Privacy Policy

Effective: August 2025

The GMT Group is a leading international manufacturer of components and systems for vibration technology. Our customers in the plant and machinery engineering, rail vehicles, construction machinery, and commercial vehicle markets value our customer-specific innovations and technological expertise. We appreciate your visit to our website and your interest in the GMT Group and our products. Below, we provide information about the type and scope of personal data that we

(hereinafter “website”), the purposes for which we process this data, the legal bases, and your rights as a data subject.

A. General

1. General Information

 Further information regarding the processing of personal data by GMT beyond the operation of the website can be found in the supplementary privacy notices for customers and suppliers under the GDPR, which we also make available on our website.

2. Data Controller / Data Protection Officer

(1) The data controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is

GMT Gummi-Metall-Technik GmbH
Liechtersmatten 5, D - 77815 Bühl
Tel. +49 7223 804-0
Fax +49 7223 21075
info@gmt-gmbh.de

referred to as “we” or “us.” Further information about the provider can be found in our legal notice.

(2) You can contact the company’s data protection officer as follows: datenschutzbeauftragter@gmt-gmbh.de, Tel. +49 7223 804 951, or via our mailing address with the note “Data Protection Officer.”
 

3. Types of Data Processed, Categories of Data Subjects

3.1 Types of Data Processed

3.2 Categories of Data Subjects

(Hereinafter, we collectively refer to the data subjects as “users.”)
 

4. Purpose of Processing

We use your personal data

5. Provision of the Website and Log Files

(1) When you use the website purely for informational purposes—that is, if you do not register or otherwise provide us with information—we collect only the personal data that your browser automatically transmits to our server. Exceptions apply when we use web analytics services to analyze user behavior (see Section B. Web Analytics Services and C. Data Processing by Third-Party Providers). When you view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis is Art. 6(1)(f) GDPR):

(2) Users’ IP addresses are deleted or anonymized after use has ended. During anonymization, IP addresses are modified in such a way that specific information regarding personal or factual circumstances can no longer be attributed to a specific or identifiable natural person—or can only be attributed with a disproportionately large expenditure of time, cost, and labor.

(3) We analyze log file records in anonymized form to further improve our website and make it more user-friendly, to identify and correct errors more quickly, and to manage server capacity.
 

6. Cookies

(1) In addition to the log file data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are assigned to and stored on your hard drive by the browser you are using, and through which certain information is transmitted to the entity that sets the cookie (in this case, us). Cookies cannot run programs or transfer viruses to your computer. They serve to make the website more user-friendly and effective overall.

(2) Use of Cookies:

a) This website uses the following types of cookies, the scope and functionality of which are explained below:

b) Session cookies store a so-called session ID, which allows various requests from your browser to be associated with the same session. Session cookies are automatically deleted when you log out or close your browser. If you restart your browser and return to the website, the website will not recognize you. You will need to log in again (if a login is required) or reset templates and preferences if the website offers these features. A new session cookie will then be generated, which stores your information and remains active until you leave the site and close your browser.

c) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete these cookies at any time in your browser’s security settings.

(3) For what purposes do we use cookies?

When you visit our website, the country and language selection—whether determined automatically or chosen by you—is stored in cookies to save you from having to select them again on subsequent visits. First, we check whether your browser supports cookies, and this information is stored in another cookie. You are then shown contact information localized according to your country and language, which is also stored. The legal basis for this is Article 6(1)(f) of the GDPR.

Overview

Purpose

Technically Necessary Cookies

Technically necessary cookies enable the use of our website by facilitating basic functions such as page navigation and access to secure areas of the website. Visiting our website cannot function properly without these cookies.

Session Cookies – are deleted when you close your browser

Performance (e.g., user’s browser) and Preferences

When you use our website, cookies are used (e.g., to recognize your browser) to improve performance (e.g., faster loading of content). When you visit our website, the country and language selection—whether determined automatically or chosen by you—is stored in cookies to save you from having to select them again on subsequent visits. We first check whether your browser supports cookies, and this information is stored in a separate cookie. You are then shown contact information localized for your country and language, which is also stored. The legal basis for this is Article 6(1)(f) of the GDPR.

Session cookies—are deleted when you close your browser.

Analytics Cookies (Statistics)

We use third-party analytics cookies to understand how visitors use our site. This helps us improve the quality and content of our site. The aggregated statistical information includes data such as the total number of visitors. For example, we learn how frequently and in what order individual pages were accessed and how much time visitors spend on our pages on average. We also learn whether users have visited our website at an earlier time. The legal basis for this is our legitimate interests, as well as your consent to the extent that we ask for your consent to the processing. For more information, see Section B. Web Analytics Services.

