Privacy Policy of Metalshub’s Website Including the Metalshub-Platform

By this privacy policy we inform you about the processing of your personal data when using our website www.metals-hub.com including the Metalshub-Platform as well as information on your rights under the applicable data protection laws.

I. Contact Information of the Controller

The controller responsible for data processing pursuant to Art. 4 No. 7 General Data Protection Regulation (“GDPR”):

Metals Hub GmbH
Platz der Ideen 2
40476 Düsseldorf
Germany

Email: privacy@metals-hub.com
Phone: +49 211 976 33620

If you have any questions or suggestions regarding data protection or if you want to exercise your rights, please do not hesitate to contact us.

II. Personal Data

The subject of the processing is your personal data to the extent set out in this privacy policy. According to Art. 4 No. 1 GDPR, “personal data” means any information relating to an identified or identifiable natural person; this includes, for example, names or identification numbers.

III. Processing Activities

The extent and type of processing of your personal data depends on the functionalities and services you may use when visiting our website. In this section we inform you for what purposes we may process your personal data:

1. Server Log Files

In order to log your visit to our website, we use log data (directly or via third parties) in the form of so-called log files. The information in the log files includes: date and time of accessing our website, IP-address, browser type and version, operating system, URL of the previously visited website (Referrer), Date and time stamp of access to our website, Pages clicked on and any other information that your browser provides to us.

We only store these data for the technical administration and the security of the website. The data are anonymized after seven (7) days and deleted after 30 days, provided that there is no legitimate reason to suspect illegal use based on concrete indications. [HKLW1] The respective processing is necessary for the purposes of our legitimate interests in a secure website pursuant to Art. 6 para. 1 lit. f GDPR.

2. Use of Cookies

We use Cookies and Similar Technologies on our website. Cookies are small text files that are stored on your device by a web server and provide us with access to stored information. Besides Cookies, we also use Similar Technologies on our website which store information on your browser or device and e.g. or local storage (for instance, web beacons or tracking pixels). In the following, we use the term “Cookies” holistically with regard to Cookies and Similar Technologies.

Some of the Cookies we use on our website are automatically deleted after the end of the browser session, i.e. after you close your browser (so-called “Session Cookies”). Other Cookies remain on your device and enable us to recognize your browser the next time you visit us (so-called “Persistent Cookies”).

Please note we only use Cookies if and to the extent you give us your consent, except for Cookies which are strictly necessary for provision of our website and the functions and services provided there; such Strictly Necessary Cookies do not require your consent. You can withdraw your Consent at any time with effect for the future by accessing the Cookie Settings and changing your selection. You can access the Cookie Settings at any time by clicking on the icon placed on the bottom left of the website.

You can also set your browser so that you exclude the acceptance of Cookies for certain cases or generally. You can delete Cookies that have already been set via your browser. Please note that if you delete or do not accept certain Cookies, the functionality of our website may be limited.

Please see the Overview at the end of this privacy policy for further information on the cookies we use and their functionalities.

3. Use of HubSpot

We use HubSpot, a service provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, for processing data related to newsletter subscriptions, contact forms, lead tracking, white paper download forms, and user behaviour analysis.

As part of our use of HubSpot, we process usage data, including IP addresses, browser and session information, as well as the information you provide in forms on our website.

As HubSpot Inc. is based in the USA, your data may be transferred to and processed on servers in the USA. We ensure that appropriate safeguardsarein place to ensure sufficient protection of your data The data transfer to HubSpot, Inc, is based on the adequacy decision of the EU Commission according to Art. 45 GDPR concerning the EU-US Data Privacy Framework; HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework.

HubSpot uses cookies or similar technologies to provide its services. These cookies are only activated after you have given your explicit consent through our cookie banner. You can adjust your preferences regarding cookies at any time through the cookie settings available on our website (as described in detail under Section III. 2 ‘Use of Cookies’).

The data is stored until you withdraw your consent. The data collected via HubSpot is used exclusively for internal purposes and is not shared with third parties, other than HubSpot, Inc., without your explicit consent.

The processing of your data is based on your consent in accordance with Article 6 para. 1)lit. af GDPR.

For more information on data processing by HubSpot, please refer to HubSpot’s Privacy Policy.

4. Newsletter

We offer a free newsletter. With our newsletter we provide you with updates and marketing information about Metals Hub.

