Privacy Policy and Data Protection Notice

We process your Data in accordance with the applicable data protection law of the country in which we have our registered office and, within the European Economic Area, in accordance with the General Data Protection Regulation. The purposes of processing and the specific legal basis on which the processing is carried out are set out in the description of the respective processing activity. We use the following legal bases.

1.1.1 You have given your consent to the processing of your Data for one or more specific purposes. You may withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing based on consent before its withdrawal. Where specific contact details for withdrawal were provided to you when your consent was obtained, you may use those; irrespective of this, you may at any time direct the withdrawal to the contact details stated above.

1.1.2 Processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract;

1.1.3 Processing is necessary for compliance with a legal obligation to which we are subject;

1.1.4 Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of your Data. The legitimate interests we pursue are set out in the respective processing activity. You may object to the processing of your Data at any time, on grounds relating to your particular situation, with effect for the future. We will then no longer process your Data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. In the case of direct marketing and any related profiling, we will in no event further process your Data for that purpose. If you require further information regarding the balancing of interests or wish to lodge an objection, please contact us using the contact details set out above or, in the case of email marketing, click the unsubscribe button.

1.2.1 In the context of processing your Data, we may transfer your Data to service providers in third countries. Third countries are any countries outside the country in which we have our registered office.

1.2.2 Where we transfer your Data to third countries, this is done on the basis of appropriate safeguards as required by the applicable data protection laws. Where a transfer to a third country occurs in connection with a processing activity, we will indicate this in the description of the respective processing activity.

1.2.3 Before using certain tools, you may also be asked, on a case-by-case basis, to consent to a data transfer where the service provider responsible for the tool is established in a third country and the safeguards described above are not applicable. By using the tool, a data transfer of at least your IP address to that third country will take place, or access to your Data from that third country may be possible. Please note that such third countries may not provide an adequate level of data protection and that lawful access to data as well as the enforcement of your data subject rights may not be ensured there. Before you use the relevant tool, we will inform you separately which third country is involved, which Data are transferred and that your consent is required.

Processing of your Data for purposes other than those described will only take place where permitted by a legal provision or where you have consented to the changed purpose of the processing. In the case of further processing for a purpose other than that for which the Data were initially collected, we will inform you prior to such further processing of those other purposes and provide you with all further information relevant in that regard.

We do not use automated processing – including profiling – to bring about a decision which produces legal effects concerning you or similarly significantly affects you.

Where we use systems supported by artificial intelligence (“AI”) in specific areas (e.g. chatbots or automated analysis and support tools), this is solely for assistance. Decisions, assessments or measures with legal or similarly significant effects are always taken by natural persons.

We store your Data only for as long as this is necessary to fulfil the purposes. In addition to the purposes stated for the respective processing activities, relevant criteria include, inter alia, statutory retention obligations, limitation periods/evidentiary periods, the establishment, exercise or defence of legal claims, IT back-up cycles, as well as documentation for the purposes of our accountability obligations. Where specific time limits vary depending on the country or process, the locally applicable requirements apply.

Your Data will also be erased where you have successfully objected to the processing or withdrawn your consent and the criteria referred to in the previous paragraph do not prevent erasure.

Alternatively to erasure, in certain cases – in particular for reasons of longer-term data analysis – your Data will be anonymised so that, due to the lack of any personal reference, they are no longer subject to data protection law.

As with any website, our server automatically and temporarily records information in server log files transmitted by the browser, unless you have disabled this. If you wish to view our Website, we collect Data which are technically necessary for us to display our Websites to you and to ensure stability and security (e.g. IP address of the requesting device, client file request, HTTP response code, the website from which you visit us (referrer URL), time of the server request, browser type and version, operating system of the requesting device). Collection is based on our legitimate interest in the proper functioning of our Websites. Your Data are stored for the duration of the session to enable delivery of the Website to your device and are erased after you leave the Website. Your Data are also stored in log files in order to ensure the functionality of the Website and the security of our information technology systems.

To protect our Website, for example to prevent misuse of online forms through automated entries (spam/bot attacks), we use a bot protection service. When visiting our Website, you may also optionally consent to technologies such as pixels, tags, browser fingerprinting, etc. We use these, for example, to improve convenience, optimise the Website, analyse user behaviour or address you with personalised advertising. Further information on the processing of your Data can be found directly in the processing activities described below and, as regards the technical processes, in our cookie banner under “Consent settings”. You can adjust your consents at any time via a link in the footer of our Website (“Cookie settings”).

We use the platforms listed below to communicate with interested parties, customers, applicants and other users and to provide information about our company. The legal basis is our legitimate interest in promoting sales and maintaining business relationships.

