Privacy policy

The website is provided and operated by HENSOLDT AG, Willy-Messerschmitt-Strasse 3, 82024 Taufkirchen, telephone: +49.89.51518-0, email: info@hensoldt.net (the ‘Company’). In this capacity, the Company acts as the data controller for the processing of personal data carried out in connection with the use of the website.

However, if you establish a business relationship or are in contact as another company’s business partner with within the HENSOLDT Group, that company will, in principle, be responsible for the processing of personal data carried out in the context of that relationship.

An overview of the companies within the HENSOLDT Group, together with their contact details, can be found at the end of this privacy policy.

The proper implementation of data protection is overseen within our organization by our Data Protection Officer. If you have any questions, requests or concerns regarding the processing of your personal data, you can contact them directly.

You can contact the Company’s Data Protection Officer at the following address:

Data Protection Officer
HENSOLDT AG, Taufkirchen
Willy-Messerschmitt-Strasse 3
82024 Taufkirchen
Email: dataprotection@hensoldt.net

The Company processes your personal data in accordance with the General Data Protection Regulation No. 2016/679, which came into force on 25 May 2018, and Law No. 78-17 of 6 January 1978, known as the Data Protection Act of 6 January 1978, as amended (hereinafter collectively referred to as the ‘Regulations’).

Personal data means any information that relates to an identified or identifiable natural person (known as a ‘data subject’).
This includes information such as your name, postal address, email address or telephone number, as well as other information that your web browser transmits to our web server, for example the date and time of the request, and the page from which the file was requested.

In its capacity as controller – that is the entity that determines the purposes and means of personal data processing as described in this privacy policy – the Company collects and processes your personal data in accordance with the characteristics listed below.

3.1. Browsing the website

3.1.1. Log files

When you simply browse the website, without registering or providing us with any information (for example via a contact form), certain technical information is automatically collected and recorded in log files by our hosting provider, Vercel. This information includes your device and user ID, information about your operating system, the sub-pages visited during your visit, and the date and time of each visitor request. This information is temporarily stored in what is known as a ‘log file’.
The collection of this data is technically necessary for the display of our website and to ensure its stability and security. The aforementioned data is processed for the purpose of ensuring that a connection to the website is successfully established, that its use is convenient, and that the security and stability of the system are maintained.

To enable privacy-friendly audience measurement without the use of cookies, the service generates a hash associated with a visitor session. Such hashes remain valid for a maximum period of 24 hours and are automatically reset thereafter. As a result, visitor sessions cannot be linked across periods exceeding 24 hours. The hashes are automatically deleted or irreversibly renewed after this period and are retained only for as long as necessary to fulfil the purpose described above.
The legal basis for data processing is Article 6(1)(f) of the General Data Protection Regulation (GDPR). Our legitimate interest arises from the aforementioned processing purposes. The aforementioned data is erased as soon as it is no longer necessary for the purpose for which it was collected.

3.1.2 Distribution of multimedia content (Bynder)

In order to make the images and videos available on our website, we use the Bynder digital asset management platform and its content delivery network (CDN).

When this content is loaded, certain technical data – including your IP address, information about your browser and the requested resource – is transmitted to Bynder to enable the content to be delivered.

This processing is based on our legitimate interest in improving the speed and quality of the website’s display (Article 6(1)(f) GDPR).

Bynder acts as a technical processor. The data is retained only for as long as necessary to provide the requested content, ensure the security and operation of the content delivery network and comply with applicable legal obligations.

3.1.3 Website analytics and performance monitoring (Vercel Web Analytics and Speed Insights)

We use the Vercel Web Analytics and Vercel Speed Insights services to analyse the website usage, obtain aggregated statistics and improve its technical performance.

In this context, information relating to your browsing activity is processed, including the pages visited, the referring page, the browser, the operating system, approximate geographical information and data relating to the the website’s performance.

This processing is based on our legitimate interest, measuring the use of our website and improving its functionality and performance (Article 6(1)(f) GDPR).

Vercel acts as the technical service provider for these services. The information collected via these tools is retained for two years and then deleted.

3.2 Newsletter subscription

On our website, we use the ‘CleverReach’ marketing tool provided by CleverReach GmbH & Co. KG, //CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany, for email dispatch and automation services.

