDPR, which states that the processing is lawful if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

The contact request is a step at the request of the data subject prior to entering into a contract. The data collected by the operator is also required for the purpose of carrying out the step prior to entering into a contract because the request cannot be responded to without it.

3.3      Advertising (Art. 6 para. 1 f) of the GDPR, Section 7 para. 3 of the German Unfair Competition Act)
The operator shall use your data for advertising purposes if necessary. The admissibility of this processing is based on Art. 6 para. 1 f) of the GDPR, which states that the processing is lawful if it is necessary for the purpose of preserving the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

The use of data for advertising purposes constitutes a legitimate interest of the operator within the meaning of Art. 6 para. 1 f) of the GDPR. The operator relies on actively presenting its services to new and existing customers.

In the case of direct advertising to customers, Section 7 para. 3 of the German Unfair Competition Act forms the legal basis, according to which an unacceptable nuisance shall not be assumed to exist for advertising using electronic mail in the cases listed therein. You can object to the use at any time without any costs other than the transmission costs according to the basic rates being incurred.

If you do not wish to receive any more recommendations or any advertising messages at all, you can object to this at any time. Notifying the operator in text form is sufficient for this. In addition, each e-mail contains an unsubscribe link.

3.4      Use of cookies (Art. 6 para. 1 f) of the GDPR)
The admissibility of this processing is based on Art. 6 para. 1 f) of the GDPR, which states that the processing is lawful if it is necessary for the purpose of preserving the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. It is the operator’s legitimate interest to present its website in an optimised way. The provision of the data is required in order to be able to access the operator’s website without any errors. If you do not accept cookies or delete cookies which have already been set, this may impair the way that the website works.

3.5      Use of analytical tools (Art. 6 para. 1 a) of the GDPR)
The admissibility of the processing is based on Art. 6 para. 1 a) of the GDPR, which states that the processing is lawful if the data subject has given consent to the processing of his or her personal data for one or more specific purposes. The processing of the data is taking place for the purposes stated above. Consent can be given when accessing the website.

3.6      Investor relations (Art. 6 para. 1 b) of the GDPR)
The operator uses the data which you provide in order to respond to your investor enquiry. The data which is provided is data that is absolutely essential for the specified processes. The admissibility of this processing is based on Art. 6 para. 1 b) of the GDPR, which states that the processing is lawful if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

The investor enquiry is a step at the request of the data subject prior to entering into a contract. The data collected by the operator is also required for the purpose of carrying out the step prior to entering into a contract because the enquiry cannot be responded to without it.

3.7      Customer magazine (Art. 6 para. 1 a), b) of the GDPR)
The operator uses the data which you provide in order to make the magazine PROfil available to you. The data which is provided is data that is absolutely essential for the specified processes. The admissibility of the processing is based on Art. 6 para. 1 b) of the GDPR, which states that the processing is lawful if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

The customer magazine is provided to you free of charge on request as part of a contractual relationship. The data collected by the operator is also required for the purpose of carrying out the contractual step because the request cannot be responded to without it.

The operator also uses the data for advertising purposes. The admissibility of this processing is based on Art. 6 para. 1 a) of the GDPR, which states that the processing is lawful if the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

When you make use of the fact that the magazine PROfil has been made available, you consent accordingly to the processing of the personal data for advertising purposes.

3.8      e-box (Art. 6 para. 1 b) of the GDPR)
The operator uses the data which you provide in order to be able to assign the data to your customer profile. The data which is provided is data that is absolutely essential for the specified processes. The admissibility of this processing is based on Art. 6 para. 1 b) of the GDPR, which states that the processing is lawful if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

The e-box is a contractual step at the request of the data subject. The data collected by the operator is also required for the purpose of carrying out the contractual step because without it there can be no assignment to the customer profile and therefore also no triggering of an order.

4.       Information relating to the guarantee of fair and transparent processing

4.1      Period of storage

(a) Accessing and using the website
Your IP address is erased or anonymised after the use ends. Anonymisation involves modifying the IP addresses so that they can no longer be assigned or can only be assigned with a disproportionately large amount of time, costs and effort to a specific or specifiable or identified or identifiable natural person.


The log files (server log files) are evaluated by the operator in anonymised form in order to further improve the website and make it more user-friendly, find and rectify errors more quickly and manage server capacities. This makes it possible, for example, to track at what time use of the website is particularly popular, and the operator can provide an appropriate volume of data.

(b)
E-mail at a click
The contact details which you transmit are erased by the operator after the contact comes to an end, unless there is a legitimate interest in storing them or there are statutory retention obligations opposing such erasure.

(c) Advertising
The personal data which is stored for advertising purposes will be stored by the operator and used in accordance with the statutory provisions, unless you object to this.

(d) Cookies
Temporary cookies are automatically deleted when your browser is closed (session cookies). By contrast, persistent cookies have a longer life span. This type of cookies makes it possible for you to be recognised when you next access a website once you have left it.

(e) Google Analytics
The personal data which is collected as part of utilising tracking tools will be erased, unless the controller has a legitimate interest in continuing to store it. In any event, only the data that is also absolutely required for achieving the corresponding purpose will continue to be stored. Where possible, the personal data will be anonymised.

(f) Investor relations
The data collected as part of investor relations will be erased by the operator, unless there is a legitimate interest in storing it or there are statutory retention obligations opposing such erasure.