The registration for the newsletter takes place in the so-called double opt-in procedure. To subscribe to the newsletter, you can enter your email address in the respective field on our website. To prevent abuse, we will send you an e-mail after your registration, asking you to confirm your registration. Only if you click on this link you will be added to our mailing list and receive our newsletter. In order to prove the registration process according to the legal requirements, your application will be logged, in particular the registration and the confirmation time and your IP address.

Furthermore, we collect via so-called “web beacons” (these are small graphics in HTML emails) information whether our newsletter was delivered, whether it has been opened and whether links have been clicked. This gives us statistical evaluations and allows us to see exactly how well our newsletter was received by you. This enables us to adapt and improve our newsletter service.

In order to provide our newsletter service we use the services of Mailchimp. This includes processing of the aforementioned data on Mailchimp’s servers located in the USA. Mailchimp is provided by The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA.

Provision of the newsletter service and processing of the data affected is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. The consent includes the aforementioned data transfer to Mailchimp’s server in the USA. You may revoke your consent at any time via the unsubscribe link included in each newsletter email. Please note that the lawfulness of the processing carried out on the basis of the consent prior to your withdrawal remains unaffected.

5. Metalshub-Platform

Via our Metalshub-Platform third party sellers and buyers of goods can initiate requests for offers or bids, negotiate and complete transactions. When you use our platform we process your personal data in order to provide platform services according to the Metalshub-Platform’s general terms and conditions.

a) Registration and Log-in

You can only use the platform upon registration. In this regard the provision of certain data as indicated by the * in the registration form are necessary. If you do not provide the required data, you cannot register for Metalshub-Platform. The processing of these personal data is necessary to fulfil the registration contract. The provision of further data is voluntary. For both necessary and voluntary data the processing is based on our legitimate interest to handle your registration properly pursuant to Art. 6 para. 1 lit. f GDPR.

If you have been invited by a master user of your company or after you have submitted the registration form you receive a link to confirm your registration. Only if you click on this link, you will have access to the platform to continue the company registration process. Once your registration is confirmed and the required company details are provided we can approve your registration according to the Metalshub-Platform’s general terms and conditions. After registration you may update your data or delete your data by cancelling your registration at any time via sending an email to support@metals-hub.com.

Please note that we will also process your abovementioned personal data to provide the platform services, especially in order to verify your authority to act, based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. We further process the abovementioned data to obtain sanction reports as set out in our general terms and conditions Art. 6 para. 1 lit. c GDPR.

b) Buying and Selling

You can create a listing for the sale and purchase of goods. According to the preferences you chose for your listing, personal data may be published within the platform. The processing of personal data serves the purpose of providing our associated services, such as matching. If you are directly our customer, we process your personal data to fulfil our contractual obligations. If you are not our customer but a contact person of our customer acting for the customer the processing is based on our legitimate interest of the execution of the contract with our customer pursuant to Art. 6 para. 1 lit. f GDPR.

Please note that seller and buyer are solely responsible for any processing of the other party’s personal data in connection with their transactions.

6. Contact Form

You can send us a message using the contact form or chat. We process the personal data provided by you to handle your request, to provide you with the requested information and to contact you for further assistance. This may involve processing all data contained in fields marked with* which are necessary, such as name, email, location and phone number as well as any other information provided by you as part of your contact request.

The processing is based on our legitimate interest to process your data in order to properly respond to your request pursuant to Art. 6 para. 1 lit. f GDPR.

7. Marketing and Analysis Tools

On our website we use the following marketing and analysis tools:

a) Google Analytics

We use Google Analytics on our website. Google Analytics is a web analytics service provided by Google. The operator responsible for the provision of Google Analytics in the European market is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Google Analytics uses cookies that enable an analysis of your use of our website. The information collected with the help of the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. These servers are operated by Google LLC.

During your visit to the website, your user behaviour is recorded in the form of “events”. Events can be: page visits, first visit to the website, session start, your “click path”, interaction with the website, scrolling (whenever a user scrolls to the bottom of the page (90%)), clicks on external links, internal search queries, interaction with videos, file downloads, ads seen/clicked, language settings.

In addition, the following personal data are collected: Your approximate location (region), your IP address (in shortened form), technical information about your browser and the devices you use (e.g. language setting, screen resolution), your internet service provider, the referrer URL (via which website/advertising medium you came to this website).

Google Analytics has activated IP address anonymisation by default. Through IP anonymisation, your IP address is shortened by Google within member states of the EU or in other contracting states of the Agreement on the European Economic Area (EEA). Only in special situations the full IP address will be transferred to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other personal data from Google.

Google will process the aforementioned information for the purpose of analysing your use of the website and to compile reports on website activity for us. The reports provided to us by Google Analytics will be used to analyse the performance of the website.

