Data Privacy

1. Controller and Data Protection Officer

Controller: AMF-Bruns GmbH & Co. KG, Hauptstraße 101, 26689 Apen, Germany; info@amf-bruns.de

Data Protection Officer: PLANIT // LEGAL Rechtsanwaltsgesellschaft mbH, Jungfernstieg 1, 20095 Hamburg, Germany; mail@planit.legal

2. General use of our websites (www.amf-foerderanlagen.de)

Below we provide general information about the legal bases, the purposes and, where applicable, the legitimate interests and the necessity of the processing of your personal data.

We have implemented SSL or TLS encryption on our website (recognizable by the “https://” in the address bar and the lock symbol) to protect personal data you transmit to us via our website from unauthorized access by third parties.

a) Data processing when visiting our website
When you visit our website, we collect personal data to enable you to use it (usage data). This includes your IP address and data on the beginning, end and scope of your use of the website, as well as, where applicable, data for identification purposes (e.g. your login data if you log in to a protected area). It also includes technical data transmitted by your browser, such as browser type / browser version, the previously visited website (referrer URL), monitor resolution, operating system and, where applicable, device information (e.g. device type), etc. We process this data to provide and to design this website in a needs-based manner, based on our legitimate interest (Art. 6(1)(f) GDPR).

b) Contact form
On our website you have the option of submitting inquiries and requests to us via the contact form. In this context, we process your first and last name, your e-mail address, the content of your message and, if you voluntarily provide it, your telephone number. Your data is processed in order to handle your inquiry and respond to you.

If your inquiry relates to the performance of an existing contract or to the initiation of a contractual relationship (e.g. product or service inquiry, order, complaint), the legal basis for the processing is Art. 6(1)(b) GDPR.

In all other cases, the processing is based on our legitimate interest in the efficient and structured handling of your inquiry pursuant to Art. 6(1)(f) GDPR. In that case, you have the right to object to the processing under the conditions set out in Art. 21(1) GDPR.

3. Additional data processing when visiting our website

When you visit our website www.amf-foerderanlagen.de, we process personal data about you in addition to the purposes listed under section 2, as described below.

a) Access to and storage on your device (“cookies”)
We use tracking technologies on our website that enable us, as well as our contractual partners or service providers, to collect data relating to the use of our website. These tracking technologies are commonly referred to as cookies, which is why we also use this term below. However, the following statements also apply accordingly to other tracking technologies or file formats, such as local storage, pixels, beacons or tags. Cookies are text files that are stored on your device via the browser. User-related pseudonymous data may be stored in these files, which can then in turn be read out. When you visit our website amf-foerderanlagen.de for the first time, we display a so-called cookie consent banner to inform you about the tracking technologies we use and to give you the choice of which optional cookies you wish to consent to. You can change your selection at any time in the Privacy Preference Center on our website (see (iv) below).

i. Technically necessary cookies
In certain cases, the storage of information on your device or access to information already stored on your device is strictly necessary in order for us to be able to provide you with our website (“necessary cookies” or “essential cookies”). In these cases, access to your device is based on Section 25(2) No. 2 TDDDG. To the extent that this information relates to a person and is further processed by us in our IT systems, the legal basis for this processing is our legitimate interest in providing our website and ensuring data security, Art. 6(1)(f) GDPR.

ii. Cookies requiring consent
We only use cookies that are not strictly technically necessary with your consent. We use the following categories of cookies that require consent:

• Performance cookies: These cookies allow us to count visits and traffic sources so that we can measure and improve the performance of our website. They help us answer questions such as which pages are the most popular, which are used the least, and how visitors move around the website. All information collected by these cookies is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you visited our website.
• Functional cookies: These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we use on our pages. If you do not allow these cookies, some or all of these services may not function properly.
• Cookies for marketing purposes: These cookies may be set on our website by our advertising partners. They may be used by these companies to build a profile of your interests and to show you relevant advertisements on other websites. They do not directly store personal data but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

You can find further information on the file names, storage period, provider and category of each cookie in the cookie settings of the cookie consent banner or the privacy preference center of the respective website (listed there under the categories “Statistics” or “External Media”).