Persistent cookies—remain on the computer but are automatically deleted after 26 months if the website has not been visited again, unless shorter periods apply in individual cases. You can manually delete the cookies at any time.

(4) Control Over Cookies

You can configure your browser settings according to your preferences and, for example, control or reject the acceptance of third-party cookies or all cookies as you see fit. You can delete existing cookies via your browser settings. Please note that you may then be unable to use all features of this website.
 

7. Contact Form and Email Contact

(1) Our website features a contact form that can be used to contact us electronically. If a user makes use of this option, the data entered in the form is transmitted to us and stored. This data includes:

* Fields marked with an asterisk are required.

The following data is also stored at the time of submission:

(2) Your consent to the processing of this data is obtained as part of the submission process, and reference is made to this Privacy Policy. Alternatively, you may contact us via the email address provided. In this case, the user’s personal data transmitted via email will be stored.

(3) The legal basis for processing the data, provided the user has given consent, is Article 6(1)(a) of the GDPR. The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. If the purpose of the email contact is to conclude a contract, the legal basis for the processing is Article 6(1)(b) of the GDPR.

(4) We process the personal data entered in the contact form solely for the purpose of handling the contact request. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data.

(5) The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For personal data entered into the contact form and data sent via email, this is the case once the respective conversation with the user has ended. The conversation is considered concluded when the circumstances indicate that the matter in question has been definitively resolved.
 

8. Job Postings (Careers)

(1) We post job openings on our website. We collect, process, and use your personal data to process your online application. The legal basis is Article 6(1)(b) of the GDPR. The application data you enter via the application form on our website is transmitted to BITE, an external service provider commissioned by us, which informs the data controllers and authorized personnel at GMT of the receipt of the application. Appropriate technical and organizational measures ensure that your personal data is transmitted securely and treated confidentially.

(2) BITE is a cloud-based application management solution that assists us in managing job postings, reviewing and evaluating application portfolios, and communicating with applicants. We have entered into a data processing agreement with BITE in accordance with Article 28 of the GDPR.

(3) The third-party provider is BITE GmbH, Magirus-Deutz-Straße 12, 89077 Ulm. Information on data protection can be found at the following link: www.b-ite.de/legal-notice.html

(4) What data is processed?

(5) Please note that, by default, applications submitted via email are encrypted only during transmission, and the data could potentially be viewed or tampered with by unauthorized parties. You are welcome to send us your documents by mail. If you have applied for a specific position and it has already been filled, or if we consider you equally or even more suitable for another position, we would be happy to forward your application within our company. The legal basis for this is Article 6(1)(f) of the GDPR to safeguard your and our legitimate interests. Please let us know if you do not agree with this procedure.

(6) Upon completion of the application process, but no later than 6 months thereafter, your personal data will be automatically deleted, unless you expressly consent to its storage for a longer period.
 

9. Automated Decision-Making, Profiling

We generally do not use fully automated decision-making pursuant to Article 22 of the GDPR to establish or carry out the business relationship. GMT does not use profiling.
 

10. Disclosure to Third Parties

(1) In connection with the hosting of our website, the data we process is handled pursuant to a data processing agreement.

(2) When using web analytics services and third-party providers, data is transferred to the extent described herein; see Sections B and C.
 

11. Retention Period

We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations. We delete your personal data as soon as it is no longer necessary for the purposes mentioned above. In some cases, personal data may be retained for the period during which claims against our companies may be asserted (statutory limitation periods of three to thirty years). Corresponding documentation and retention obligations arise from commercial, tax, and social security regulations. Operational data containing personal data (e.g., system logs) is automatically deleted 90 days after creation. Cookies are deleted as described in Section 6.

B. Web Analytics Services

Google Analytics

(1) This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the analysis of website visitors’ behavior. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user’s location. This data is aggregated into a user ID and assigned to the website visitor’s respective device.

Furthermore, Google Analytics allows us to track, among other things, your mouse and scroll movements and clicks. Google Analytics also uses various modeling approaches to supplement the collected data sets and employs machine learning technologies in its data analysis. Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google regarding the use of this website is generally transmitted to a Google server in the United States and stored there.

(2) Legal Basis

Use of this service is based on your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG (Telecommunications and Digital Services Data Protection Act). You may revoke your consent at any time.

