Privacy policy

Version of 21 August 2026

This English text is a convenience translation of the German "Datenschutzerklärung". In the event of any discrepancy, the German version shall prevail.

1. Scope

Below we provide information on the processing of your personal data when

• you use our websites,
• you write to us via our contact form or by e-mail,
• you transmit data to us in connection with an existing or future business relationship,
• you find us on social networks such as LinkedIn, Instagram and Facebook,
• you attend one of our events,
• you apply for employment,
• you visit our company premises.

Personal data means all data relating to an identified or identifiable natural person, for example your name, your address, your e-mail address and your user behaviour.

Where this privacy policy refers to "we" or "us", this means PaintSystems GmbH.

We process personal data in accordance with the applicable data protection provisions, in particular on the basis of the General Data Protection Regulation of the European Union ("GDPR") and the German Federal Data Protection Act ("BDSG").

2. Controller

The controller responsible for the processing of your personal data pursuant to Art. 4 (7) GDPR is PaintSystems GmbH:

PaintSystems GmbH
Industriestr. 3
63825 Schöllkrippen
Germany

You can reach our data protection officer at

PaintSystems GmbH
Datenschutzbeauftragter
Industriestr. 3
63825 Schöllkrippen
Germany

3. Your rights as a data subject

(1) Access, rectification, erasure, restriction of processing and data portability

You have the following rights vis-à-vis us with regard to your personal data:

• Art. 15 GDPR: right of access by the data subject
  You have the right to obtain information from us about which data we process relating to you. Please note that we cannot comply with your request for access in all cases, in particular where the duty of supply confidentiality to be observed by us pursuant to Section 29 BDSG precludes the provision of information.
• Art. 16 GDPR: right to rectification
  Should the data concerning you be incorrect or incomplete, you may request the rectification of incorrect information or the completion of incomplete information.
• Art. 17 GDPR: right to erasure
  Under the conditions of Art. 17 GDPR you may request the erasure of your personal data. Your right to erasure depends, among other things, on whether the data concerning you are still required by us to fulfil our contractual and legal obligations.
• Art. 18 GDPR: right to restriction of processing
  Under the conditions of Art. 18 GDPR you may request the restriction of the processing of the personal data concerning you.
• Art. 20 GDPR: right to data portability
  Under the conditions of Art. 20 GDPR you may receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or request its transmission to another controller.

(2) Withdrawal of consent

If you have given consent to the processing of your data, you may withdraw it at any time without affecting the lawfulness of the processing carried out up to the withdrawal. The permissibility of processing the data on the basis of other legal grounds likewise remains unaffected. Insofar as your consent was the sole legal basis for the processing of your data, in particular where we have no legitimate interest in the processing pursuant to Art. 6 (1) sentence 1 lit. f GDPR, we will erase the data without undue delay after the withdrawal of your consent.

(3) Objection to certain processing operations

Insofar as we base the processing of your personal data on a balancing of interests (Art. 6 (1) sentence 1 lit. e or f GDPR), you may object at any time, on grounds relating to your particular situation, to the processing of the personal data concerned (Art. 21 GDPR). When exercising such an objection, we ask you to state the reasons why we should not process your personal data in the way we have done. In the event of your justified objection, we will examine the situation and will either cease or adjust the processing or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.

You may object at any time to the processing of your personal data for the purposes of advertising and data analysis, incurring no costs other than the transmission costs according to the basic rates.

(4) Complaints to the supervisory authority

You also have the right to lodge a complaint with the supervisory authority if you believe that the processing of your data is unlawful (Art. 77 GDPR). The address of the supervisory authority responsible for us is:

Der Bayerische Beauftragte für Datenschutz
Wagmüllerstr. 18
80538 München
Germany
Phone: +49 89 21 26 72 - 0
Fax: +49 89 21 26 72 - 50
E-mail: poststelle@datenschutz-bayern.de
Internet: www.datenschutz-bayern.de

4. Disclosure of data to third parties

Where this is requested by you or necessary for the performance of an existing contract with you, or where we have a legitimate interest in the transfer of data, we also transfer your personal data to third parties.