Our newsletters and email notifications are sent either on the basis of to your consent or where permitted by applicable regulations, on the basis of our legitimate interest (for example, in the context of a pre-existing business relationship). For this purpose, we process your email address, your first and last name for personalized communication, as well as the information about your preferred language, so that we can provide the newsletter and other electronic communications in your chosen language. However, as part of the newsletter subscription process, you also have the option to specify your interests in relation to various topics so that we can offer you a personalized service. This personal data is used to send you our newsletter and to keep you informed about news and events relating to HENSOLDT and the defence industry. We may also inform you of new developments or updates to HENSOLDT’s products and services.

You can unsubscribe from the newsletter at any time by using the unsubscribe link included in every communication or withdraw your consent by sending an email to info@hensoldt.net. If you do so, we will immediately remove you from our newsletter distribution list in accordance with your request.

Personal data processed for the purpose of sending our newsletter and other electronic communications is retained until you unsubscribe from such communications or withdraw your consent. In the absence of such action, the data will be retained for a maximum period of three (3) years from the date on which it was collected or from your last interaction with us.

Furthermore, in order to be able to provide evidence of consent previously given, to ensure that unsubscriptions are processed, and, where necessary, to defend our rights in the event of a complaint, we may retain the email addresses of those who have unsubscribed for a maximum period of three years in a separate archive database. In this context, the processing of this data is strictly limited to this purpose.

3.3 Contact via Email or contact form

When you contact us by email or via a contact form, as indicated in the ‘Events’ section on our website, the data you provide to us (your email address, your first name, surname and the content of your request, your country of residence, where applicable, the name of your company as well as any other information you choose to provide in connection with your enquiry) are processed by us in order to answer your questions and deal with your enquiries. The legal basis for this is Article 6(1)(f) GDPR, our legitimate interest being to respond to your enquiries and questions.

You may also contact us through the contact form available in the "Contact" section of our website. When you do so, we collect your first name, your surname, your email address, as well as, where applicable (as these fields are not mandatory), of residence, the name of your country, your company and any other information you choose to provide to us in connection with your enquiry.

Where necessary for the processing of your enquiry, your request may be shared with other departments within our company or with other companies within the HENSOLDT Group. In exceptional cases, this may also involve affiliated companies outside the European Union (EU) or the European Economic Area (EEA). We ensure an adequate level of data protection at HENSOLDT Group affiliates outside the EU/EEA in accordance with Articles 44 et seq. GDPR (see Section VI and VII below).

The processing of personal data that you provide to us when contacting us is based on our legitimate interest in accordance with Article 6(1)(f) GDPR, in order to process and respond appropriately to your enquiry. This legitimate interest also includes the possible forwarding of your enquiry to affiliated companies within the HENSOLDT Group. If you submit an enquiry in the context of a contractual or pre-contractual relationship, processing is carried out on the basis of Article 6(1)(b) GDPR to fulfil our contractual obligations or to respond to (pre-)contractual enquiries.

The data we collect in connection with your enquiry is retained only for as long as is necessary to process your enquiry. It is deleted as soon as the purpose for which it was collected has been fulfilled, once your enquiry has been fully processed.

3.4 Our careers page / Links to other websites

Our website contains a link to our career portal. For information on the processing of your personal data when you visit our careers portal and apply for a job via it, please refer to the privacy policy provided there.

Where we provide links to websites of other organizations or to other HENSOLDT sites, the data protection information and statements contained therein shall apply.

3.5 Procurement activities

3.5.1 Application as a supplier

The HENSOLDT company, with which you are establishing a relationship as a supplier, is, in principle, responsible for any further processing of personal data carried out as part of the purchasing or procurement process, as well as for managing the relationship with suppliers or business partners.

The ‘Supplier Application’ form, which can be found on the website, is designed to facilitate initial contact with companies wishing to become suppliers to the HENSOLDT Group. It enables interested companies to provide us with information about their business, their products and their services so that they can be assessed as potential business partners.

As part of an application to become a supplier, we process data relating to the applicant company as well as the personal data of the designated contact person, such as their name, job title, email address and telephone number. Mandatory fields are marked with an asterisk (*).