(3) Data Transfer to Third Countries

Data transfers to the United States are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. You can obtain further information on this from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

(4) IP Anonymization

Google Analytics IP anonymization is enabled. As a result, your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the United States. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.

(5) Browser Plugin

You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. For more information on how Google Analytics handles user data, please see Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=de.

(6) Data Processing on Behalf of a Client

We have entered into a data processing agreement with Google and fully comply with the requirements of the German data protection authorities when using Google Analytics.

C. Processing by Third-Party Providers

1. Cookiebot

(1) This website uses Cookiebot. The Cookiebot Consent Management Platform (CMP) provides transparency and control over all cookies and similar tracking technologies on our website. Through the CMP, users can individually grant their consent. This plug-and-play solution for data protection compliance is based on scanning technology that detects and monitors all cookies and trackers on a website and automatically manages end-users’ consents.

(2) Information about the third-party provider: Since September 2021, Cookiebot CMP has been a cloud service provided by the e-privacy company Usercentrics, Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, Phone: +49 89 21 54 01 20, Email: contact@usercentrics.com

(3) Information regarding the processing of your personal data by Cookiebot can be found here: https://www.cookiebot.com/de/privacy-policy/. The cookie policy can be found here: https://www.cookiebot.com/de/cookie-declaration/
 

2. Google Web Fonts

(1) This site uses so-called web fonts provided by Google to ensure consistent font display. When you visit a page, your browser loads the necessary web fonts into its cache to display text and fonts correctly.

(2) The web fonts are installed on our web server and are made available from there when you visit the website. No data is transmitted to Google.
 

3. MS Teams

(1) If you are invited to an MS Teams meeting initiated by GMT, you will be informed that the meeting may be recorded and automatically transcribed. By participating in the meeting, you agree that your camera feed and your comments, including chat messages and emoji reactions, will be recorded in audio and video. The recording will be clearly marked. If you do not agree to this, you can disable your camera and/or microphone at any time. Depending on the selected settings, no video or audio recordings of you will be made and, therefore, you will not be transcribed.

(2) Personal Data

When a Microsoft Teams session is recorded or transcribed, we process the personal data of the individuals participating in that session. This may include the following individuals:

The personal data processed in an MS Teams recording or transcription relates to the individuals who participate in the meeting by being present.

(3) Data Categories

(4) Legal Basis

The legal basis for any MS Teams recording and transcription depends on the type of meeting being recorded and the reason for the recording.

(5) Recipients: The GMT meeting organizer can choose who has access to the recording and the meeting minutes.

D. Social Media

1. YouTube

(1) We have embedded YouTube videos in our online content that are stored on http://www.youtube.com and can be played directly from our website. These are all embedded in “enhanced privacy mode,” meaning that no data about you as a user is transmitted to YouTube unless you play the videos. Only when you play the videos is the data specified in Section A. 3 transmitted. We have no control over this data transmission.

(2) When you visit the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the data specified in Section A. 5 (Provision of the Website and Log Files) of this policy is transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for this data to be associated with your YouTube profile, you must log out before clicking the button.

YouTube stores your data as usage profiles and uses them for advertising, market research, and/or to tailor its website to user needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver personalized advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.

(3) YouTube is a subsidiary of Google: Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. For more information on the purpose and scope of data collection and its processing by YouTube, please refer to the privacy policy. There you will also find further information about your rights and settings options for protecting your privacy: https://policies.google.com/privacy?hl=de.

2. LinkedIn

We maintain a company profile on the online platform of the social network operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”), where personal data is processed. 

(1) Joint Control 

Together with LinkedIn, we are jointly responsible for data processing in connection with our company profile, particularly in connection with the “Page Insights” feature, in accordance with the provisions of Article 4(7) of the GDPR. When you visit our company profile, personal data is processed by LinkedIn and by us as data controllers. With this privacy notice, we would like to inform you of the extent to which your personal data (hereinafter referred to simply as “data”) is processed by us in this context. 

(2) LinkedIn Terms of Use

The use of our company profile is governed by LinkedIn’s Terms of Use, in particular the “Page Insights Joint Controller Addendum.” These Terms of Use (including the other terms and policies listed therein) are solely applicable. The “Page Insights Joint Controller Addendum” can be accessed at: https://legal.linkedin.com/pages-joint-controller-addendum. LinkedIn’s Privacy Policy can be found at: https://www.linkedin.com/legal/privacy-policy. 