By clicking on the relevant button (“Accept all” or, following an individual selection, “Save”) in the cookie consent banner or the privacy preference center, you consent both to the storage and reading of information in these optional cookies (Section 25(1) TDDDG) via our website and to the further processing of any personal data read out in this way (Art. 6(1)(a) GDPR).

iii. Transfer to third countries
We use cookies and services from third-party providers on our website that are based or have server locations in third countries outside the European Union (EU) and the European Economic Area (EEA). The level of data protection in these third countries is generally not comparable to that of the EU. However, in accordance with the requirements of the GDPR (Art. 44 et seq. GDPR), we ensure that your data remains adequately protected.

The EU-U.S. Data Privacy Framework was established for data transfers to the USA. For US providers certified under this framework, the EU Commission assumes an adequate level of data protection for transfers. These certified providers include Cloudflare Inc., Meta Inc. and Google LLC (the official list can be found at https://www.dataprivacyframework.gov/list).

For providers without corresponding certification or from other third countries, we use – where necessary – appropriate safeguards in accordance with Art. 44 et seq. GDPR, in particular the standard contractual clauses of the EU Commission.

iv. Withdrawing your consent
You can withdraw the consent you gave in the cookie consent banner at any time with effect for the future (Art. 7(3) GDPR). To do so, go to the privacy preference center on our website. You can access the privacy preference center by clicking on the “Cookie Settings” link in the bottom left-hand corner of our website. In the privacy preference center, you have the option of withdrawing consent already given by deselecting the relevant cookies and granting it again. You can also select additional cookies there and thereby give us further consent.

Your selection of optional cookies is in turn stored as a cookie of our cookie consent management provider, Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany, in your browser.

b) Use of Google services
We use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website. If you consent to the use of these services in our cookie consent banner or the privacy preference center, Google processes personal data in connection with your use of our website.

This may in particular involve the processing of online identifiers (e.g. cookie IDs), usage data, device and browser information, and approximate location data. Processing is carried out through the use of cookies and comparable technologies.

Insofar as Google Analytics is used, the IP address is, according to Google, not stored. The IP address is processed only briefly to derive location information and is then deleted.

The legal basis for the use of Google services is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via our Privacy Preference Center:

A transfer of personal data to the USA cannot be ruled out. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is certified under the EU-US Data Privacy Framework. The data transfer therefore takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR. You can view Google’s privacy policy here.

i. Google Analytics in particular
If you consent to the setting of the Google Analytics cookie in our cookie consent banner or the privacy preference center on our website, Google collects data relating to your use of our website. This allows Google to associate data relating to usage behavior on our website with the respective pseudonymous user. We have instructed Google to use this information to evaluate website usage behavior, to compile reports on website activity, and to provide us with further services relating to website usage and internet use.

ii. Google Ads, Google Ads Remarketing in particular
Google Ads enables us to display advertisements in the Google search engine or on third-party websites when you enter certain search terms into Google (keyword targeting). In addition, targeted advertisements can be displayed based on user data available at Google (e.g. location data and interests) (audience targeting). We can evaluate this data quantitatively, for example by analyzing which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.

With Google Ads Remarketing, we can assign persons who interact with our online offering to specific target groups in order to subsequently show them interest-based advertising within the Google advertising network (remarketing or retargeting). Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google’s cross-device functions. In this way, interest-based, personalized advertising messages that have been tailored to you based on your previous usage and browsing behavior on one device (e.g. mobile phone) can also be displayed on another of your devices (e.g. tablet or PC). You can withdraw your consent to personalized advertising at any time via our Privacy Preference Center [Link]. In addition, you can object to personalized advertising directly in your Google account here.

iii. Google Conversion Tracking
With the help of Google Conversion Tracking via Google Tag Manager, Google and we can recognize whether users have carried out certain actions. For example, we can evaluate which buttons on our website are clicked and how often, and which products are viewed or purchased particularly frequently. This information is used to compile conversion statistics. We learn the total number of users who have clicked on our advertisements and which actions they have carried out. We do not receive any information that would allow us to personally identify the user. Google itself uses cookies or comparable recognition technologies for identification purposes.

iv. Google Maps
We use Google Maps in the interest of presenting our online offerings in an appealing way and making it easy to find the locations we provide on our website.

v. Integration of YouTube videos
Videos from YouTube, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, are embedded on our website. With your consent via our cookie banner (Art. 6(1)(a) GDPR), a connection to YouTube is established and the YouTube video is loaded accordingly. In doing so, personal data (e.g. IP address, device information) may be transmitted to YouTube or Google, and cookies may be set. YouTube also recognizes which subpage you have visited.