In addition, we use statistics and analyses which are made available to us by the platform operators through their processing of your Data (processing of contact data, content data, types of use, etc. to generate information on the reach of our social media page, visitor numbers and demographics, clicks, the number of new subscribers, or “likes”). Unless explicitly stated otherwise in this section, these are anonymised and aggregated and do not allow us to identify individuals. The legal basis and purpose is our legitimate interest in analysing and optimising our social media channels in order to increase sales and customer loyalty. In doing so, both we and the platform operators process Data.

The platform operators are recipients of the Data collected by us insofar as this relates to their respective platform. When using our social media channels and messenger services, a transfer to third countries (in particular the USA) may take place, which is safeguarded by an adequacy decision or, if not existent, by standard contractual clauses. The platform operators also reserve the right to share the Data with additional recipients in possible further third countries. Further details can be found in their privacy policy.

If you wish to use the functions of a social media channel or messenger service (e.g. sharing, rating or commenting), you do so at your own responsibility and based on your consent to the related processing of Data. We have no influence on the nature and scope of the Data processed by the platform operators. If you comment on our social media channels, your comment will be displayed publicly worldwide. You can delete your comment yourself at any time.

The platform operators operate the social media platforms under their own responsibility. For certain processing operations, we are jointly responsible with the respective platform operator for the processing. Where Joint Controllership exists with us, we will indicate this below in the information on the individual social media channels. In such cases, we have concluded an arrangement on Joint Controllership with the platform operator, which in particular sets out who fulfils which data protection obligations. The essential content of this arrangement is made available by the respective platform operator in its privacy policy. In these cases, you may also exercise your rights with us; we will then promptly forward your request to the respective platform operator.

We operate a Facebook fan page on the “Facebook” platform and an Instagram page on “Instagram” platform. Both social media platforms belong to Meta Platforms Ireland Ltd., Serpentine Avenue, Block J, Dublin 4, Ireland (“Meta Ireland”). We use “Page Insights” provided by Meta Ireland to obtain statistics about the use of our social media channels. We and Meta Ireland are jointly responsible for the processing. The essential content of the arrangement (“Page Controller Addendum”) can be found here: https://www.facebook.com/legal/terms/page_controller_addendum.

We operate a YouTube channel on the “YouTube” platform. YouTube is a service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google Ireland”). When you visit our YouTube page, Google Ireland processes your Data, may analyse your usage behaviour and makes statistics derived from this Data available to us.

We operate an account on the “X” platform. X is a platform of X Unlimited Company, 24-26 Fenian Street, Dublin 2, D02 AX07, Ireland (“X Unlimited Company”). When you access this page, X Unlimited Company processes your Data. We receive statistics on the use of this page derived from such Data.

We operate a company account on the “LinkedIn” platform. LinkedIn is a platform of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn Co.”). When you access this page, LinkedIn Co. processes your Data. We receive statistics (Page Insights) on the use of this page derived from such Data. We and LinkedIn Co. are jointly responsible for the processing. The essential content of the arrangement (“Page Insights Joint Controller Addendum”) can be found here: https://www.linkedin.com/legal/l/page-joint-controller-addendum.

In addition, within the LinkedIn platform we place advertisements for lead generation purposes (Lead Ads) and to increase brand awareness (Awareness Ads). In this context, your Data may be processed (e.g. contact data, content data, connection data) which are collected either through interaction with our ads or directly via forms provided by LinkedIn (Lead Gen Forms). The legal basis in this case is your consent. The purpose is to increase our sales.

We use a WhatsApp channel to inform our customers and interested parties about news relating to our company. The provider of this service is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“WhatsApp Ireland Ltd.”). The WhatsApp channel is designed as a one-way broadcast service and is not used for individual communication with you. If you follow our channel or access content, WhatsApp Ireland Ltd. processes personal data (in particular usage data and metadata relating to your device and the use of the channel) under its own responsibility. We have no influence over this. Further information on data processing for WhatsApp channels can be found in WhatsApp Ireland Ltd.’s privacy policy on WhatsApp channels.

You may contact us via various channels: by telephone, email, tools or, at your request, via WhatsApp. In doing so, we process in particular your name, your contact data and content data. You may also contact us via our live chat or an AI-controlled chatbot, which can be activated via the cookie settings. The legal basis for processing your Data is your consent. Where the contact is aimed at entering into a contract, the legal basis is the taking of steps prior to entering into a contract. The purpose is to handle your request.

When using WhatsApp, your Data are processed by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“WhatsApp Ireland Ltd.”) (e.g. communication metadata) and may be transferred to third countries (in particular the USA). Further information can be found in WhatsApp’s privacy policy at: https://www.whatsapp.com/legal/privacy-policy.

