Viessmann Data Protection Statement

General information

We, Viessmann Holding International GmbH (hereinafter "Viessmann" or "we") as part of the Carrier Global Corporation, take the protection of your personal data very seriously and adhere strictly to the rules of the applicable data protection laws. These include above all the General Data Protection Regulation (hereinafter: "GDPR", Regulation (EU) 2016/679 of the European Parliament and of the Council.

Personal data is collected on our websites and when using our apps and services only to the extent necessary and processed for the specific purpose. Personal data is data that identifies you personally or other data linked to you.

Responsible body within the meaning of Data Protection Legislation

Viessmann Holding International GmbH
Viessmannstraße 1
D-35108 Allendorf (Eder)
Phone: +49 6452 70-0
Fax: +49 6452 70-2780
E-Mail: info@viessmann.com

Processing within Viessmann

Acting on our behalf, Viessmann Holding International GmbH, operates:

• Viessmann Deutschland GmbH for sales and marketing purposes
• Viessmann Climate Solutions Berlin GmbH for the operation of the websites and apps as well as marketing
• Viessmann IT Service GmbH for the operation of backend systems
• Viessmann Solutions & Services GmbH

The data collected can be processed or passed on to other Viessmann Holding International group companies if:

• you have given your express and informed consent elsewhere (e.g. reference in the enquiry form),
• it is necessary with a specific purpose and the division of labour within the Viessmann Holding International; corresponding contractual agreements have been concluded within the Viessmann Holding International for this purpose,
• the data is made available pseudonymised by the responsible party and the responsible party guarantees that the commissioned group company cannot de-pseudonymise this data, or
• the data is stored anonymously by the responsible body and the data stored in this way is no longer subject to data protection regulations.

Transfer to third countries

The companies of the Viessmann Holding International process/transmit the data provided by you in/at locations in Germany, the European Union and third countries (including the USA) which have an appropriate level of data protection in accordance with Article 45 GDPR or offer suitable guarantees in accordance with Article 46 GDPR.

Scope of the data protection statement

The following statement gives you an overview of how we guarantee data protection, what kind of data is collected and processed for what purpose and on what legal basis. It applies in principle to all websites and apps for which Viessmann is responsible. If Viessmann websites and apps deviate from these principles of data processing or supplement them with their own, this will be indicated in a suitable manner on the corresponding websites or in the apps.

This privacy policy consists of five parts:

• The first part (regulations for private users) applies to the private users of Viessmann services.
• The second part (provisions for business users) applies to business users of Viessmann services.
• The third part (regulations for applicants) applies to the private users of Viessmann services with regard to applications.
• The fourth part (general information and regulations for Viessmann websites and apps) applies to all users using Viessmann services or websites and apps.
• The fifth part (information on rights of data subjects) applies to all users whose data is subject to data protection law, but not legal entities.

Furthermore, our websites may contain links to websites of other providers to which this data protection declaration does not apply.

I. Regulations for private users

This part of the data protection statement applies to private users of Viessmann Services. The legal basis for processing your data is based on your consent to this data protection statement as consent or in order to be able to provide you with information, services or products requested in accordance with GDPR Article 6 Para.1 lit.b).

Use and verification of personal data

The following, are some of the personal data types you provide:

• your name
• your address (postal code, city, street and house number, address supplements if applicable)
• your email address
• your date of birth
• your sex
• your telephone number and/or mobile phone number
• your country
• your payment information
• your heating specialist used so far
• product name of your Viessmann product
• serial number of your Viessmann product

If you provide us with personal data, we use it to answer your questions, to process and carry out your consultation request, for technical administration, for login activities and the services provided within the respective websites or apps. The legal basis for this is Art. 6 para. 1 sentence 1 b GDPR or your consent. You can revoke your consent to the use of your provided data at any time. To do so, please contact: datenschutz@viessmann.com, stating the service(s) used if possible.

Viessmann contact by telephone

If you have agreed to our data protection statement and have given us your telephone number when making a consultation request, we will contact you by telephone before forwarding your consultation request to our partner company in order to check the accuracy of your information, to discuss your project and to be able to refer you to the appropriate specialist company.

