Data Protection

Table of Contents

I. Controller

II. Data Protection Officer

III. How, why and which of your personal data is collected and processed when you visit our websites

a) Data categories processed:

b) Processing purposes, legal basis and, if applicable, legitimate interests:

c) How long your personal data is stored:

d) The need for your approval to collect your data / consequences of withholding:

e) Google Maps

f) YouTube

IV. Processing of your personal data as part of our general business activities

a) Types of data and data categories processes

b) Purposes of processing and legal bases

c) How long your personal data is stored

d) The need for your approval to collect your data / consequences of withholding

e) Additional information on the processing of your personal data is processed when you contact us

f) Automated individual decision-making including profiling

V. Use of cookies

VI. Recipients

a) Data processors

b) Public authorities

c) Other recipients

VII. Transfers to countries outside the EU / EEA

VIII. Your rights

Thank you for your interest in our group of companies and our products.

The following privacy notice explains how Debrunner Metallservice AG (hereinafter also referred to as "Debrunner Metallservice", "we", or "us") processes your personal data within the scope of our general business operations, particularly for the purpose of delivering services. Personal data refers to any information relating to an identified or identifiable natural person (e.g. your first and last name, address, telephone number, or email address).

Below, we provide detailed information about which of your personal data we process, the purposes for which this data is used, and the rights to which you are entitled under applicable data protection law.

I. Controller

The data controller under data protection law is

Debrunner Koenig Group

Hinterlauben 8

9004 St. Gallen

Phone: +41 58 458 18 89

Email: info@metallservice.ch

II. Data Protection Officer

Here are the contact details of our Data Protection Officers:

Group Data Protection Office

Email: datenschutzbeauftragter@kloeckner.com

III. How, why and which of your personal data is collected and processed when you visit our websites

a) Data categories processed:

Each time you visit our website, we process the following data:

Connection data of the requesting device, including IP address,
Pages accessed on our website, including the referring page from which you have accessed our website,
Date and time of access,
Type and version of the browser used, along with information about the operating system and device used,
Volume of data transferred during the session.

b) Purpose of processing, legal basis, and legitimate interests (where applicable): We process this to provide access to our website and ensure its technical functionality, in accordance with Article 6(1)(b) GDPR, and to identify and resolve technical faults, based on our legitimate interests pursuant to Article 6(1)(f) GDPR. Our objective is to ensure a seamless, error-free experience for visitors using our website.

c) How long your personal data is stored: Unless a more specific retention period is stated in this privacy policy, we retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected. Typically, this data is deleted no later than one year after collection.

d) Requirement to provide data / consequences of withholding: This data is automatically processed when you access our website. Without it, the website cannot function properly, and you would be unable to use it.

e) Google Maps

This website uses the Google Maps mapping service. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

This service allows us to embed interactive maps directly on our site.

To use the features of Google Maps, it is necessary to store your IP address. This information is generally transmitted to and stored on a Google server in the United States. We have no control over this data transmission. When Google Maps is activated, Google may also use Google Fonts to ensure consistent font display. Your browser will load the necessary web fonts into its cache to correctly display texts and fonts.

The use of Google Maps is in the interest of providing an appealing presentation of our online offerings and helping users easily locate the places we specify on the website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR. If consent has been requested, data processing is carried out solely on the basis of Article 6(1)(a) GDPR in conjunction with § 25(1) of the German Telecommunications and Telemedia Data Protection Act (TDDDG), where consent includes the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) as defined by the TDDDG. Consent may be withdrawn at any time.

Data transfers to the United States are based on the European Commission’s Standard Contractual Clauses. Further details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

For more information on how user data is handled, please refer to Google’s privacy policy: https://policies.google.com/privacy?hl=de.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States intended to ensure that data processing in the US complies with European data protection standards. Companies certified under the DPF commit to complying with these standards. Further details are available from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active.

f) YouTube

This website incorporates videos from the YouTube platform. The operator of YouTube is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our pages that includes a YouTube video, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited.

YouTube may also store cookies on your device or use similar recognition technologies (e.g. device fingerprinting). This allows YouTube to collect information about visitors to our website. Such data is used, among other purposes, to compile video statistics, improve user experience, and prevent fraudulent activity. If you are logged into your YouTube account, YouTube may associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your YouTube account.

The use of YouTube is in the interest of presenting our online content in an appealing and engaging way. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR. If consent has been requested, data processing is carried out solely on the basis of Article 6(1)(a) GDPR in conjunction with § 25(1) of the German Telecommunications and Telemedia Data Protection Act (TDDDG), where consent includes the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) as defined by the TDDDG. Consent may be withdrawn at any time.

Further information on how user data is handled can be found in YouTube’s privacy policy: https://policies.google.com/privacy?hl=de.