Insofar as we disclose personal data to other companies, transmit it or otherwise grant them access, this is done in particular for administrative purposes as a legitimate interest and, beyond that, on a basis that complies with the statutory requirements.

In some cases we use external service providers to process personal data. These have been carefully selected and commissioned by us, are bound by our instructions and are checked regularly.

These may be the following categories of recipients:

• service providers for, for example, IT services, banking services, communication services, services in the area of our financial administration and the destruction of data carriers;
• hosting providers and media developers;
• forwarding agents and carriers;
• printers, letter shops, advertising agencies and photographers;
• recruitment agencies and personnel consultants who support us in the search for personnel.

Where you so wish or where it is necessary for the performance of a contract with you, we transfer your personal data to countries outside the European Union.

Where, in the course of our processing, data are transferred to other persons and companies (processors, joint controllers or third parties) to recipients outside the European Union, we will ensure that an adequate level of protection exists at the recipient, that appropriate safeguards are in place, that you have consented, or that the transfer is permissible on other grounds, for example where this is necessary at your request for the preparation or performance of a contract with you.

Any other transfer of your personal data to countries outside the European Union is not intended, but is also not excluded provided it is lawful.

5. Data security and erasure

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing as well as the varying likelihood and severity of the risk, we take appropriate technical and organisational measures to ensure an adequate level of protection.

These measures include in particular safeguarding the confidentiality, integrity and availability of personal data by controlling physical access to the data as well as the access to, input, disclosure, availability and separation of that data. We have also established procedures that ensure the exercise of data subject rights and the erasure of personal data.

Unless otherwise specified for individual processing activities, the following applies to the duration of storage of your personal data:

We erase your personal data as soon as the purpose of storage ceases to apply. Storage by us may also take place where this has been provided for by the European or national legislator in Union regulations, in national laws or in other provisions to which we are subject. Exceptions to the principle of erasure once the purpose has been achieved may arise, for example, from the provisions of the GDPR and from German law, in particular the BDSG. Furthermore, erasure does not take place for as long as retention obligations under commercial or tax law exist.

Longer storage may likewise be necessary in individual cases due to the assertion or possible assertion of claims against us in connection with a contract. The same applies where, in an individual case, claims are asserted by us, are intended or may be considered on the basis of specific circumstances. Storage then takes place for as long as the processing of the data is necessary for the assertion, exercise or defence of legal claims, plus the duration of any statutory retention obligation that may exist.

Where a statutory retention obligation precludes erasure, your data will initially be stored by us in such a way that they can only be processed by a restricted group of persons, and will only be erased after the retention obligation has ended.

6. Obligation to provide personal data

You are not obliged to transmit personal data to us. However, if you wish to conclude a contract with us, in particular to purchase our products, provide services for us or seek employment, the provision of personal data by you is necessary. If you do not provide us with personal data in an individual case, you will not be able to conclude a contract with us.

The same applies if you request technical data sheets and information about our products, attend one of our events or enter our company premises as a visitor. As a rule, you can only make use of these services if you provide us with the personal data required in each case, which usually includes your name, your company and your e-mail address. For further data we will indicate in each case whether these are mandatory or voluntary.

7. Data processing when using our website

On our website we present our company and our products. The controller responsible for the data processing is PaintSystems GmbH, as stated in the imprint.

Our website is a purely static website. It does not embed any third-party content: no web analytics services, map services, video platforms, social plug-ins, external fonts or scripts are loaded from third-party servers. All files – including the fonts and the corporate video – are delivered exclusively from our own server.

(1) Processing of data transmitted in the background

When you use the website for information purposes only, that is, when you do not transmit any information to us, we collect the following data and store them in the log files of our system:

• IP address,
• date and time of the request,
• time zone difference to Greenwich Mean Time (GMT), content of the request (specific page),
• access status/HTTP status code, amount of data transferred in each case,
• website from which the request originates, operating system and its interface,
• browser, language and version of the browser software.

The log file data are stored separately from any personal data provided by you. They are evaluated by us statistically and with the aim of increasing data protection and data security, in order ultimately to ensure an optimum level of protection for the personal data we process.