The personal data collected and linked to the cookies set by Google Analytics are automatically deleted after 2 months. The deletion of personal data whose retention period has been reached takes place automatically once a month.

You can withdraw from your consent at any time with future effect by accessing the settings of our consent management tool and changing your selection there. Please note that the lawfulness of the processing carried out on the basis of the consent until withdrawal from it remains unaffected by this.

In addition, you can prevent the transfer to Google and the processing by Google of the data generated by the cookie relating to your use of the website (including your IP address) by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en

For more information on Google Analytics’ terms of use and Google’s privacy policy, please see the following link: https://policies.google.com/privacy?hl=de

b) Google Tag Manager

We use the Google Tag Manager on our website. The operator responsible for the provision of the Google Tag Manager in the European market is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the Google Tag Manager to deploy and manage tools (e.g. Google Analytics) that we use on our website. The tools deployed via the Google Tag Manager may set cookies in your browser and process personal data. Information on the tools deployed can be found in the relevant section of this privacy policy. The Google Tag Manager itself processes your IP address, which may also be transmitted to Google’s servers in the USA.

The legal basis for the use of the Google Tag Manager is your consent in accordance with Art. 6 para. 1 lit. a GDPR. The consent includes the aforementioned data transfer to Google’s server in the USA.

c) Google Fonts

We may use Google Fonts (in particular Open Sans) on our website. Google Fonts is a service that allows us to use individual fonts on our website. Responsible for operating Google Fonts in the EEA is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

When you visit our website, the respective fonts are loaded from a Google server. This also involves the transmission of certain personal data to the Google servers. This includes your IP address, language settings, technical information about your browser (browser version, browser screen resolution, browser type), operating system and the referrer URL (via which website you came to this website).

All Google Fonts are optimised for use on the internet. This reduces data volume and is especially beneficial when using the fonts on mobile devices. This reduces the data volume required and is particularly beneficial when the website is accessed on mobile devices. When you visit our website, the small file size ensures a fast load time.

We may only use Google Fonts with your prior consent pursuant to Art. 6 para. 1 lit. a GDPR. This means the website cannot load Google Fonts from the Google servers without your prior consent. In case you do not give us your consent we use only locally implemented fonts.

d) Hotjar

We use Hotjar to understand our users’ needs and improve the offerings on our website. Hotjar is provided by the Hotjar Ltd., Dragonara Business Centre 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141 Malta. Hotjar helps us to better understand our users’ experiences (e.g. how much time users spend on which pages, which links they click on, what they like and dislike, etc.) and helps us to tailor our offerings to their feedback. Hotjar uses cookies and similar technologies to collect information about our users’ behaviour and about their devices (in particular, device IP address (collected and stored anonymously only), screen size, device type (unique device identifiers), information about the browser used, location (country only), preferred language for viewing our website). Hotjar stores this information in a pseudonymised user profile. The information is used neither by Hotjar nor by us to identify individual users nor is it merged with other personal data about individual users.

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future.

For more information on Hotjar’s privacy policy, please click here: https://www.hotjar.com/legal/policies/privacy

8. Our Social Media Pages

In addition to this website, we operate several social media pages. If you interact with our social media pages, we may process certain personal data, e.g. if you leave comment, like or retweet a post. The legal basis for processing of your data is our legitimate interest in operating social media pages and to inform and communicate with the users of the respective social network, pursuant to Art. 6 para. 1 lit. f GDPR.

We operate the following social media pages:

●      Our Facebook page can be accessed via https://www.facebook.com/Metalshub

●      Our Twitter channel can be accessed via https://twitter.com/metals_hub

●      Our LinkedIn page can be accessed via https://de.linkedin.com/company/Metalshub

●      Our Xing page can be accessed via https://www.xing.com/companies/Metalshubgmbh

●      Our YouTube channel can be accessed via: https://www.youtube.com/channel/ UC3X17hSVldeIPjj7y_6cZcw

In addition, the operators of the respective social media networks may process your personal data when using their network. You will find further information in the privacy policies provided by the operators of the social media networks (please see below):

●      Facebook’s (Meta’s) Privacy Policy: https://www.facebook.com/privacy/policy/

●      Twitter’s Privacy Policy: https://twitter.com/en/privacy

●      LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy

●      Xing’s Privacy Policy: https://privacy.xing.com/en/privacy-policy

●      YouTube’s Privacy Policy: https://policies.google.com/privacy

IV. Transfer of Data to Third Parties

We may transfer your personal data to third parties in the following cases.