If you contact us by telephone, the call may, in individual cases, be recorded for the purpose of improving our service. In this context, we also process your voice data. You will be informed of this before the start of the call and asked for your consent. If, under the data protection and telecommunications rules applicable in your country, no consent is required, the recording is based on our legitimate interest in maintaining customer-oriented service and in the training and further training of our employees. You may object to the recording at any time without giving reasons, directly to the employee on the telephone.

Where we receive Data from you as a contact person in the context of a potential collaboration (e.g. tender) or an existing contractual relationship, we process such Data for the performance of the contract (e.g. communication during contract negotiations, handling of payment transactions or deliveries, dunning).

Where we receive your Data via third parties, for example from persons involved in a construction project, we will, if necessary, store such Data in our customer database, based on our legitimate interest in contacting you for the purpose of selling our products.

In some cases, we pass on information about companies and contacts to third parties (wholesalers, retailers, architects, construction companies) in order to establish contacts and possible business transactions within the construction industry. This constitutes a change of purpose. The legal basis is our legitimate interest in (indirectly) promoting our sales by maintaining good relationships within the construction industry, as well as the interest of third parties in promoting their sales through such receipt of information. If you object, we will record this in our customer database and will not disclose your Data to third parties.

Where you use our customer service in connection with service, repair or warranty cases, or where we receive your Data via third parties under contractual arrangements (e.g. installer, wholesaler), we process your Data for the performance of the contract (e.g. name, address, contact data, content data). Where you provide us, in the context of your enquiry, with additional information which is not necessary, we process such information based on our legitimate interest. The purpose is to handle and/or process the request.

In the case of a voluntary product recall, we process your Data on the basis of our legitimate interest in the preventive protection of our customers, or, in the case of a legally required product recall, for compliance with our legal obligations under product liability law.

If you contact us by telephone, the call may, in individual cases, be recorded for the purpose of improving our service. In this context, we also process your voice data. You will be informed of this before the start of the call and asked for your consent. If, under the data protection and telecommunications rules applicable in your country, no express consent is required, the recording is based on our legitimate interest in maintaining customer-oriented service and in the training and further training of our employees. You may object to the recording at any time without giving reasons, directly to the employee on the telephone.

To comply with our legal obligations, we have established a whistleblower hotline for the purpose of receiving and handling reports of possible legal/compliance infringements by us or third parties. If a report is received, it will be reviewed and, where possible and necessary, remedial action will be taken. Reports are generally accepted anonymously in order to enable confidential reporting. In the case of a report made by telephone, your voice will be transcribed immediately and then erased. Where you disclose your own Data, this is voluntary; further processing also serves the fulfilment of our legal obligation to investigate possible legal or other breaches of duty. Where a country does not provide for a company-specific hotline, the Geberit companies use a joint hotline. In such cases, incoming reports are processed at the Group headquarters in Switzerland and, where applicable, forwarded to the local companies. The legal basis for the transfer of Data to a third country is the adequacy decision and, where no adequacy decision exists, standard contractual clauses.

You have the opportunity to provide us with feedback on campaigns via certain forms. We process the Data provided there on the basis of your consent for the purpose of improving our offering and our online presence.

You may use various services via a customer account. Registration and the creation of the required Geberit ID are prerequisites for using our services and are subject to our terms of use. The legal basis for processing your Data is the performance of the contract thereby concluded. The purpose is to provide the services and to increase customer loyalty. For security reasons, registration requires a telephone number, which is used solely for this purpose. This is done by sending an SMS to be confirmed. Alternatively, you may also log in via a social login provided by the social media operators LinkedIn, Google, Facebook or Apple. Please note that in doing so, the social media operators may collect Data over which we have no control. Please refer to your social media operators’ privacy policy in this respect. Your customer account will be deleted if you delete your Geberit ID yourself or if you have not logged in for 19 months. Before your account is deleted due to inactivity, we will send you a reminder email so you can avoid deletion by logging in before the deadline.

Via our customer portal you may manage your customer profile and your product registrations. You will also receive access to digital tools and to your documentation created via our tools. You may forward these directly to your specialist partner from within the customer portal. Use of the customer portal requires the creation of a customer account (Geberit ID). Providing your Data in a customer portal is based on our legitimate interest and serves the purpose of maintaining a good customer relationship with you by offering you a holistic overview of your interactions with our tools and product registration options. You may add optional Data to your profile, such as a profile photo. If you do so, processing is based on your consent. Your Data will be erased when you delete individual Data or your entire profile in the customer portal.