(2) Cookies

This website does not use any cookies. Nor are comparable technologies such as local storage, fingerprinting or tracking pixels used. Consent pursuant to Section 25 TDDDG is therefore not required, and we can dispense with a cookie banner.

(3) No web analytics, no third-party services

We do not use web analytics and do not create user profiles. In particular, Google Analytics, Google Maps, Google Fonts, embedded YouTube videos and social plug-ins are not used on this website. We merely link to our profiles on social networks; for details please see section 10.

The corporate video available on our website is hosted on our own server and is only loaded when you start it. No data are transferred to third parties in this process.

(4) Legal bases and storage period

The legal basis for the processing of the server log files is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in displaying our website to you and ensuring its stability and security.

Where our website is used for information purposes only, we store the above data for seven days. Storage beyond this is possible; in that case the users' IP addresses are erased or altered so that the calling client can no longer be identified.

8. Data processing in relation to our contact forms

On the contact page and in the page footer we provide forms through which you can send us a message. The controller responsible for this data processing is PaintSystems GmbH.

We process the details you enter: name, e-mail address and your message as mandatory information, as well as your telephone number and subject if you provide them. In addition, we store the IP address and the time of submission in order to prevent misuse.

The forms are processed on our own server; the message is delivered to us by e-mail to info@paintsystems.com. No third-party captcha service is used. To protect against automated submissions we use only a form field that is invisible to you (a "honeypot"), which does not process any personal data.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR insofar as your enquiry is aimed at the conclusion or performance of a contract, and otherwise Art. 6 (1) sentence 1 lit. f GDPR; our legitimate interest lies in responding to your enquiry.

We erase your enquiry as soon as it has been dealt with conclusively and no statutory retention obligations preclude erasure.

9. Data processing in relation to a business relationship

If you contact us within the framework of a business relationship or in order to enter into one, the personal data transmitted with your enquiry or your offer will be stored by us.

We process the personal data that are necessary for the initiation or performance of the business relationship. This includes in particular your first name and surname, your company and your contact details, as well as further data necessary for the submission of an offer, depending on the nature and scope of the business. Your details may be stored in a customer relationship management system or a comparable enquiry management system.

If you contact us via a contact form on our websites or an e-mail address provided by us, we store your e-mail address, your name and the content of the message. With regard to the contact form, the principles of data minimisation and data avoidance are observed, as the data required are marked as mandatory fields. These are your first name and surname, your e-mail address and your enquiry.

If your company is a customer of ours and you have provided your e-mail address as contact details for the processing of orders, we will also send you information about our products without your express consent. In such a case, only information about our own similar products will be sent by e-mail. We also send you Christmas cards and similar communications in line with social convention. For this purpose we store and process your form of address, your first name and surname, your company and your e-mail address.

In the course of performing the business relationship we also process personal data within the framework of our business organisation, financial accounting and archiving. In this respect we also disclose or transmit data to the tax authorities, to advisers such as auditors, and to payment service providers.

The legal basis for the processing of the data is Art. 6 (1) sentence 1 lit. f GDPR: the data processing serves the pursuit of legitimate interests, in particular the handling of the matter transmitted with your communication. With regard to financial accounting and compliance with statutory obligations, the legal basis is additionally Art. 6 (1) lit. c GDPR. We also have a legitimate interest in sending you product information tailored to your advisory needs as well as communications in line with social convention, such as Christmas cards, and thereby fostering our business relationship with you. The legal basis for sending product information in connection with the sale of goods is Section 7 (3) of the German Act Against Unfair Competition (UWG).

We store your data until the end of the business relationship, plus any applicable retention obligations. We erase enquiries once we can consider the matter settled in the circumstances or the relevant issue has been clarified, or we restrict the processing where statutory retention obligations exist. Storage takes place for the purpose of handling the matter transmitted with your communication.

10. Data processing in relation to social networks

You can also find us on social networks, currently on LinkedIn, Facebook and Instagram. The controller on our side is PaintSystems GmbH.