Information about the transfer of your data and evaluation

If you have agreed to our data protection statement and provided us with your e-mail address when making a consultation request, we will inform you by e-mail about the current status of your consultation request via our service. Among other things, we will send you a message with the contact details of the referred specialist partner and, after your consultation, an opportunity to evaluate this specialist company. If you do not provide your e-mail address when you request specialist advice, we cannot provide you with a specialist advice service.

Passing on of personal data

With your consent, we will forward the personal data you have entered to external specialist companies who cooperate with our company as partners and who are active in your region, in order to provide the service of providing specialist advice and/or the purchase, maintenance or repair of a heating system or other product from the Viessmann product range.

This specialist partner will be asked to contact you within a fixed time frame in order to be able to provide the specialist advice and/or quotation you have requested. For this purpose, the specialist company will contact you by e-mail and/or telephone.

Payment via Stripe

Within the scope of contract conclusions, delivery and service as well as some programming interfaces, so-called APIs, for the creation of own applications, we offer payment via Stripe (e.g. conclusion of service agreements, orders, within the scope of the Viessmann Developer Portal). Data is only transmitted to Stripe if you have given your prior consent by means of a checkbox. The provider of this payment service is Stripe Payments Europe, Ltd, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland (hereinafter "Stripe"). Stripe collects your contact information as well as payment information such as payment type, credit card number, account numbers and the amounts to be paid. In addition, Stripe sets cookies to perform the payment process and to ensure the security of the payment process.

We have entered into a data processing agreement with Stripe pursuant to Article 28 GDPR. Due to the fact that Stripe is headquartered in the USA and because payments (depending on the bank or credit institution involved) may be processed outside the European Union, we have also concluded a contract with Stripe in accordance with the EU Commission's standard contractual clauses to protect your data in the event of a third country transfer. For more information on Stripe's data protection, please visit www.stripe.com/de/privacy.

The legal basis for the transfer of data by us to Stripe is your consent (Article 6 (1) 1 a GDPR). You may revoke your consent at any time. For this purpose, it is sufficient to send an e-mail to revoke+stripe+de@viessmann.com.  The effect of the revocation refers only to the future. A payment transaction once ordered can no longer be influenced by the revocation under the rules.

We store the data only insofar as this is necessary for invoicing and for compliance with the statutory retention obligations for invoices.

Further processing and deletion of your data

Furthermore, your data will not be passed on or sold to third parties, i.e. persons or companies not belonging to Viessmann Holding International GmbH. Stored personal data will be deleted if you revoke your consent to its storage, if the data is no longer required for the purpose intended by the storage or if its storage is inadmissible for other legal reasons.

Advertising and advertising consent

We, i.e. Viessmann Holding International GmbH, as part of the Carrier Global Corporation, Viessmann Deutschland GmbH and Viessmann Climate Solutions Berlin GmbH, will only inform and ask you about Viessmann products and services by e-mail, post or telephone and if you have expressly given us your consent to use your personal data for advertising purposes (opt-in).

This is done by actively ticking the box next to the statement, "Yes, Viessmann Limited may contact me by e-mail and telephone to fulfill my consultation request and to keep me informed about the latest products and services. I also take advantage of my opportunity to participate in market/opinion surveys. I may revoke this consent at any time with future effect."

Please note: The text displayed on the respective website/app may list different companies if they are affected by your request.

If you have given us your consent for such use but no longer wish to receive advertising or surveys from Viessmann in future, you can revoke your future consent at any time. Your data will then be deleted or, if it is still required for billing and accounting purposes, stored for these purposes. Please send an e-mail to datenschutz@viessmann.com.

Participation in competitions

Viessmann regularly organises competitions in which you can participate on the basis of consent in accordance with Art. 6 Para. 1 Sentence 1 a GDPR by providing your name and contact details (e.g. address, email address or telephone number) and possibly other personal data. The data will only be processed for the purpose of carrying out these competitions in accordance with the respective competition conditions. Viessmann may use third parties (e.g. KickTipp) for this purpose. As a rule, the data is either deleted or made anonymous one month after the end of the competition. The winners' data will be stored in accordance with the usual statutory retention periods. Please also refer to the data protection declarations of the respective competitions or third parties commissioned to carry them out. You can revoke your consent to the processing of your data by us at any time. To do so, please contact us, always stating the name of the competition: revoke+competition+EN@viessmann.com.

Use of personal data when using the contact form

If you send us enquiries using one of our contact forms, your details from the enquiry form, including the contact data you have provided there, will be stored with us for the purpose of processing your enquiry and in the event of follow-up questions on the same subject. This data will not be passed on to third parties.