The processing is carried out for the purposes of evaluating and selecting potential suppliers, creating a supplier profile, and taking pre-contractual steps with a view to establishing a possible business relationship, in accordance with Article 6(1)(b) GDPR. Furthermore, we have a legitimate interest in organizing the supplier registration and selection process in an efficient and structured manner, as well as in ensuring smooth communication with our potential business partners, in accordance with Article 6(1)(f) GDPR.

The data subjects affected by this processing include employees, representatives or contact persons of candidate companies. The data collected may be passed on within the company to the relevant departments (e.g. procurement, quality assurance), as well as to our IT service providers in the context of technical processing, acting as processors in accordance with Article 28 GDPR for the purposes of hosting, maintenance and technical administration of the systems used. The data is retained for the duration of the supplier selection process and is deleted no later than six months after its conclusion, unless a contractual relationship is established or statutory retention obligations prevent this.

Data is primarily collected directly from the applicant company or, where permitted by regulations, collected from publicly available sources such as the websites of the companies concerned, the Companies Register or any other relevant public source.

3.5.2. Assessment of suppliers through IntegrityNext

As part of our due obligations throughout the supply chain, we use the IntegrityNext platform. To this end, we invite our suppliers to create a user profile on the IntegrityNext platform via our website and to submit to us the self-assessment they have completed there. Personal data is processed by IntegrityNext solely for the purposes of registration on the platform and for carrying out the assessments. This processing is based on Article 6(1)(b) GDPR where it is necessary for the performance of pre-contractual or contractual measures, and on Article 6(1)(c) GDPR where it is necessary for compliance with a legal obligation to which we are subject.

In this context, the personal data that may be processed includes, in particular, surname, first name, role within the company, company name, work email address and work telephone number.

We delete the personal data collected via the form Integrity Next at the same time as that contained in the application form for suppliers.

At the end of the retention periods specified in this Privacy Policy, personal data may, where strictly necessary, be retained in an intermediate archive for administrative, legal, accounting, tax or other regulatory purposes.

For example, personal data may be retained for up to five (5) years following the end of the applicable active retention period for litigation purposes (limitation period) or for up to ten (10) years for accounting purposes. At the end of these periods, the data will be deleted or anonymized in accordance with the Regulations.

The recipients of your personal data are as follows:

• Other departments or units within the HENSOLDT Group, authorized to process your personal data in accordance with the Regulations;
• The Company’s data processors, in particular IT service providers, are responsible for the technical administration and maintenance of the website. In this context, the transfer of your personal is governed by an agreement, in accordance with the Regulation, which obliges our data processors to respect the confidentiality, integrity and security of your personal data and to use it solely for the purpose of performing their services, within the limits of the instructions we provide to them.
• In specific circumstances, we may be required to disclose your personal data when requested to do so by judicial and administrative authorities who can demonstrate a legitimate need to access it.
• If the Company undergoes a reorganization, merger or disposal of a business or assets, we may disclose your personal data to the prospective purchaser of that business.

We make it a point of honor to process your data within the EU/EEA. However, we may occasionally use service providers who process data outside the EU/EEA. In such cases, where the country in question does not benefit from an adequacy decision by the European Commission, we implement the appropriate safeguards required by the GDPR to ensure an adequate level of protection for your personal data.

As such:

• We only transfer your data to companies within the HENSOLDT Group located outside the EU/EEA if such transfers are governed by the Standard Contractual Clauses adopted by the European Commission.
• We only transfer your data to external recipients or service providers established outside the EU/EEA if they have signed the Standard Contractual Clauses adopted by the European Commission with HENSOLDT.
• If you have any questions about such data protection contracts based on the EU standard contractual clauses or would like more information on further security mechanisms and security measures for data transfers to third countries, please feel free to contact us by email at dataprotection@hensoldt.net.

We use the widely adopted SSL (Secure Sockets Layer) protocol, in combination with the highest level of encryption supported by your browser.

You can tell that a page on our website is being transmitted in encrypted by the presence of a form closed padlock symbol in your browser’s status bar.

