PRIVACY STATEMENT – SOCIAL MEDIA
A. Moras & Comp. GmbH & Co. KG
General
We, A. Moras & Comp. GmbH & Co. KG, Europaallee 42, 50226 Frechen (hereinafter ‘A. Moras & Comp. GmbH & Co. KG’ or ‘we’), maintain publicly accessible profiles on social networks. The specific social networks we use are listed further below. Social networks such as YouTube, LinkedIn, Facebook, Instagram, or TikTok can generally analyse your user behaviour extensively when you visit their website or a website with integrated social media content (for example, like buttons, embedded videos, pixels, or advertising banners).
Visiting our social media presences triggers numerous processing operations relevant to data protection. If you are logged into your social media account and visit our social media presence, the operator of the social media portal can associate this visit with your user account. Your personal data may, under certain circumstances, be collected even if you are not logged in or do not have an account with the respective social media portal.
Such data collection occurs, for example, through cookies or similar technologies stored on your device, or through the recording of your IP address and other usage data. Using this data, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be shown to you both within and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be shown on all devices on which you are or were logged in.
Please note that we cannot fully track or influence all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out independently by the operators of the social media portals. Details relating to this can be found in the terms of use and privacy policies of the respective social media portals.
We expressly point out that, where legally required, we obtain your consent for social media tracking, marketing pixels and similar technologies used on our website or the platforms. The legal basis is Art. 6 (1) (a) of the GDPR in conjunction with Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw your consent at any time with effect for the future via the ‘Cookie Settings’ function on our website. For this purpose, we use a consent management tool (CMP) that records your selection, provides you with an equivalent choice of ‘Accept all’ and ‘Reject all’, and specifies for each tool the purpose, provider, retention period and any third-country transfers. Technically necessary storage is carried out on the basis of Art. 6 (1) (f) GDPR and/or Section 25 (2) TDDDG.
Our social media offerings are not specifically directed at children under 16 years of age; parents or guardians should accompany interactions by minors.
Controller and your rights
When you visit one of our social media presences (for example on Facebook or Instagram), we may, under certain circumstances, be jointly responsible together with the operator of the respective social media platform for the data processing operations triggered by that visit. The controller within the meaning of the GDPR is A. Moras & Comp. GmbH & Co. KG, Europaallee 42, 50226 Frechen, Germany; email: datenschutz@schaebens.de. Our Data Protection Officer is named below under ‘Questions’.
Generally, you may exercise your rights of access, rectification, erasure, restriction of processing, data portability and complaint both against us and against the operator of the respective social media portal. Please note in this respect that, despite joint controllership together with the social media portal operators, we do not have full influence over their independent data processing; our options are largely determined by the corporate policies of the respective provider.
In addition, you have the right to object to the processing of your personal data where this is based on Art. 6 (1) (f) GDPR (legitimate interest). Any consent you have given may be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with the competent supervisory authority. For us, the competent authority is the Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, website: https://www.ldi.nrw.de.
We additionally point out that, where we do not collect data directly from you (for example public profile data, usage statistics/‘Insights’), the source of the data is the respective platform operator (Art. 14 GDPR). Recipients of your data may, in addition to the platform operators, include our IT and hosting service providers, agencies and, where applicable, the provider of the consent management tool; these act, where relevant, on the basis of a data processing agreement pursuant to Art. 28 GDPR.
You may object at any time to the processing of your personal data for the purposes of direct marketing; this also applies to profiling insofar as it is related to such direct marketing (Art. 21 (2) GDPR). Withdrawal of your consent does not affect the lawfulness of processing carried out up to the point of withdrawal (Art. 7 (3), sentence 2 GDPR).
Processing of personal data
As a rule, we only process the personal data that is publicly visible from you on social networks or that arises through your interaction with us. This may include, for example, your name, place of residence, age, gender, profile or cover image, your comments, messages, reactions (giving ‘likes’/‘hearts’), shared content as well as usage data and metadata (for example IP address, device and browser information, time stamps, referrer URL). You decide yourself which data on your profile is publicly visible and which content you share with us; you can change the relevant settings at any time in the privacy settings of the respective platform operator.