In this context, Google may also transfer data to the USA. Google is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection for the data transfer pursuant to Art. 45 GDPR.

Google itself is responsible under data protection law for the subsequent processing of data after accessing the YouTube platform. We have no influence over this data processing.

Further information on data processing by Google can be found in Google’s privacy policy at: https://policies.google.com/privacy.

c) Use of a Content Delivery Network (Cloudflare)
We use the “Cloudflare” service. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare offers a globally distributed content delivery network with DNS. In technical terms, the transfer of information between your browser and our website is routed through Cloudflare’s network. This enables Cloudflare to analyze the traffic between your browser and our website and to act as a filter between our servers and potentially malicious traffic from the internet. Cloudflare may also use cookies or other technologies to recognize internet users, but these are used solely for the purpose described here. The use of Cloudflare is based on our legitimate interest in providing our web offering as reliably and securely as possible (Art. 6(1)(f) GDPR). A transfer of personal data to the USA cannot be ruled out. Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA, is certified under the EU-US Data Privacy Framework, so that the data transfer takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR.

Details can be found here. Further information on security and data protection at Cloudflare can be found here.

d) Honeypot
To protect our contact and registration forms from automated input and spam, we use a so-called honeypot mechanism. This is a technically hidden form field that cannot be filled in by human users. If this field is filled in, the request is recognized as automated and, where applicable, is not processed.

This processing is carried out solely to protect our website and forms from misuse and to ensure the functionality of our online offerings.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and IT systems from spam and automated attacks.

e) Google Fonts & Font Awesome (local hosting)
We use so-called fonts from Google (Google Fonts) and Fonticons Inc. (Font Awesome) on our website to ensure a consistent display of typefaces. The fonts of both providers are hosted locally by us. Accessing our website therefore does not result in a connection to Google or Fonticons servers in the USA.

Further information on Google Fonts can be found here and in Google’s privacy policy: Here.

Further information on Font Awesome can be found in the Font Awesome privacy policy: Here.

4) Visiting our Facebook fan page and Instagram profile (Insights)
When you visit or interact with our Facebook fan page or Instagram profile, personal data is processed.

a) Joint controllership
Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”) is, in principle, responsible for the processing of personal data in connection with the operation of the Facebook or Instagram platform.

We process personal data in connection with the operation of our fan page or our Instagram profile on our own responsibility, in particular in the context of publishing content and interacting with users.

Insofar as Meta provides us with aggregated usage statistics as part of so-called “Page Insights”, this may constitute joint controllership within the meaning of Art. 26 GDPR, particularly with regard to the processing of “Page Insights” data.

b) Legal basis and purpose of the processing of your personal data
We operate our Facebook fan page to present our company, communicate with users, and analyze and optimize the reach and use of our content.

Our processing of personal data in this respect is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in effective public relations, communication with users, and the needs-based design and optimization of our online presences.

Insofar as you interact with our content (e.g. through “likes”, comments or messages), we process the data you provide in order to handle your inquiry or to communicate with you.

Personal data collected by Meta in connection with the use of the platform (e.g. usage data, cookies, tracking) is processed by Meta on its own responsibility. We have no influence over this data processing.

c) Further information on our joint controllership with Meta
For certain processing activities in connection with “Page Insights”, we have entered into a joint controllership agreement with Meta pursuant to Art. 26 GDPR.

This agreement governs in particular the respective responsibilities with regard to the exercise of data subject rights and the fulfillment of information obligations. Regardless of this, you can assert your rights against both Meta and us.

Further information on Page Insights data and the exercise of your rights can be found here in Meta’s information. For further information on the allocation of responsibilities within the joint controllership within the meaning of Art. 26 GDPR, see the agreement with Facebook: Here.

Meta is certified under the EU-US Data Privacy Framework, so that the data transfer takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR. Details can be found here and here.

You can also deactivate the remarketing function “Custom Audiences” in the advertising settings section here . To do so, you must be logged in to Facebook.

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: Here.