For the technical and organisational management of contractual relationships, warranty cases, customer contacts, interested parties and visitors, as well as for compliance with legal or internal corporate requirements, we use digital IT systems. The legal basis and purpose is our legitimate interest in efficient, cost- and resource-saving administration, communication and contract handling.

Via the Geberit online catalogue you may view, download and save as a list information and documents relating to our product portfolio. Login via the Geberit ID is not required to use the online catalogue. Where you are logged in with your Geberit ID, your lists are stored in your profile and can be accessed at any time; otherwise, they are erased when you close the browser. Processing takes place only if you log in with your Geberit ID (we refer to the Geberit ID section). The purpose is to increase your convenience of use, namely the storage of lists so that you can later retrieve and manage them again. You may delete your lists yourself at any time; otherwise, they will be erased when the Geberit ID is deleted.

In some countries, we also offer a webshop through which you may order consumables for your Geberit products. In the context of the ordering process, we collect your Data on the basis of the contract concluded between you and us for the purpose of processing your order. Where you withdraw from the contract, we process your Data for the purpose of handling the withdrawal. In the European Union, the webshop also provides an electronic withdrawal function, which we are legally obliged to make available and, when used, we collect from you only the Data legally required (name, order, email address).

If you use our download center or product catalogue, in some cases we request your email address for the purpose of sending you the requested documents. The legal basis is your consent. Where the orders are subject to a fee, we collect additional Data required for invoicing. In this case, processing is based on the performance of a contract.

Our Geberit AquaClean Blog offers a comment function to enable transparent and individual communication between you and us and to allow third parties to view valuable information. If you use the comment function, you do so on the basis of your consent.

If you use our planning tools (Pro Planner, Revit PlugIn, etc.), we process your Data based on your consent to enable you to plan your projects with Geberit products easily. Where the planning tools include terms of use, the legal basis is the performance of the contract.

Depending on the tool, you may forward information to third parties (installers, other companies). This process is carried out by us and you will receive a confirmation of the forwarding from us. The purpose is to handle the request to the respective third party selected by you and to promote our sales through cooperation with those third parties.

Depending on the tool, you may also upload Data (e.g. product images, serial numbers, etc.). We store uploaded Data permanently, provided that they do not contain any personal reference and can no longer be attributed to you. If, in an individual case, we identify a personal reference, we will erase such Data.

You may subscribe to our press distribution list or other media releases in order to receive our official corporate communications. The legal basis is your consent. The purpose is to fulfil our obligation to communicate important company-related information and to strengthen our brand.

You may subscribe to various marketing channels (newsletter, etc.) in order to receive information from us about our products, offers, participation in surveys or market analyses. The legal basis is your consent or our legitimate interest where, under local law, no consent is required. The purpose is to promote our sales. As a rule, you will receive general advertising from us that is not interest-based.

If, on our Website, you have additionally consented to the Google Analytics cookie and, as a result, to the combination of your online and offline Data and to the use of the combined Data for analysis and personalised communication, we may provide you with advertising tailored specifically to your interests. The cookie creates a random ID, which enables the collection of usage data (time spent, topics viewed, click behaviour, etc.). If, while the cookie is active, you enter the same email address on our Website (e.g. in a contact form) that you used to provide your consent for marketing, the usage data will automatically be combined with your existing profile via your email address and thereby personal­ised.

We process the information obtained from this in order to create an interest profile about you and to provide you with targeted advertising by assigning you to an interest segment. Your interest profile is based on various Data that we receive from you. In addition to usage data, this may include, for example, the registration of a shower toilet or participation in an event.

We use retargeting products from specialised service providers in order to place audience-targeted advertising on the internet when using the service providers’ products. In this context, we transmit the first and last name, email addresses, and the country and postal code of our customers who have actively consented to advertising measures to these service providers. Except for the country and postal code, the transmission is hashed, i.e. pseudonymised. The respective service provider matches the hash value to known accounts whose Data have been hashed in the same way. Using this information, the service provider identifies, for us, a target audience of interest consisting of our customers and other persons to whom we can address personalised advertising. Once this has been done and the target audience has been created, the Data are erased in accordance with the determinations made by the respective service provider. The legal basis is your consent. The purpose is audience-targeted online advertising and the promotion of our sales.

We have no influence on the scope and further use of the Data collected by the service providers. We can therefore not exclude that they may ascertain and store further identifiers. The service providers are solely responsible for the processing which takes place after the Data have been transmitted to them.

If you participate in our promotions (e.g. cashback, discount promotions, WC test promotions, prize draws) or register your device in order to obtain a (extended) warranty, we process your Data for the performance of the contract which you enter into by accepting the participation and/or warranty terms. In individual cases, we carry out analyses on the legal basis of our legitimate interests in order to measure the success of our promotions and/or extended warranties. The purpose is to promote our sales.