We do not use any social plug-ins on our website. In the page footer we merely link to our profiles using our own, locally stored icon. Only when you click one of these links and open the page of the respective network does your browser establish a connection to its servers; from that point onwards the privacy provisions of the respective provider apply. As long as you do not click the link, no data whatsoever are transmitted to the social networks.

If you visit our profiles, the respective provider may assign your visit to your user account there if you are logged in. You can largely avoid this by logging out beforehand and deleting any cookies that have been set.

On their websites, the providers of the social networks make detailed information available on the scope, nature, purpose and further processing of your data. There you will also find further information on your rights and on the settings available to protect your privacy.

(1) LinkedIn

The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. You can find the privacy policy at https://www.linkedin.com/legal/privacy-policy.

(2) Facebook and Facebook page

The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. You can find the privacy policy at https://www.facebook.com/about/privacy/.

We are jointly responsible with Meta Platforms Ireland Limited for our Facebook page. Under joint controllership we analyse how you use our page (page insights). You can obtain the information required under the GDPR on this processing from Meta, currently at https://www.facebook.com/privacy/explanation. Meta currently makes the relevant content of the agreement concluded between Meta and us pursuant to Art. 26 GDPR available at https://www.facebook.com/legal/terms/page_controller_addendum.

Within the framework of page insights we ourselves receive only anonymised statistics; we have no access to personal data processed by Meta.

Our pages on social networks offer community functions through which you can interact with other users, for example by posting contributions, leaving comments or giving "like" ratings. We point out that these areas are publicly accessible and that any personal information you post there can be viewed by others. We cannot control how other users use this information and in particular cannot prevent unwanted messages from being sent to you.

(3) Instagram and Instagram page

The provider is likewise Meta Platforms Ireland Limited. You can obtain information on the privacy settings at https://help.instagram.com/155833707900388. The statements under (2) apply accordingly to our Instagram page.

(4) Legal bases

Operating our profiles on social networks serves to make us and our products better known. The underlying advertising purpose is to be regarded as a legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR. The processing of the anonymised statistics by us is likewise based on Art. 6 (1) sentence 1 lit. f GDPR, as we have a legitimate interest in gaining a better understanding of the interests of the visitors to our pages.

11. Data processing in relation to our events

We regularly hold events for customers and prospective customers. You can register for these events by telephone, fax or e-mail.

The controller responsible for the data processing is PaintSystems GmbH. The details required to register for an event are your first name and surname, your address and your e-mail address. Providing further data is voluntary. Your data are used to hold the event.

If you additionally declare that you would like to be invited to events by e-mail in future, your personal data, including your e-mail address, will be used for the purpose of informing you about the events in which you have told us you are interested.

If your company is a business partner of ours and you are known to us as a contact person, we will also send you information about events of a training character, such as workshops and forums, and about professional exchange, without your express consent, where their thematic orientation matches the business of your company and where they serve to foster the business relationship. For this purpose we store and process your first name and surname, your address and your e-mail address.

The legal basis for the processing is Art. 6 (1) sentence 1 lit. a GDPR insofar as you have given your consent. The legal basis is furthermore Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in being able to offer you events of a training character corresponding to the interests of your company and in fostering our business relationship.

We store your data until the event has been held, or permanently if you have expressed an interest in being invited to further events in future, until you object to any further use of your personal data. You may object at any time to the use of your personal data for the purpose of sending you invitation e-mails and event information, incurring no costs other than the transmission costs according to the basic rates. You can address your objection in writing or by e-mail to the address stated above, marketing department. You can also use the option provided in an e-mail sent to you to prevent the receipt of further e-mails by clicking a button.

12. Data processing in relation to applications

We process the personal data you have sent us in connection with an application in order to assess your suitability for the position (or, where applicable, other vacancies with us) and to conduct the application procedure. The controller responsible for the data processing is PaintSystems GmbH.

Where we offer this, you may also submit your application via social networks (e.g. LinkedIn, Xing, etc.). The data are transmitted to us in encrypted form in accordance with the state of the art. You may also send us your application by e-mail. In this case, however, please note that e-mails are generally not sent in encrypted form and that you must arrange for encryption yourself. We can therefore accept no responsibility for the transmission path of the application between the sender and receipt on our server.