Further information on the setting of cookies when visiting our fan page can be found in Meta’s Cookie Policy.

Further information on the protection of your privacy at Meta can be found in Meta’s privacy policy: Here.

Further information on data protection at Instagram can be found here.

5) LinkedIn
We maintain an online presence within the social network “LinkedIn” in order to communicate with users active there and to provide information about our company.

Insofar as you visit or interact with our LinkedIn page, we process personal data, in particular in the context of communicating with you and providing content.

Our processing of your personal data in this respect is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in effective public relations and communication with users.

Otherwise, the processing of personal data in connection with the operation of the platform is carried out by LinkedIn on its own responsibility.

Insofar as LinkedIn provides us with aggregated information on the use of our LinkedIn page as part of its analysis functions, this may constitute joint controllership within the meaning of Art. 26 GDPR. You can assert your data subject rights against both LinkedIn and us. As LinkedIn has direct access to user data, contacting LinkedIn directly may be more efficient in certain cases. Of course, you can also contact us at any time.

The service provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

A transfer of personal data to the USA cannot be ruled out. LinkedIn is certified under the EU-US Data Privacy Framework, so that the data transfer takes place on the basis of Art. 45 GDPR.

Further information on data protection at LinkedIn can be found in LinkedIn’s privacy policy.

6) Entering into and performing contracts
In order to enter into or perform contracts with you (contract of sale), we process personal data relating to you. The legal basis for this is Art. 6(1)(b) GDPR. We process your personal data to establish and perform the contractual relationship with you. This requires you to provide your personal data. You are not obliged to provide your personal data; however, if you do not provide it, it will not be possible to establish or perform the contractual relationship. Otherwise, this will have no consequences for you

7. Visit to our premises (video surveillance)
If you visit our business premises, we monitor the outdoor areas and the car park in part by means of video systems. These areas are marked with the following pictogram:

The legal basis for this data processing is Art. 6(1)(f) GDPR. The purpose we pursue is the prevention, detection and investigation of criminal offenses, the exercise of our right to determine who may access the premises, and compliance with our duties of care in traffic. Our legitimate interest within the meaning of Art. 6(1)(f) GDPR is the protection of our property as well as the property and physical integrity of all visitors and employees.

Video surveillance recordings are generally deleted after a period of 72 hours at the latest. In justified individual cases, in particular for criminal investigations or the preservation of evidence, recordings are kept for longer and deleted once this purpose has been fulfilled.

8) Visiting our business and production premises (visitor process)
If you visit our business or production premises as a guest, we process the following data: surname, first name, employer, date of visit. The legal basis for this is Art. 6(1)(f) GDPR. The purpose we pursue is the prevention, detection and investigation of criminal offenses, the exercise of our right to determine who may access the premises, and compliance with our duties of care in traffic. Our legitimate interest within the meaning of Art. 6(1)(f) GDPR is the protection of our property as well as the property and physical integrity of all visitors and employees.

9) Applying for a job
We process your personal data as part of the application process. The legal basis for this is Art. 6(1)(b) GDPR. The data processing takes place in connection with the initiation of an employment relationship with you. We process your personal data for the purpose of contacting you and assessing your suitability for the position you are applying for. It is not possible to apply to AMF-Bruns without providing personal data. You are neither obliged to apply to AMF-Bruns nor to provide personal data. If you do not provide us with personal data, we may not be able to consider your application.

In the event of a rejection, your application data will generally be deleted six months after completion of the application process, unless another legal basis (e.g. your consent to inclusion in a talent pool) or statutory retention obligations preclude erasure.

10) Ordinary contact in the course of business operations (e.g. trade fairs)
This section describes circumstances that result in the processing of personal data that is customary in the ordinary course of business.

These are, in particular, cases such as the spontaneous exchange of contact details at trade fairs, events, business meals or other business activities, e.g. through the exchange of business cards, or the initial contact by AMF-Bruns or by you with business content, e.g. by entering data in a contact form. We also process your personal data if you contact us via other communication channels (e-mail or similar).

The legal basis is Art. 6(1)(b) GDPR, provided that the contact serves to initiate or perform a contract.

In all other cases, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in effective business communication and building a business relationship.