You can revoke your consent to the use of the data provided via the contact form at any time. Please contact: datenschutz@viessmann.com

II. Provisions for business users

This part of the data protection regulations only applies to business users such as trade businesses, industrial businesses, municipalities, commercial businesses, planners, architects, etc. and only insofar as these make personal data available from contact persons for the conclusion and execution of contracts in accordance with GDPR Article 6 Para.1 lit.b) on our websites and in our apps.

Personal data is collected and processed by Viessmann for the following purposes:

• Mediation of customer inquiries
• Mediation to inquiring customers
• Display in Viessmann specialist company directories (e.g. specialist partner on-site search at www.viessmann.co.uk)

As far as you have made personal data available to us, we use it only for answering your inquiries, for processing contracts concluded with you, for technical administration, for login activities and the services made available within the respective Internet pages or apps.

Stored personal data will be deleted if you revoke your consent to its storage, if it is no longer required for the purpose for which it was stored or if its storage is inadmissible for other legal reasons. Please contact datenschutz@viessmann.com. Your data will then be deleted or, if it is still necessary for verification, billing and/or accounting purposes, stored for these purposes.

For further personal data processed in the context of the delivery and performance of products and services pursuant to Article 6, paragraph 1, letter b), the data protection provisions in the respective general terms and conditions of sale apply.

III. Regulations for applicants

This part of the privacy policy applies to applicants for job advertisements of companies of the Viessmann Holding International or third parties to which Viessmann Holding International provides a platform or affiliate program for job advertisements/placement. This applies only to the extent that these applicants process personal data in the context of the application process, e.g. application in paper form, e-mail, contact forms with appendix or portals operated by Viessmann or the use of electronic job portals of third parties in accordance with the required content, also in accordance with further state legal requirements, to Viessmann. Application documents submitted on paper are scanned and stored in our systems, and the paper is then disposed of in compliance with data protection regulations by certified service providers.

We use your personal data only for the process of your application on the basis of your consent to this Privacy Policy. To process your application, insofar as required, the use of your data to contact us by e-mail and/or mail and/or phone and/or SMS. The recruiting and hiring managers of Viessmann Climate Solutions Berlin GmbH, Viessmann Holding International GmbH, of the respective group company as well as supervisors or other recruiting officers in whose area the vacancy is advertised. Another form of processing is done anonymously for the purpose of measuring the success of the appointments and the technical application channels used, as well as, anonymously, the submitted skills of applicants.

The data is processed using systems from Greenhouse Software, Inc., a US-based company. In accordance with Article 46 of the GDPR, Viessmann Climate Solutions Berlin GmbH has concluded a contract with Greenhouse based on the EU standard data protection clauses. A copy of the standard contractual clauses is available at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en. 

The deletion of the stored personal data of the applicant is automatically after 4 months from the date on which the applicant was informed that the position is not occupied by him and no other legal requirements oppose. The deadline results from the requirements of the General Equal Treatment Act. Only with your explicit consent to our request your data will remain stored in our system beyond this period in order to be considered for future other job postings.

IV. General information and regulations for Viessmann websites and apps

These provisions apply in addition to the provisions for private users and the provisions for business users for Viessmann websites and apps. Some of our apps have their own additional data protection statements. The Viessmann Apps ViCare and Vitotrol Plus data protection statement can be found under the following link:
https://legal-policies.viessmann.com/b2c/vicare/de/de/privacy-policy.ext.html

Data processing by accessing our Internet pages and using our apps

Viessmann automatically collects and stores information in its server log files that your browser or app transmits to us. Viessmann cannot assign this data to individual persons. This data is not merged with other data sources. These are:

• Browser type/ version
• Operating system used
• Referrer URL (the previously visited page)
• Host name of the accessing computer (IP addresses v4 and v6)
• Time of the server request

The IP address is the globally valid identification of your computer at the time of allocation by your Internet provider and consists, in its currently most common form (IPv4), of four blocks of digits separated by dots. In most cases, as a private user, you will not use a constant IP address, as this is only temporarily assigned to you by your provider (so-called "dynamic IP address"). With permanently assigned IP addresses (so-called "static IP addresses"), a clear assignment of user data via this feature is technically easy.

