Data privacy statement for the mobile application OPTIME 

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the applicable legal data protection regulations as well as with this data privacy statement. 

The name of the application can vary depending on the operating system. This application can be found in the Google Play Store and in the App Store under OPTIME. The name OPTIME is used uniformly throughout the following text. 

1. Who is responsible for data processing? 

Schaeffler Technologies AG & Co. KG 
Industriestraße 1-3 
91074 Herzogenaurach, Germany 
Phone: +49 9132 82-0 
Fax: +49 9132 82-49 50 
E-mail: info.de@schaeffler.com 

You can contact our company’s data protection officer at: 

Schaeffler Technologies AG & Co. KG 
Data protection officer 
Industriestraße 1-3 
91074 Herzogenaurach, Germany 
Phone: +49 9132 82-1476 
E-mail: datenschutz@schaeffler.com 

2. For what purpose do we process your data (purpose of processing) and what is the legal basis for this?

We generally record and use your personal data only to the extent to which this is necessary in order to provide a functioning application and the content and services that we offer within this application. The regular recording and use of your personal data take place only after you have given your consent. Cases in which the processing of these data is permitted by legal regulations are exempted from this. We process your personal data in accordance with the terms of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG): 

a.    Subject to your consent (article 6, paragraph 1a of the GDPR)
If you have given your consent for us to process personal data for specific purposes, it is lawful for us to process these data based on this consent, and the legal basis is provided by article 6, paragraph 1a of the GDPR. A declaration of consent that has been made can be revoked at any time. Please note that this revocation only applies for the future. Data processing that took place prior to the revocation remains unaffected

b.    In order to fulfill contractual obligations (article 6, paragraph 1b of the GDPR)
Data are processed as part of the implementation of contracts in which you are one of the contractual parties or at your request for the purpose of carrying out pre-contractual measures. Article 6, paragraph 1b of the GDPR provides the legal basis for this processing. The purpose of data processing is dependent on the respective contract documents and the object of the contract. 

c.    In order to fulfill a legal obligation (article 6, paragraph 1c of the GDPR)
If the processing of personal data is required in order for a legal obligation to be fulfilled to which our company is subject, article 6, paragraph 1c of the GDPR serves as the legal basis for this to take place.

d.    As part of the weighing of interests (article 6, paragraph 1f of the GDPR)
If the processing of data is necessary in order to protect a legitimate interest of Schaeffler or a third party and your interests and your fundamental rights and freedoms as an affected party do not outweigh the former interest, article 6, paragraph 1f of the GDPR serves as the legal basis for this to take place. If necessary, we will process your data for the purpose of protecting our own legitimate interests or those of third parties. 

• Measures for business management and further development of services and products
• Ensuring IT security and IT operations -    Prevention and investigation of criminal offenses
• Assertion of legal claims and defense in legal disputes
• Advertising or market and opinion research, provided you have not objected to the use of your data
• Measures for business and risk management
• Creation of anonymized or aggregated statistics and analyses to improve our products and services
• Collaboration with external service providers to make our services more efficient and improve the user experience

3. What data do we record, and how long are they stored?

The use of the mobile application is subject to registration. To do this, you must create a user account, in which the data that you enter are stored. Access to your user account is protected by a password, and third parties can only access your account if this is initiated by you. You can edit the data stored in your user account via your personal profile, or edit/delete individual fields. The user account that you have created can also be fully deleted at any time. Please contact the following e-mail address if you wish to do this: dataprivacy@schaeffler.com  

The following data are recorded, processed, and used when a user account is created: 

• E-mail address, first name, last name
• Company
• Position (as voluntary information)
• Usage data (e.g. login times, duration of use, functions used within the app)
• Role-based access information (e.g. authorizations and access rights according to your role in the company)

The data are stored for as long as your user account exists. After your user account is deleted, we will delete the data unless we are obliged to store them by European or national legislation under Union ordinances, laws, or other regulations according to which responsibility lies with us. In such cases, access to the data is merely prohibited. Your data will be deleted at regular intervals after the expiry of the storage period proscribed by the specified standards. While the mobile application is used, OPTIME automatically receives and stores information from the browser or mobile platform in server reports, including the location, IP address, cookie information, and the sites accessed. OPTIME uses these data in an anonymous, aggregate form only. Aggregate information about user behavior within the application as well as the user distribution of operating systems, languages, and countries are not recorded specific to individuals and are processed for analytical purposes only.