IV. Processing of your personal data as part of our general business activities

a) Data and data categories processed

As part of our general business operations, we process personal data about you. This may include, in particular: Title, first name, last name; business email address; date of birth; company name; business address; legal form of the company; billing address, delivery address and related details; payment method; truncated credit card information; business telephone number; tax number; Debrunner Metallservice or Kloeckner customer number; details relating to customer-specific pricing (such as agreed discounts and conditions); contracts and placed orders (including, for example, order number, requested quantity unit, item number, desired delivery quantity and timing); correspondence; delivery notes including address data and signature.

b) Purposes of processing and legal bases
We process the aforementioned data within the scope of our general business operations, particularly for the fulfilment of our (pre-)contractual obligations in accordance with Article 6(1)(b) GDPR (in the case of data belonging to contractual partners) or Article 6(1)(f) GDPR (in the case of contact person data of contractual partners). In the latter case, our legitimate interest lies in maintaining communication with our contractual partners. Fulfilling our (pre-)contractual obligations includes preparing and submitting quotations, processing orders including logistics and signature upon receipt of goods, payment processing and invoicing, and providing general customer support (e.g. assistance with product-related enquiries). We also use your contact details to maintain and manage the business relationship (e.g. follow-up contact regarding customer satisfaction, retention, or after-sales service) on the basis of Article 6(1)(f) GDPR. Our legitimate interest here lies in strengthening and enhancing customer relationships.

In addition, we collect and process data relating to the creditworthiness of the individual or company in question, including other credit-relevant information such as details of ownership structures, outstanding receivables, or enforcement notices. The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in identifying and reducing the risk of credit defaults.

Furthermore, under Article 6(1)(c) GDPR, we are required, pursuant to the European anti-terrorism regulations 2580/2001 and 881/2002 as well as international legislation, to verify your contact details (such as company name and address) to ensure that no funds or other economic resources are made available for terrorist purposes. We collect this data either directly from you or, where applicable, via other Debrunner Metallservice or Kloeckner systems, such as our online shop.
In addition, we process your personal data to analyse general customer behaviour. The purpose of this processing is to better understand individual customer differences, e.g. in terms of order frequency, ordering channels, quantities, pricing, etc., so that we can respond to your needs in a more tailored way. The legal basis for this is our legitimate interest under Article 6(1)(f) GDPR, which lies in promoting sales through targeted offers and tailored customer support.

We also use the collected data to send general newsletters (including product recommendations, updates about Debrunner Metallservice, promotional campaigns, surveys, etc.) based on Article 6(1)(f) GDPR. Our legitimate interest in this context is the promotion of sales through marketing communication. If you have provided your consent for personalised direct marketing, we will process your data in order to send you newsletters tailored specifically to your interests. This processing is based on your consent in accordance with Article 6(1)(a) GDPR. Further details on this can be found in section "IV c) Additional Information on Personalised Direct Marketing".

In some cases, we also use existing order and communication data to support the development of our digital systems, e.g. this includes automatically reading and responding to enquiries using algorithms. This type of development (e.g. artificial intelligence, machine learning) typically requires a large volume of known data sets to "train" the system, e.g. using historical quotation requests. The legal basis for this is our legitimate interest pursuant to Article 6(1)(f) GDPR, which lies in system optimisation for the purpose of improving customer service.

c) How long your personal data is stored

We store your data only for as long as it is necessary for the purposes pursued through the processing (typically, for handling contracts and orders, including any applicable warranty obligations) or where statutory retention obligations apply. Relevant legal requirements include, in particular, tax and commercial regulations, which generally mandate a retention period of 6 to 10 years.

If you withdraw your consent to the processing of personal data, we will delete your stored personal data unless another legal basis authorises us to continue processing it. This may include legal obligations such as statutory retention periods. We retain the personal data processed to document your consent for 3 years after the end of the calendar year in which your consent was withdrawn or expired.

d) The need for your approval to collect your data / consequences of withholding

Unless stated otherwise, providing your personal data is necessary for the business relationship. If required data is not provided, the relevant service cannot be delivered. In other cases, the lack of data may mean we are unable to offer our services in the same form or quality.

e) Additional information regarding the processing of your personal data when contacting us

Data categories processed:

If you contact us (e.g. via contact forms), we will process the data you provide in your enquiry, such as your name, address, telephone number, email address, and customer number.

Purpose of processing, legal basis, and legitimate interests (where applicable): We process this data to respond to your enquiry and to fulfil our (pre-)contractual obligations, in accordance with Article 6(1)(b) GDPR, or under Article 6(1)(f) GDPR. Our aim here is to fulfil your enquiry and provide you with relevant offers.

How long your personal data is stored:

We delete your data once we have dealt with your enquiry and the respective statutory retention periods have elapsed.

The need for your approval to collect your data and consequences should you refuse: You need only provide us with the data we require to process your enquiry and to contact you. If you do not provide us with this data, we may not be able to respond to your enquiry.

f) Automated individual decision-making, including profiling

Automated decision-making, including profiling as defined by Article 22 GDPR, is not conducted in connection with the use of our service.

V. Use of cookies

In addition to technically necessary cookies, Debrunner Metallservice and the partners listed herein also use cookies and similar technologies that require consent. We also share information about your use of our website with our partners for social media, advertising, and analytics purposes.