The mentioned data will be processed by us for the following purposes:

• Ensuring a smooth connection to the website
• Ensuring comfortable use of the aforementioned website
• Evaluation of system security and system stability
• For further administrative and statistical purposes

The personal data of the server log files is processed on the basis of Art. 6 para. 1 lit. f GDPR. This authorisation allows the processing of personal data in the "legitimate interest" of the person responsible, provided that your fundamental rights, freedoms or interests do not prevail. Our legitimate interest is in the easier administration and the ability to detect and track hacking. You can object to this data processing at any time if there are reasons which exist in your particular situation and which contradict the data processing. All you need to do is send an e-mail to the data protection officer. Our legitimate interest follows from the purposes listed above for data collection. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally.

The server log files with the above data are automatically deleted after 30 days or anonymised if used for statistics. We reserve the right to store the server log files for longer if facts exist which suggest the assumption of unauthorised access (such as an attempt at hacking or a so-called DDOS attack).

Data processing for access to our websites and apps - "Viessmann Account"

Viessmann uses a central identity and access management system ("IAM") in addition to conventional login functions (e.g. user ID and password) for granting, changing and deleting access and access authorisations for websites and apps that are not public or not freely usable. For this purpose, the following personal data will be processed from you:

• E-mail address
• Password
• Website / app used with last time stamp
• User role(s)
• Timestamp of last successful login
• First name, last name and other data (depending on the website / app used)
• Mobile/telephone number (for 2-factor authentication)

The above data is processed by us for the following purposes:

• Creation of the "Viessmann Account"
• Creation and management of access rights to apps and websites
• Creation and administration of role-based access rights within apps and websites
• Checking and display of authorisations by/for the respective responsible functions for the individual websites and apps at Viessmann
• Communication of information on the website and app used (e.g. changes, error messages, innovations, etc.)
• Creation and usage of aggregated (“anonymized”) key figures on the use of websites and apps

Depending on the website or app used, permission to process your personal data is granted for the following reasons

• The fulfilment of a contract with you in accordance with GDPR Art. 6 Para. 1 lit b, the subject of which also includes the use of Viessmann websites or apps,
• your consent in accordance with GDPR Art. 6 Para. 1 lit a if you are explicitly asked for this or
• in our legitimate interest according to GDPR Art. 6 Para. 1 lit. f.

The last-mentioned permission allows the processing of personal data within the framework of the "legitimate interest" of the controller, insofar as your fundamental rights, freedoms or interests do not prevail. Our legitimate interest is the efficient administration of access and access rights and the protection of the websites and apps as well as the data processed there against unauthorised use (e.g. disclosure, modification, deletion). You can object to this data processing at any time if there are reasons relating to your particular situation that speak against the data processing. An e-mail to the data protection officer is sufficient for this purpose. Before objecting, please check whether you cannot delete the user account yourself. Some user roles, especially those based on consent, also allow you to delete your personal data yourself as part of a self-service.

In no case do we use the collected data for the purpose of drawing further conclusions about your person or creating profiles.

The above-mentioned data will be automatically deleted or, in the case of use for statistics, anonymised if your user account is inactive for longer than 360 days (last time stamp of successful login or use of website or APP). You will receive corresponding information from us before this period expires. We reserve the right to store personal data for a longer period of time if this results from legal or contractual reasons or if facts exist that suggest the assumption of unauthorised access.

Linking to external websites

This data protection statement applies exclusively to the Viessmann websites and apps. These may contain links to third-party websites. This data protection statement does not extend to these. If you leave the Viessmann websites and apps in order to visit the services of a third-party provider, we recommend that you also carefully read this provider's data protection statement.

Information on cookies and the use of analysis tools

The processing of personal data through cookies and analysis tools (Google Analytics and Google Tag Manager, Google Adwords Conversion Tracking, Third-Party-Cookies, Re-Targeting-Technologies, Google Remarketing, Facebook Remarketing and Inspectlet) is based on Art. 6 Para. 1 lit. f GDPR. This authorisation allows the processing of personal data in the "legitimate interest" of the person responsible, provided that your fundamental rights, freedoms or interests do not prevail. Our legitimate interest is to analyse the use of our website.

