Data Protection Statement

1. General
Henkel AG & Co. KGaA, hereinafter referred to as Henkel, respects the privacy of each person who visits our website. Now we would like to inform you of the type of data collected by Henkel and how they are used. You will also learn how you can exercise your data subjects’ rights.

Any changes to this Data Protection Statement will be published on this page. This enables you to inform yourself at any time about which data we are collecting and how we use such data.

This Data Protection Statement does not apply to websites accessible via hyperlinks on Henkel websites.

2. Collection, use and processing of personal data
Name of the responsible entity: Henkel AG & Co. KGaA

Address of the responsible entity: Henkelstrasse 67, 40589 Duesseldorf, Germany

Henkel uses personal data primarily to provide this website to the users and to ensure the proper functioning and security of this site. Any further processing of the data only occurs on the basis of other statutory duties or permissions or if the respective user has consented towards Henkel.
Henkel stores and processes data specifically for the following purposes:

When users visit the website, Henkel automatically collects and stores certain data. This includes: the IP address or device ID allocated to the respective end-device which we need for transmitting requested content (e.g. especially content, texts, and images as well as data files provided for downloading, etc.), the activity of users in the context of the website, the type of respective end-device, the used type of browser as well as the date and time of use.

Henkel stores this information for a maximum of 7 days for the purpose of recognizing and pursuing misuse.

Henkel uses this information also for improvements to the service’s presentation, features and functionalities as well as general administration tasks.

Aside from this, Henkel deletes or anonymizes the data on use, including the IP addresses, without undue delay as soon as they are no longer needed for the above-mentioned purposes.

The processing and use of the data is based on statutory provisions which justify those operations on the grounds that (1) the processing is necessary for the provision of the website; or (2) Henkel has an overriding legitimate interest in ensuring and enhancing the functionality and error-free operation of the website and that it is tailored to the users’ needs.

Recipients of the collected data may include members of the responsible internal departments, other affiliated companies of Henkel, external service providers (e.g. for hosting and content management, marketing agencies, other third party providers if this is necessary for the services they provide), authorities in the exercise of their respective duties and powers, for example, in the event of an official request on their part, or if this is necessary to establish, exercise or defend Henkel’s rights, and current or future acquirers of Henkel companies in the event of a business transaction, such as a sale, merger or acquisition.

3. Cookies, Pixels, Fingerprints, and similar technologies

This website uses cookies and similar technologies. Cookies are small units of data temporarily stored on the hard disk of your device by your browser that are necessary for using our website. A cookie often includes a unique identifier, which is a randomly generated number and stored on your device. Some expire at the end of your website session; others remain on your device for longer. Technically necessary cookies will be used automatically. Other cookies (or similar technologies) will only be applied based on your prior consent.

There are different types of cookies. First-party cookies are those placed by the website visited and can only be read by that website. Third-party cookies are those placed by other organizations that we use for various services. For example, we use external analytics service providers that place cookies on our behalf to tell us what is liked or not liked on our website. In addition, the website you visit may contain embedded content from, for example, YouTube, which in turn may set their own cookies.

A pixel is usually no more than 1-pixel x 1-pixel transparent image, that is placed on the website to collect data such as IP address, type of browser, time of access, or previously set cookies for the purpose of content personalization or making browsing more efficient and easier. They are often used in combination with cookies as pixels are generating and managing cookies.

Provided you have consented, the website will collect data regarding a device’s operating system, browser, language, installed fonts, IP address, plugins and further information. In doing so, a device can be re-identified for user-relevant marketing purposes.

You can find more information on the Cookies and other technologies used by our website and their purposes on our website under “Cookies” and “Cookie settings”. There, you can also withdraw your consent at any time with effect for the future by disabling the respective cookie setting.

Your preference is set for the named domain, per browser and device. Therefore, if you visit our website at home and work or with different browsers, you need to refuse data storage with every device or browser.

4. Whistleblower-Channels

If we receive messages through any of our whistleblower-channels we process relevant personal data relating to persons relevant in the respective context, which we have received or collected directly from the whistleblower report or which we collect from other sources in the course of the investigation from publicly available sources or from third parties, in particular from witnesses or other companies within the Henkel Group.