By clicking the "Accept all" button, you consent to the placement of optional cookies and to the further processing - including transmission - of your personal data for purposes such as user behaviour analysis, personalised advertising, and the storage of preferences such as language. Alternatively, you can select specific categories of cookies and consent to their use by clicking the "Save selection" button.

You can withdraw your consent at any time with future effect by clicking the "fingerprint" icon at the bottom left corner of the screen. Depending on your selected settings, or if you choose "Reject all optional cookies", certain features of the website may no longer be available to you.

Further explanations of the cookies and similar technologies used, including information on the data processed, storage periods and data recipients, can also be found there. For detailed information, click "More information".

Definitions

Partners: Our partners include social media platforms, analytics providers and advertising platforms, all of which act as data processors in accordance with the GDPR. They place cookies on your device on our behalf and are also involved in the further processing of your personal data, such as for personalising advertisements or storing preferences. You can find more details on our cookie banner (under the relevant category) and in our privacy policy.

Cookies and similar technologies: Cookies are small text files sent by a website server to your browser and stored on your device; they retain browsing information that can only be read by that server. The stored information allows the server to recognise your browser when you return to the website. You always have the choice to opt out of cookies, regardless of which type is being used.
Processing of personal data: Any operation or series of operations performed on personal data (e.g. collection, recording, organisation, structuring, storage, adaptation, use, disclosure by transmission). There is no transmission of your data to third parties beyond those explicitly named in the cookie banner.
User behaviour analysis: This involves collecting information about the individual pages visited on the website, the time spent on each page, and click patterns, in order to generate aggregated reports.
Provision of targeted advertising: Targeted advertising is delivered by collecting data on website usage in order to display tailored adverts to predefined user segments.
Setting preferences such as language: Cookies are sent to your device to retrieve preferences such as location and language so that the website can be displayed in your preferred language.
Withdrawal: As a data subject, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

VI. Recipients

Internal recipients:

At Debrunner Metallservice, only those individuals who require access to your personal data for the fulfilment of the purposes mentioned above will have access, and only to the extent necessary.

External recipients:

We only disclose your personal data to external recipients if this is necessary for processing your enquiries or orders, if we are legally permitted to do so, or if you have given us your explicit consent.

External recipients may include:

a) Data processors

Group companies of Debrunner Metallservice (including those within the Kloeckner Group) or external service providers engaged by us to deliver services, for example, in the areas of technical infrastructure, maintenance, or the provision of contract-related content.

b) Public authorities

Government bodies and public institutions, such as public prosecutors, courts, or tax authorities, to whom we are legally obliged to disclose personal data.

c) Other recipients

We will only pass on your personal data to other recipients where it is necessary for the performance of a contract, where you have given your consent, or where a specific legal provision permits it. These may include, in particular, group companies, payment service providers, credit agencies, banks, debt collection agencies, special-purpose entities, or service providers (e.g. for asset-backed securities transactions).

VII. Transfer to countries outside the EU / EEA

Personal data that we process as part of the procedures described above may also be transferred to recipients whose registered office or data processing location is outside the European Union (EU) or the European Economic Area (EEA). If such a transfer is made to a country that does not have an adequacy decision from the European Commission, we ensure an appropriate level of protection for your personal data by implementing the safeguards required under the GDPR with the respective recipients. You may request a copy of these safeguards from us using the contact details provided in Section I.

VIII. Your rights

As a data subject, you have the following rights under the General Data Protection Regulation (GDPR), provided that the relevant legal conditions are met:

Information:

You have the right to obtain information about the data we process about you.

Correction:

You can request to have incorrect data concerning you corrected. You can also request to have incomplete data rectified.

Deletion:

In certain cases, you can request to have your personal data erased.

Restriction of processing:

In certain cases, you can request that we restrict the processing of your data.

Data portability:

If you have provided us with data on the basis of a contract or consent form, you may ask to receive the data you have provided in a structured, commonly used, machine-readable format or request that we transmit the data to another controller.

Withdrawal of consent:

If you have given us your consent to process your data, you can withdraw this at any time, with future effect. However, this does not affect the legality of processing your data until the date of withdrawal.

Right to object

Right to object on a case-by-case basis:

Where we process your personal data on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to the processing of your personal data at any time, on grounds relating to your particular situation. We will then no longer process this personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing is for the purpose of establishing, exercising or defending legal claims.

Right to object to the processing of data for direct marketing purposes:

You have the right to object at any time to the processing of your personal data for direct marketing purposes. If you object to such processing, your personal data will no longer be used for these purposes.

Exercising your rights:

To exercise any of the aforementioned rights, please contact your dedicated customer service representative or use the contact details provided under Section I. Please ensure that you provide sufficient information to allow us to clearly identify you. Alternatively, you may contact our Data Protection Officer (see Section II for contact details).

Right to lodge a complaint with a supervisory authority:

If you believe that the processing of your personal data is unlawful, you have the right to lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

Last updated: May 2025