We collect the following categories of personal data on the occasion of your or our contact: contact details such as your name, address, e-mail address or telephone number; data on your company such as address, e-mail address, field of business, job description, title; and data on your input/inquiry such as content, time of the inquiry, means of communication. This data is processed for storage in our contact databases as part of our business activities, e.g. in e-mail programs, telephone directories, card indexes, etc., for the purpose of resuming contact and/or handling your request and its further processing.

Insofar as the processing is based on our legitimate interest, you have the right to object to the processing under the conditions set out in Art. 21(1) GDPR.

We store this data for the duration of the active business relationship or until the purpose of the contact has been achieved, unless statutory retention obligations preclude this.

11) Sending advertising and information flyers (postal advertising)
We use the personal data you have provided to us in the course of a business relationship with us to send you advertising and information flyers. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in maintaining the customer relationship, providing information about our products, services and events, and general corporate communication.

You may object to the use of your data for advertising purposes at any time with effect for the future. An informal notification to the contact details listed under item 1 is sufficient for this purpose (e.g. by e-mail to info@amf-bruns.de). Once we have received your objection, your data will be blocked for advertising purposes

12) Transfer to recipients of personal data within the EEA
We only disclose the personal data described in this privacy policy to the extent that this is necessary for the provision of our service or is required by law in this context. For the purposes stated here, personal data is forwarded to service providers who work for us and support us in particular in the provision of our services. In addition to their statutory obligation to comply with all data protection provisions, these service providers are bound by us to further contractual data protection requirements. This includes, in particular, an obligation as a processor pursuant to Art. 28 GDPR. In particular, we disclose personal data to the following categories of service providers:

• accounting, financial institutions, tax and legal advice,
• IT services and infrastructure/hosting,
• IT support and maintenance,
• data destruction and facility services.

Otherwise, we only transfer personal data to other recipients if there is a legal permission for this or if you have previously given your consent. You may withdraw any consent given at any time with effect for the future. We only disclose your data to government authorities within the scope of legal obligations or on the basis of an official order or court decision, and only to the extent permitted under data protection law.

13) Transfer to recipients of personal data in countries outside the EEA
In this context, we may transfer your personal data to processors or sub-processors in countries outside the European Union (“EU”) and the European Economic Area (“EEA”), in particular the USA. These data transfers generally take place on the basis of the EU Commission’s adequacy decision of 10 July 2023 (C(2023) 4745). Where no adequacy decision exists, we use, in particular, the EU Commission’s standard contractual clauses for the transfer of personal data to third countries (see Art. 46 GDPR).

In particular, we disclose personal data to the following categories of service providers:

• web analytics,
• intra-group processing and transfer of data

14) Erasure
We erase your personal data as soon as processing is no longer necessary for the purposes explained in this privacy policy. If and as long as statutory retention obligations preclude erasure, we restrict the processing of your data to this archiving purpose (so-called data blocking) and erase the data once the retention period has expired.

15) Your rights
As a data subject of the processing, you have the following rights:

• The right to confirmation as to whether we process data relating to you (Art. 15 GDPR).
• The right to access the personal data we process about you and to a copy of this data (Art. 15 GDPR)
• The right to rectification in the event that your personal data is inaccurate (Art. 16 GDPR).
• The right to erasure of your personal data (Art. 17 GDPR).
• The right to restriction (blocking) of your personal data
  (Art. 18 GDPR).
• The right to data portability (Art. 20 GDPR).

If your personal data is processed on the basis of Art. 6(1)(f) GDPR, you also have the right, under the conditions set out in Art. 21(1) GDPR, to object to the processing in question. You may object at any time, without giving reasons, with effect for the future, to the processing of your personal data for direct marketing purposes (Art. 21(2) GDPR).

If the processing is based on your consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, you may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). You can withdraw the consent given via the cookie consent banner here:

You also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR).

If you have any questions or complaints regarding data protection at AMF-Bruns, we recommend that you first contact our Data Protection Officer (see the contact details under section 1).

16) No automated individual decision-making
We do not use your personal data for automated individual decision-making within the meaning of Art. 22(1) GDPR.

Changes to this privacy policy
New legal requirements, business decisions or technical developments may require changes to our privacy policy. The privacy policy will be adjusted accordingly. The most current version can always be found on our website.

Last updated: July 2026