We also implement appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

We do not make the conclusion of contracts conditional upon the prior provision of your personal data. As a customer, you are generally under no legal or contractual obligation to provide us with your personal data. However, we may only be able to provide certain offers to a limited extent, or not at all, if you do not provide the data required for this purpose.

Should this exceptionally be the case in relation to the products or services we offer, and which are set out above, you will be informed of this separately.

Provided the conditions set out in the law are met, you have the following rights:

• Right of access, Article 15 GDPR: that is, to obtain confirmation from the controller as to whether or not personal data concerning you is being processed, and to request access to such personal data, as well as various pieces of information including the purposes of the processing, the category of personal data, and the recipient(s) of the personal data;
• Right to rectification in the event of an error, Article 16 GDPR: that is to say, the right to obtain from the controller, without undue delay, the rectification of any personal data concerning you that is inaccurate. You have the right to have incomplete data completed, including by providing a supplementary statement;
• Right to erasure (right to be forgotten’), Article 17 GDPR: that is to say, the right to obtain from the data controller, without undue delay, the erasure of personal data concerning you on the following grounds:
  • the purposes for which the data were collected or processed are no longer being pursued;
  • the consent on which the processing was based has been withdrawn, and there is no other legal basis for the processing of the data;
  • objection has been raised to the processing and there is no overriding legitimate interest in justifying the processing;
  • the data has been processed unlawfully;
  • the data must be erased in order to comply with a legal obligation to which the Company may be subject;
  • the data was collected when the data subject was a minor, without parental consent.
• Right to restriction of processing, Article 18 GDPR: that is to say, the right to obtain from the data controller a restriction on the processing of your data if you contest the accuracy of your personal data, if the processing is unlawful and you request a restriction, or if the data controller no longer needs your personal data but you still require it;
• Right to object, Article 21 GDPR: that is to say, the right to object at any time to the processing of personal data, unless there are legitimate and compelling grounds for the processing; you also have the right not to be subject to a decision based solely on automated processing, including profiling, unless that decision is necessary for the conclusion or performance of a contract, is authorized by Union law or the law of a Member State to which the data controller is subject, or you have given your consent;
• Right to data portability, Article 20 GDPR: that is to say, the right to receive the data provided to the data controller in a structured, commonly used and machine-readable format, and to transmit that data to another data controller;
• Right to withdraw consent at any time, with the withdrawal of consent taking effect for the future, if consent was given in accordance with Article 7(3) GDPR;
• To issue instructions regarding the handling of your data after your death: for individuals whose data is processed by a group entity established in France, you may, in accordance with Article 85, I, paragraph 1 of Law No. 78-17 (known as the ‘Data Protection Act’), issue instructions regarding the retention, erasure and disclosure of your personal data following your death. If you set out specific instructions regarding the processing of personal data covered by these instructions, these must be registered with the relevant data controllers. You may in particular submit this registration to the following email addresses: dataprotection@hensoldt.net.

These rights may be exercised by simply sending a written request to our Data Protection Officer (‘DPO’) by email to: dataprotection@hensoldt.net or and by providing evidence of a legitimate interest where required by law. To exercise your rights, you may be asked to provide proof of your identity in the event of reasonable doubt as to your identity.

Should you exercise any of these rights electronically, your data will be provided to you electronically, where applicable, whenever possible, unless you have specifically requested otherwise.

You may also lodge a complaint with the relevant supervisory authority (Article 77 GDPR) if, despite the response provided, you consider that your rights have not been respected.

This complaint may be lodged with the CNIL (Commission nationale de l’informatique et des libertés, located at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07), the national supervisory authority responsible for ensuring compliance with obligations relating to the protection of personal data.

You will also find below a list of the lead supervisory authorities responsible for personal data protection, depending on which entity within the HENSOLDT Group you are dealing with.

Please note that we regularly update our Privacy Policy to reflect changes in our data processing practices. We will inform you if your cooperation (e.g. consent) or individual notification is required.

In the event of a substantial change that may affect your rights or the way your data is processed, we will inform you accordingly. Where required by law, we will seek your consent again.

Furthermore, the contact details and information relating to the companies, organizations or authorities mentioned in this privacy policy may change over time. We encourage you to check that they are correct at the time you wish to contact them.