We use services of certain external service providers as processors (Art. 4 No. 8 GDPR). Processors only process data on our behalf and according to our instructions. These processors are carefully selected and regularly reviewed by us to ensure that your privacy is protected. The processors may only use the personal data for the purposes specified by us and are also contractually obligated to treat your personal data in accordance with this privacy policy and applicable data protection laws. We only transfer your personal data to them to the extent necessary. In addition, we also transfer your personal data to recipients who are data controllers under the terms of Art. 4 No. 7 GDPR themselves.

We transfer your personal data to the following recipients or categories of recipients:

● Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (re. use of Google Analytics, Google Fonts and Google Tag Manager)

● HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA (re. use of HubSpot)

● Hotjar Ltd Dragonara Business Centre 5th Floor, Dragonara Road, Paceville St Julian’s, STJ 3141 Malta (re. use of Hotjar)

● The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA (re. provision of Mailchimp for the newsletter service)

● Invoice service provider (re. the invoice processing which involves processing the online order and handling the invoices)

● Law enforcement authorities, authorities that prosecute fined administrative offences and the tax authorities, and, if necessary to injured third parties (e.g. in the event of a legal obligation provide information to certain public authorities upon request, or if it is necessary to discover or investigate any illegal use of our services or for prosecution, or to enforce terms of use or other agreements)

V.Transfer of Data to Third Countries

We transfer personal data to service providers and recipients in countries outside the EU/EEA (so-called third countries) where such transfer is necessary for the purposes set out in this privacy policy.

A transfer to a third country will only take place in compliance with the applicable data protection regulations, in particular the guarantee of an adequate level of data protection. This means that your personal data will only be transferred insofar as a decision of the EU Commission on an adequate level of data protection exists for the respective third country (Art. 45 GDPR), appropriate guarantees are provided for the protection of your personal data (cf. Art. 46 GDPR) or a legal permission norm exists (cf. Art. 49 GDPR). Appropriate safeguards within the meaning of Art. 46 GDPR include the standard data protection clauses published by the EU Commission.

The transfer of your personal data may take place when using the following services: Google Analytics, Google Fonts, Google Tag Manager and Mailchimp. For further information on the processing please see the previous sections in this privacy policy.

VI. Storage Period of Your Personal Data / Erasure of Your Personal Data

We only store personal data for as long as it is necessary for the purposes for which they are processed or if your consent has been revoked. In addition, statutory storage requirements may apply.

VII. Legal Obligation to Provide Personal Data

You are neither obliged by contract nor by law to provide us with your personal data. Please note the following: if you do not provide us with the personal data we may need for the respective purposes, such as the execution of a contract with you, the respective contractual relationship may not come into existence.

VIII. Automated Individual Case Decisions and Measures for Profiling

We do not use any means of automated individual decision-making or profiling.

IX. Your Rights as Data Subject

The GDPR provides you, as a data subject, with the following rights regarding the processing of your personal data:

•   The right of access (Art. 15  GDPR)

•   The right to rectification (Art. 16 GDPR)

•   The right to erasure (Art. 17 GDPR)

•   The right to restriction of processing (Art. 18 GDPR)

•  The right to data portability (Art. 20 GDPR)

Insofar as we process your personal data based on your consent, you can withdraw from your consent at any time with effect for the future.

As far as your personal data is processed for the purpose of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, you have the right to object according to Art. 21 GDPR. You can find further information on your right to object in accordance with Art. 21 GDPR below.

Furthermore, you have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR) if you are of the opinion that the processing of your personal data is not lawful.

Information about your right to object in accordance with Art. 21 General Data Protection Regulation (GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you on the basis of Art. 6 para. 1 lit. f GDPR (processing of personal Data based on a balancing of interests); this includes profiling based on those provisions (Art. 4 No. 4 GDPR).

Should you decide to object the processing, we will stop to process personal data concerning you, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the purpose of establishment, exercise or defence of legal claims.

You also have the right to object at any time to processing of personal data concerning you for the purpose of advertising; this also applies to profiling insofar as it is associated with advertising.

Should you decide to object to the processing for advertising purposes, we will stop to process personal data concerning you for these purposes.

The objection is not subject to any form. Ideally, it should be lodged via email at the bodies mentioned in Section I.

In order to exercise the aforementioned rights, you can contact the bodies mentioned in Section I.

X. Amendments of Our Privacy Policy

This privacy policy may be amended with changes. The current version of this privacy policy is available at all times at https://www.metals-hub.com/privacy-policy/

STATUS: 09.2023