(g) Customer magazine
The data collected in relation to the customer magazine will be erased by the operator, unless there is a legitimate interest in storing it or there are statutory retention obligations opposing such erasure.

The data which is stored for advertising purposes will be stored by the operator and used in accordance with the statutory provisions, unless you withdraw your consent to this.

(h) e-box
The data collected as part of the e-box will be erased by the operator, unless there is a legitimate interest in storing it or there are statutory retention obligations opposing such erasure.

4.2      Right to information, erasure, restriction, objection and data portability

(a) Right to information

The operator shall provide you on request with information on whether it is processing data in relation to you. You also have the right to receive information about:

  • the personal data that forms the subject of the processing, and the category to which it belongs,
  • the information available about the origin of the data,
  • the purposes of the processing and the legal basis therefor,
  • the recipients or the categories of recipients to which the data has been disclosed, in particular in the case of recipients in third countries or international organisations,
  • the period for which the data will be stored or, if this is not possible, the criteria used to determine this period,
  • the existence of a right to rectification, erasure or restriction of processing of the data by the controller,
  • the right to call the supervisory authority, and
  • details about how to contact the supervisory authority.

The operator shall endeavour to deal with requests for information swiftly.

(b) Right to erasure
You shall have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  • The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • You withdraw your consent on which the processing was based according to point a) of Art. 6 para. 1 of the GDPR or point a) of Art. 9 para. 2 of the GDPR, and there is no other legal ground for the processing.
  • You object to the processing pursuant to Art. 21 para. 1 of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 of the GDPR.
  • The personal data has been unlawfully processed.
  • The personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the operator is subject.
  • The personal data has been collected in relation to the offer of information society services referred to in Art. 8 para. 1 of the GDPR.

(c) Right to restriction

You shall have the right to obtain from the operator restriction of processing where one of the following applies: 

  • the accuracy of the personal data is contested by you, specifically for a period enabling the operator to verify the accuracy of your personal data,
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of the use of the personal data instead,
  • the operator no longer needs your personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims, or
  • you have objected to processing pursuant to Article 21 para. 1 of the GDPR pending verification of whether the legitimate grounds of the operator override yours.

(d) Right to object
You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point e) or f) of Art. 6 para. 1 of the GDPR; this also applies to profiling based on these provisions. The operator shall no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Where your personal data is processed for direct advertising purposes, you shall have the right to object at any time to processing of personal data concerning you for such advertising; this also applies to profiling to the extent that it is related to such direct advertising.

You shall have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is done for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 para. 1 of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

For your notification, please use the contact address which is specified in the legal notice.

(e) Right to data portability
You shall have the right to receive the personal data concerning you, which you have provided to the operator, in a structured, commonly used and machine-readable format, and have the right to transmit this data to another controller without hindrance from the operator to which the personal data has been provided, where the processing is based on consent pursuant to point a) of Art. 6 para. 1 of the GDPR, point a) of Art. 9 para. 2 of the GDPR or on a contract pursuant to point b) of Art. 6 para. 1 of the GDPR and the processing is carried out by automated means.

4.3      Withdrawal of your consent
If you have given consent to the processing of your personal data and withdraw this consent, the processing up to the point of this withdrawal shall remain unaffected.

4.4      Right to complain
You have the right to lodge a complaint with the relevant supervisory authority at any time.

4.5      Provision of your data
The data listed under clauses 2.1 and 2.2 needs to be provided for the purpose of utilising the services of the operator. Without this data the operator's website cannot be accessed and utilised, and it is not possible to respond to your contact request. The consequence of a failure to provide the data is that you cannot access the website and the operator cannot respond to your request.

The provision of the data listed under clauses 2.3, 2.4 and 2.5 is neither prescribed by law nor required to enter into a contract. If you object to the use of the cookies listed under clause 2.4, it is possible that the operator’s website will be displayed to you incorrectly and you will not be able to utilise some functions.

If you object to the use of the cookies listed under clause 2.5, this shall have no repercussions.

The data listed under clause 2.6 needs to be provided for the purpose of participating in the investor relations. Without this data participation cannot take place. To this extent, log-in to the Investor relations section shall also not be possible.

The data listed under clause 2.7 needs to be provided for the purpose of making the magazine PROfil available. Without this data there is no service in return for making the magazine available, which means that this cannot happen. Accordingly, the personal data also cannot be utilised for advertising purposes.

The data listed under clause 2.8 needs to be provided for logging into and utilising the e-box section. Without this data there can be no log-in and therefore no order can be placed either.

5.       Recipients
The data which is collected when you access and use the website and the details which you specify are transmitted to the operator's server and stored there. In addition to this, your data may be passed on to the following categories of recipients:

  • Data centre
  • IT service providers
  • Providers of tracking tools
  • Group-affiliated companies
  • Internal departments involved in the processing of your personal data

6.       Links to third parties
When the website is accessed, content linked to third-party websites might be displayed. The operator has no access to the cookies or other functions employed by third parties, and nor can the operator control them. Such third parties are not subject to the operator’s data protection provisions.

7.       Miscellaneous
The operator also provides the data privacy statement to you in English to aid understanding. However, in case of doubt the provisions of the German data privacy statement shall be decisive.

Last updated: May 2018