Depending on the exact nature of the reported behavior, such data may be, e.g.:

  • Contact data, in particular postal address, electronic addresses (e.g., email address), telephone numbers and user IDs;
  • Bank data, in particular account number, financial institute, credit card number, debit card number
  • Assessment data, in particular data with regard to assessments of performance and/or potential or personality, e.g., data in connection with Henkel’s employee appraisal process;
  • Learning data, in particular data about participation in training or eLearnings;
  • Communication data, in particular content of electronic communication, e.g., via email or other collaboration tools;
  • Connection data, in particular data that describes the circumstances of telecommunications or electronic communications, data from web analysis tools, e.g., telephone invoices, log files as well as websites, IP addresses and other data necessary for virus-scanning and cyber-defense;
  • Data concerning personal life, in particular data about relatives, interests as well as data about private life (which is not health data or data on religious belief)
  • ID data, in particular data that is generally stated on an identity card or a driving license, e.g., the birthday or passport number;
  • Pictures/Video Recording, in particular photographs as well as images from video surveillance;
  • Time stamps, in particular personalized records of activities with time stamps (time events), e.g. logging of events in computer systems, safety systems or recording of working hours; and/or
  • Transaction data, in particular data on particular contracts or legal relationships, payments, deliveries or other details of business transactions.

We will process the data specified above for the whistleblower process and the respective investigation in accordance with all statutory provisions, in particular, as the case may be, data protection, whistleblowing and employment related laws on the basis of Art. 6 Paragraph 1 lit. b GDPR (fulfillment of contract, in particular employment contracts and supply agreements), Art. 6 Paragraph 1 lit. c GDPR  (fulfillment of legal obligations), and Art. 6 Paragraph 1 lit. f GDPR (safeguarding our legitimate prevailing interests). Such legitimate interests may be e.g.: asserting or defending against any legal claims and litigation, IT security measures, prevention and detection of criminal offences, video surveillance to safeguard domiciliary rights and the collection of evidence in the event of, e.g. any burglaries, sabotage and thefts, measures for building and plant safety (e.g. physical access control), measures to secure domiciliary rights.

To the extent that we process special categories of personal data, Art. 9 GDPR applies.

There is no obligation to provide personal data. Henkel offers ways for whistleblowers to provide information anonymously.

We will store and process data for as long as this is necessary for the respective purpose for which it is being processed (e.g. for the duration of the employment relationship). Subsequently, the data will be deleted. We will delete data, which we process on the basis of Art. 6 Paragraph 1 lit. f), already as soon as your interests or fundamental rights and fundamental freedoms that require the protection of personal data outweigh our legitimate interests or those of a third party, or if our legitimate interests or those of a third party no longer exist.

However, in certain cases, we will continue to store and process the data as long as we are legally obliged to retain and store this information (for example, for tax or labor law reasons), as long as this is necessary to assert, exercise or defend legal rights or if we have legal grounds allowing further processing.

Within Henkel, data will only be provided to such employees (for example, specialist departments required for the investigation) who need them in connection with their official duties for the above-mentioned purposes.

In addition, data may be passed on to other companies within the Henkel Group if necessary.

We may use external service providers bound by data processing agreements for the provision of required services (e.g. IT services, consulting).

To the extent that this is required and permitted by data protection law, we may also pass on data to other recipients outside the Henkel Group. Such recipients may be e.g.: banks, social insurance carriers, public bodies and institutions (e.g. law enforcement authorities), lawyers, tax advisors and courts.

In this context, data may also be transmitted to countries outside the European Economic Area (EEA), in particular to other Henkel Group companies. If data is transmitted to countries outside the EEA, this will only be done if the EU Commission has decided that this country, this area or the specific sector provides an adequate level of protection (this is currently the case, for instance, in Andorra, Argentina, Canada (with restrictions), Faroe Islands, Guernsey, Israel (with restrictions), Isle of Man, Japan, Jersey, New Zealand, Switzerland, United Kingdom and Uruguay), and if suitable guarantees are provided for and enforceable rights and effective remedies are available to you (e.g. after conclusion of the EU Standard Contractual Clauses) or if there is an exemption according to Art. 49 GDPR (e.g. if you have consented to such a transfer or if this is necessary to fulfil the employment contract with us).

5. Your Data Subject Rights / Data Protection Officer

At any time, you may assert the right to access your data. Additionally, provided that the respective requirements are met, you may assert the following rights:

  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to lodge a complaint with the respectively competent data protection supervisory authority
  • Right to data portability (as of May 25th 2018)

Right to object

In case of processing activities involving your personal data that are carried out on basis of a legitimate interest of Henkel, you have the right to object against such processing of your personal data at any time for reasons resulting from your specific situation. Henkel will stop that processing unless Henkel can prove important reasons for the processing which deserve protection which outweigh your interests, rights and freedoms or if the processing serves to assert, exercise or defend against legal claims.

Should you have given your consent to the processing of your personal data, you can withdraw it at any time with effect for the future.

In these cases, or if you have any other questions or wishes with regard to your personal data, please send an email or a letter to our data protection officer, Mr. Frank Liebich, Henkel AG & Co. KGaA, Henkelstrasse 67, D 40191 Düsseldorf, Germany (Email: Datenschutz@henkel.com).