The processing of personal data by Google AdWords (list all retargeting technologies) is based on Art. 6 Para. 1 lit. f GDPR. This authorisation allows the processing of personal data in the"legitimate interest" of the person responsible, provided that your fundamental rights, freedoms or interests do not prevail. Our legitimate interest is in the personalised display of targeted advertising and the statistical analysis of the effectiveness of advertising (e.g. determining how many clicks on an advertising banner have led to a purchase from our website).

Viessmann uses so-called cookies in several places on its websites and in its apps. They serve to make our website more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser. Most of the cookies we use are so-called "session cookies". They are automatically deleted at the end of your visit. Cookies do not cause any damage to your computer and do not contain any viruses.

Viessmann also uses analysis tools for this purpose, such as Web Trends or Google Tag Manager (Firebase). The data provided and used is collected and stored completely anonymously. This data may also be stored outside the United Kingdom or the European Union.

When implementing and using analysis tools and tracking technologies, we make personal data anonymous as quickly as possible either on the part of the provider, regulated by appropriate contracts, or within the scope of our first use, so that the right to information on your part cannot be exercised on all technologies listed below.

Third-Party-Cookies

Viessmann makes use of a number of advertising partners who help to make the Internet offer and the websites more interesting for you. For this reason, cookies from partner companies are also stored on your hard drive when you visit the websites. These are temporary/permanent cookies that are automatically deleted after the specified time. These temporary or permanent cookies (lifetime 14 days to 10 years) are stored on your hard disk and delete themselves after the specified time. The cookies of our partner companies also only contain pseudonymous, usually even anonymous data. This includes, for example, data on which products you have looked at, whether something was purchased, which products were searched for, and so on.

Some of our advertising partners collect information about which pages you have visited before or which products you have been interested in, for example, in order to be able to show you the advertising that best suits your interests. This pseudonymous data will never be combined with your personal data. Their sole purpose is to enable our advertising partners to address you with advertising that might actually be of interest to you.

Re-Targeting Technologies

Our websites use so-called re-targeting technologies. We use these technologies to make our website more interesting for you. This technology makes it possible to address Internet users who are already interested in our products with advertising on the websites of our partners. We are convinced that the insertion of personalised, interest-related advertising is generally more interesting for the Internet user than advertising that has no such personal reference. The insertion of these advertising materials on the pages of our partners is based on cookie technology and an analysis of the previous user behaviour. This form of advertising is completely pseudonymous. No user profiles are merged with your personal data.

By using our site, you consent to the use of so-called cookies and thus to the collection, storage and use of your user data. Furthermore, your data is stored in cookies beyond the end of the browser session, so that it can be called up again the next time you visit the website, for example. You can revoke this consent at any time with future effect by refusing to accept cookies in your browser settings.

Acxiom

Use of personal data for customer analysis and other advertising purposes

In order to select certain target groups on the basis of predefined criteria and to form and address new ideal-typical target groups (potential new customers) for the purpose of carrying out advertising activities, Viessmann has a service provider analyze pseudonymized or anonymized - and thus no longer assignable to a specific person - data of relevant interested parties and existing customers. 

On the basis of this analysis, advertising accounts on digital platforms can be used for the selected target groups for the purpose of target group-specific advertising targeting in which the strongly encrypted master data of potential new customers is matched with comparable strongly encrypted master data of Facebook or Google users pseudonymized there in order to advertise to them with campaigns of Viessmann. To carry out such processing, Viessmann commissions specialized companies, such as for Facebook activities Acxiom Deutschland GmbH, Martin-Behaim Str. 12, 63263 Neu-Isenburg, Germany, within the framework of order processing strictly for the intended purpose. Acxiom pseudonymizes all data of data subjects and, if necessary, acts as a so-called "trusted third party" when placing advertisements, e.g. on Facebook. On Facebook, for example, this processing appears in the advertising preferences under the item "Companies that have uploaded and shared a list with your information".

Personal data for the purpose of customer analysis is processed on the basis of Art. 6 (1) lit. f DSGVO. This permissive provision allows the processing of personal data in the context of the "legitimate interest" of the controller, unless your fundamental rights, freedoms or interests prevail. Our legitimate interest is the analysis to identify potential new customers as well as the purposes mentioned above. In no case do we use the collected data for the purpose of drawing conclusions about your person. You can object to this data processing at any time if there are reasons that exist in your particular situation and that speak against the data processing. To do so, simply send an e-mail to the data protection officer named below.