Your personal data are collected and processed by us for the decision on the establishment of a contractual relationship for which you have applied (employment, vocational training, internship or another contractual relationship).

The legal basis for the processing is Art. 6 (1) sentence 1 lit. b GDPR in conjunction with Section 26 BDSG. Insofar as the contractual relationship for which you have applied is not an employment relationship within the meaning of Section 26 (8) BDSG (that is, in particular not an employment relationship or employment for vocational training), the legal basis is Art. 6 (1) sentence 1 lit. b GDPR. Your personal data may additionally be processed on the basis of further provisions of employment law, vocational training law and social law. Insofar as processing of your personal data is necessary to fulfil a legal obligation to which we are subject, this processing is based on Art. 6 (1) sentence 1 lit. c GDPR.

Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR are communicated voluntarily in the course of the application procedure, they are processed pursuant to Art. 9 (2) lit. b GDPR (e.g. health data, severe disability status or ethnic origin). Insofar as we request personal data within the meaning of Art. 9 (1) GDPR from you, they are additionally processed pursuant to Art. 9 (2) lit. a GDPR (e.g. health data where these are necessary for the exercise of the profession).

In the event of a successful application, the data you provide may be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a vacancy is unsuccessful, your personal data will be erased. The duration of storage therefore depends on the duration of the decision-making process. Your personal data will likewise be erased if the application is withdrawn, which you are entitled to do at any time.

Subject to your withdrawal, erasure takes place after six months at the latest, so that we can answer any follow-up questions regarding the application and comply with our duties of proof under the General Equal Treatment Act. Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

Should you have sent us an unsolicited application – that is, an application that does not relate to a specific position advertised by us – we will likewise process your personal data in order to decide on the establishment of a contractual relationship. The above statements apply accordingly, whereby we will generally erase your data if, in our view, it is not foreseeable that your personal data might be used for a decision on the establishment of a contractual relationship.

In individual cases a storage period may arise that goes beyond the decision on the establishment of a contractual relationship. This would be the case, for example, where there are indications that you will assert claims against us. Storage then takes place for as long as the processing of the data is necessary for the assertion, exercise or defence of legal claims. The criteria for the storage period may include the time limits under the General Equal Treatment Act and the Labour Courts Act (Section 15 (4) sentence 1 AGG; Section 61b ArbGG) as well as limitation periods or statutory retention periods.

13. Data processing in relation to visitors

If you visit or wish to visit our company premises as a visitor, we process the personal data you transmit. This includes, for example, your name and your company if you announce your visit for a business meeting or for the performance of services. Our reception staff note and store your name as well as the time and duration of your stay. Your personal data are also processed if images of you are recorded by video cameras that we have installed in order to protect our property and our right of domicile.

The legal basis for the processing of your personal data is Art. 6 (1) sentence 1 lit. f GDPR. We have a legitimate interest in monitoring who enters our business premises and company site in order to prevent access by unauthorised persons. With regard to entering buildings, in particular the production halls, we also process your personal data for reasons of fire protection and occupational safety. In this respect we are required by law to be able to determine at any time how many persons are present in the buildings. Because it is recognisable, the video surveillance is intended to have a preventive effect and to deter conduct directed against us. Video recordings also serve to clarify criminal offences and other relevant incidents.

Where you have transmitted personal data to us as a visitor, your personal data will generally be erased after the end of the visit, unless you have expressly requested that we continue to store your personal data, for example in order to be invited to our events in future or to receive information from us. Video recordings are generally stored for only a few days. A longer storage period may also arise in these cases where, in an individual case, there are indications that you will assert claims against us or that the assertion of such claims by us may be considered. Storage then takes place for as long as the processing of the data is necessary for the assertion, exercise or defence of legal claims, plus the duration of any statutory retention periods that may exist.

14. Currency and amendments

This privacy policy is currently valid and dated August 2026. Due to the further development of our website or as a result of changed statutory or official requirements, it may become necessary to amend this privacy policy.