If you participate in an online or in-person event (“Event”), we process your Data for the performance of the contract which you enter into by accepting the terms and conditions of participation. The purposes are the management and conduct of the Event, which, depending on the Event, may also include issuing certificates of attendance. Where we ask you about your preferences and needs (for example in the case of catering), you may provide these on the basis of your consent in order to enable you to participate in the Event more conveniently.

At some Events, you may take photos and send them to yourself or to third parties (e.g. photo booth, photo setting). The processing of your Data is based on your consent. You may share the photos via various channels. You are responsible for compliance with third parties’ data protection requirements.

Where, at a trade fair or exhibition, you provide us with your contact details (e.g. business card) or consent to our collecting your contact details (e.g. by scanning a personal QR code or by accepting the organiser’s terms and conditions of participation), the legal basis is your consent. We use your contact details in accordance with the purpose agreed between you and us, for example to send you a brochure or further information. If you wish to receive ongoing information from us, we store your Data and your marketing consent in our customer database. In individual cases, we additionally use your Data for analysis purposes, for example to evaluate the visitor groups at our trade fair stand. This is based on our legitimate interest in promoting our sales.

At Events, trade fairs or exhibitions with an international customer base, we may ask you for your nationality or address for the purpose of assigning your enquiry or marketing consent to the Geberit sales company responsible for you. The legal basis is our legitimate interest in efficient customer support.

At certain Events, trade fairs or exhibitions, photo and/or video recordings may also be made for the purposes of internal and external communication and/or for marketing measures on the internet and on social media. Where we document these and participants may only be captured incidentally in the background, processing is based on our legitimate interest in promoting our sales and increasing awareness of our brand. Where we take close-up shots of you as an individual or within a group of persons and use these for internal communication, the legal basis is your consent. You provide such consent by participating in the Event, trade fair or exhibition, of which we will expressly inform you in advance. Where we plan external communication using these recordings or wish to use them for marketing purposes, we will obtain your prior explicit written consent.

If you visit us at one of our sites, we collect your Data (e.g. name, company, reason for visit, check-in/check-out) for the purpose of administering your visit (issuance and return of visitor badges, access control), and for aggregated analysis of visitor numbers for capacity and safety planning or for adjusting marketing measures. The legal basis is our legitimate interest in proper security and access control and in promoting our sales. In addition, we may be legally obliged to record visitors in order to comply with local requirements (e.g. safety/evacuation processes).

If you participate in customer training on or off the Geberit Campus (online or onsite), we process your Data for the performance of the contract which you enter into by accepting the terms and conditions of participation. In addition, we store your course participation in the customer history of our customer database on the basis of our legitimate interest in maintaining business partner relationships. We offer training for the purpose of enabling you to use our products in the best possible way and to maintain our business relationship with you.

If you assert your rights as a data subject with us or otherwise submit a data protection enquiry (“Data Subject Request”), we are legally obliged to handle it. The purpose is to respond to your Data Subject Request. For this purpose, it may be necessary for us to carry out an identity check. You will receive a negative confirmation if we do not process any Data relating to you.

Where we process your Data in the context of legal defence and enforcement, we do so on the basis of our legitimate interest in defending against unjustified claims as well as in enforcing and asserting claims and rights.

We use service providers in part and disclose your Data to other trusted recipient within and outside our corporate group. These may include, for example:

• Other Geberit companies for the purposes of central customer administration and order processing as well as for the provision of central IT and other services
• External IT service providers
• Geberit specialist partners (dealers, showroom operators)
• Logistics service providers
• External speakers and organisers of training courses
• Banks and other payment service providers for the purpose of processing any payments
• Service providers for the purpose of organising, performing and handling any installation works as well as after-sales services
• Scanning services and print shops
• Lawyers, law enforcement authorities and courts

Right of access: You have the right to obtain from us, upon request, at any time, confirmation as to whether or not Data concerning you are being processed, and, where that is the case, access to the Data.

Right to rectification: You have the right to obtain from us, without undue delay, the rectification of inaccurate Data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete Data completed, including by means of providing a supplementary statement.

Right to erasure: You have the right to obtain from us the erasure of Data concerning you.

Right to restriction of processing: You have the right to obtain from us restriction of processing.

Right to object to processing: You have the right to object to processing. We refer to Section 1.1.4 of this Data Protection Declaration.

Right to data portability: You have the right to receive the Data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format.

Right to lodge a complaint with the competent supervisory authority: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes applicable data protection law.