(3) What data does LinkedIn process?

LinkedIn does not store any personal data simply through the integration of social plug-ins. LinkedIn refers to this data generated by plug-ins as “passive impressions.” However, if you click on a social plug-in—for example, to share our content—the platform stores personal data as so-called “active impressions.” This occurs regardless of whether you have a LinkedIn account or not. If you are logged in, the collected data is associated with your account. Your browser establishes a direct connection to LinkedIn’s servers when you interact with our plug-ins. In this way, the company logs various usage data. In addition to your IP address, this may include, for example, login data, device information, or details about your internet or mobile service provider. If you access LinkedIn services via your smartphone, your location may also be determined (after you have given your consent). LinkedIn may also share this data in “hashed” form with third-party advertisers. Hashing means that a data record is converted into a string of characters. This allows the data to be encrypted in such a way that individuals can no longer be identified.

(4) Legal Basis

If you have consented to the processing and storage of your data through integrated social media elements, this consent serves as the legal basis for data processing (Art. 6(1)(a) GDPR). In general, your data is also stored and processed based on our legitimate interest (Art. 6(1)(f) GDPR) in maintaining fast and effective communication with you or other customers and business partners. However, we only use the embedded social media elements to the extent that you have given your consent

(5) Data Transfer to Third Countries

LinkedIn processes your data, among other places, in the United States. LinkedIn is an active participant in the EU-U.S. Data Privacy Framework, which governs the proper and secure transfer of personal data of EU citizens to the United States.

In addition, LinkedIn uses so-called Standard Contractual Clauses (Art. 46, paras. 2 and 3 of the GDPR). Standard Contractual Clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the United States). Through the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses, LinkedIn commits to adhering to European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the U.S.

E. Links to Other Websites

(1) Our website may contain links to websites operated by third parties that are not covered by this Privacy Policy. These third-party websites have their own privacy policies and may also use cookies or other tracking technologies. The respective operator or the designated data controller of the corresponding website is responsible.

(2) We review links to external websites before posting them. However, we have no control over whether their operators comply with data protection regulations. If we become aware of any violations or legal infringements, we will remove the relevant links immediately.

F. Your Rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller:

1. Rights under Art. 15 et seq. of the GDPR

(1) The data subject has the right to request confirmation from the data controller as to whether the relevant personal data is being processed. If this is the case, the data subject has the right to access this personal data and to receive the information specified in detail in Article 15 of the GDPR. Under certain conditions, you have the right to rectification under Article 16 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, and the right to erasure (“right to be forgotten”) under Article 17 of the GDPR. In addition, you have the right to receive the data you have provided in a structured, commonly used, and machine-readable format (right to data portability) under Article 20 of the GDPR, provided that the processing is carried out by automated means and is based on consent under Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) of the GDPR. With regard to the right of access and the right to erasure, the restrictions set forth in Sections 34 and 35 of the BDSG apply.

(2) You may revoke any consent you have given to the processing of personal data at any time by notifying us. Please note that the revocation takes effect only for the future. Processing that took place prior to the revocation is not affected.

2. Right to File a Complaint

You have the option to file a complaint with us or with a data protection supervisory authority, in particular in the Member State of your residence, your workplace, or the location of the alleged infringement (Article 77 of the GDPR in conjunction with Section 19 of the BDSG).

3. Right to Object under Article 21 of the GDPR

In addition to the aforementioned rights, you have the right to object as follows:

a) Right to object on a case-by-case basis

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Article 6(1)(e) of the GDPR (data processing in the public interest) and Article 6(1)(f) of the GDPR (data processing based on a balancing of interests); this also applies to profiling based on these provisions within the meaning of Article 4(4) of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

b) Right to Object to the Processing of Data for Marketing Purposes

In certain cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

The objection may be submitted in any form to the address specified in Section A. 2. of this Privacy Policy.

G. Final Provisions

1. Security

We have implemented technical and organizational security measures in accordance with Articles 24 and 32 of the GDPR to protect your personal data from loss, destruction, manipulation, and unauthorized access. All of our employees and all third parties involved in data processing are obligated to comply with the requirements of the GDPR and to treat personal data confidentially.

2. Changes to Our Privacy Policy

We reserve the right to modify our security and data protection measures to the extent necessary due to technical developments or changes in the law. In such cases, we will also update our Privacy Policy accordingly. Please therefore refer to the most current version of our Privacy Policy.