4. Access authorization

Authorization checks may be carried out as part of the application’s use, depending on the user function. These checks are independent of registration processes. Data are only transferred when you have granted the necessary authorization. The data are used only to gather the information required. You can deactivate access to the authorizations in the device settings menu. Please note, however, that you may not be able to fully use all of the app’s functions in this case. Authorization checks can take place within the following areas/functions: 

• Camera access (mandatory function)
  Reason: Enables the scanning of QR codes or barcodes for authentication or adding devices.
  Use: The camera is only activated if you want to use the corresponding function, e.g. when scanning a code.
• Location access (optional)
  Reason: Enables the provision of location-based services, such as displaying the nearest service points or creating location-based reports.
  Use: The location is only recorded if the corresponding function is used and you have consented to its use.
• Contacts access (optional)
  Reason: Allows you to share app content or invite contacts to use the app.
  Use: The contacts are only read out if you actively use the function to share contacts or send invitations.
• Storage access (optional)
  Reason: Allows you to save and retrieve data and files on your device.
  Use: Access is only granted if you want to save or upload files within the app. 
• Microphone access (optional)
  Reason: Enables the use of voice commands or the recording of audio notes.
  Use: The microphone is only activated if you want to use the voice control function or record an audio note.
• Notifications (not a mandatory function but part of the solution)
  Reason: Enables push notifications to be sent to inform you of important updates or messages.
  Use: Push notifications are only sent if you have expressly consented to them. You can deactivate push notifications at any time in the settings.

5. How can I access my data?

Within the Schaeffler Group, access to your data is granted to those parties who require such access according to the “least privilege” and the “need to know” principles. Service providers and vicarious agents employed by us may receive data from us for these purposes, provided that they observe our guidelines and instructions governing data protection. 
We will only forward data to recipients outside the Schaeffler Group if this is necessary, it is required by law, you have given your consent, or processors commissioned by us guarantee that the specifications of the GDPR and the German Federal Data Protection Act (BDSG) will be observed. Under these prerequisites, recipients of personal data can include the following: Cloud providers, development partners, Schaeffler legal entities, service providers for sending e-mails for user communication (e.g. system maintenance announcements).

6. Are data transferred to third-party countries or international organizations?

The transfer of data to countries outside of the EU/EEA (so-called “third-party countries”) only takes place when necessary or legally proscribed, when you have given us your consent, or as part of the processing of an order. If service providers in third-party countries are employed, they are obliged to confirm that they will observe the European level of data security by agreeing in writing to the EU’s standard contractual clauses.

7. What data protection rights do I have?

If your personal data are processed, you are an affected party according to the terms of the GDPR and you have the following rights with regard to us as the responsible party:

• Information regarding your personal data that have been processed in accordance with article 15 of the GDPR
• Correction of incorrect personal data according to article 16 of the GDPR
• Deletion of your personal data according to article 17 of the GDPR
• Restriction of data processing according to article 18 of the GDPR
• Objection according to article 21 of the GDPR
• Data portability according to article 20 of the GDPR

The restrictions specified in §§ 34 and 35 of the German Federal Data Protection Act / BDSG apply to the right to information and the right to deletion. You additionally have the right to complain to the supervisory authority for data protection according to article 77 of the GDPR in conjunction with § 19 of the German Federal Data Protection Act / BDSG.

8. Am I under obligation to provide data?

As part of the conclusion of contracts, you are obliged to provide such personal data as are necessary to justify, implement, and terminate the contract and fulfill the obligations arising from it, or such personal data as Schaeffler is obliged to record. Without these data, no contracts can be concluded with Schaeffler. If we provide products and services in this mobile application that you can utilize on a voluntary basis, you are not obliged to make your data available to us, but it may not be possible for you to utilize our products and services without your personal data. 

9.    To what extent are decisions made automatically?

We generally do not use any fully automated decision-making systems in accordance with article 22 of the GDPR.

10.    Does “profiling” take place?

Schaeffler generally does not use “profiling”. Should we use such systems in individual cases, we will inform you of this separately provided that this is legally required and request your consent in advance if required.

11.    Security

The Schaeffler Group applies technical and organizational security measures in order to protect your data as administered by us against accidental or intentional destruction, manipulation, loss, or access by unauthorized persons. These security measures are under continuous development in line with the new technical possibilities available at the time. The application may contain links to external providers’ websites. Our statements on data protection do not apply to these websites. 

Consent in terms of data protection law for the use of mobile apps

By giving your consent, you are agreeing to the use of your personal data in accordance with the regulations specified above. You can withdraw your consent at any time with effect for the future; to do so, please contact dataprivacy@schaeffler.com.

Status: 6/7/2024