Unless otherwise described in this statement, the legal bases for processing your personal data, depending on the purpose, are Art. 6 (1) (b) GDPR (pre-/contractual communication), Art. 6 (1) (f) GDPR (legitimate interest in public relations, reach measurement and optimisation), and, in the case of tracking, retargeting and embedded content, Art. 6 (1) (a) GDPR (consent) in conjunction with Section 25 (1) TDDDG. Technically necessary storage is carried out on the basis of Article 6 (1) (f) GDPR in conjunction with Section 25 (2) TDDDG.
If you apply to us via social media, we shall process your data for the purpose of deciding on the establishment of an employment relationship pursuant to Section 26 (1) of the German Federal Data Protection Act (BDSG). Longer retention only takes place with your express consent pursuant to Art. 6 (1) (a) GDPR (for example for a talent pool).
Where we process data on the basis of Art. 6 (1) (f) GDPR, we ensure by means of a balancing of interests that your legitimate concerns are safeguarded (e.g. data minimisation, access restrictions, opt-out options). We do not carry out covert data collection regarding social media usage outside the respective platforms. We do not make exclusively automated decisions with legal effect or with similarly significant impact on you (Art. 22 GDPR).
The provision of personal data within the scope of our social media presences is generally neither legally nor contractually required. You are not obliged to provide data; however, without certain information it may be the case that individual functions (e.g. commenting, participation in competitions or responding to your messages) are not possible or only possible to a limited extent.
Retention period
The data directly collected by us via our social media presences is deleted from our systems once the purpose for storage ceases to apply, you request erasure, or you withdraw your consent, provided that no statutory retention obligations prevent deletion. Interaction and communication data that we require to process enquiries is generally deleted no later than twelve months after completion of the matter, unless longer statutory periods apply.
Stored cookies and similar technologies remain on your device until you delete them. Mandatory statutory provisions, in particular retention periods, remain unaffected. We have no influence over the period of retention of your data stored by the operators of social networks for their own purposes. For details in this regard, please refer directly to the privacy statements of the respective platform operators. Application documents are generally deleted six months after completion of the recruitment process, unless you have given us consent for longer retention.
Publicly visible posts or comments on our profiles generally remain visible until you or we delete them; direct messages are regularly deleted no later than twelve months after completion of the matter, provided that no statutory obligations prevent deletion.
Transfers to third countries
Your personal data will only be transferred to entities in countries outside the European Union (EU) or the European Economic Area (EEA) if this is necessary for the performance of a contract, you have given us your consent, or a statutory obligation requires such transfer.
Where we use service providers in the USA (e.g. cloud services, CRM systems, video conferencing tools), your personal data will, as a rule, only be transferred if the respective recipient is certified under the EU-U.S. Data Privacy Framework (DPF). In such cases, the European Commission determines, in accordance with Art. 45 GDPR, that an adequate level of data protection exists in the USA for these certified companies. Transfers are carried out only to the extent necessary for the respective purpose.
If the recipient is not certified under the DPF, we rely on other appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR). Where necessary, additional technical and organisational measures will be taken to ensure the protection of your data. You can find an up-to-date list of companies certified under the DPF at: https://www.dataprivacyframework.gov/s/participant-search.
Social networks in detail:
We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the USA and other third countries. When you access our Facebook page and become active on our page, for example by posting comments or giving ‘likes’, Facebook records your IP address and other information, such as data stored by cookies on your device (see also the explanations above under ‘General’).
This information is used to provide us, as the controller of the Facebook page, with statistical information about the usage behaviour of users of our Facebook page, and is therefore also transmitted to us by Facebook. The transfer of data for the analysis of your usage behaviour takes place, pursuant to Art. 6 (1) (a) GDPR, on the basis of the consent you have given. We process the data in order to be able to observe your behaviour and analyse your interactions on our Facebook page, assess the image of our company and our products, better understand the wishes and needs of our users, and enable contemporary communication.
Together with Facebook (Meta), we are jointly responsible pursuant to Article 26 GDPR for the processing of the so‑called ‘Page Insights’. This data is collected by Facebook and made available to us in aggregated form. The agreement on joint controllership can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum
According to this agreement, Facebook assumes primary responsibility for fulfilling your data subject rights (e.g. access, erasure, rectification). You may exercise your rights both against us and directly against Facebook. Further information on the handling of your personal data can be found in Facebook’s privacy statement: https://de-de.facebook.com/policy.php.
Irrespective of joint controllership for Page Insights, Facebook (Meta) processes your data in other respects under its own responsibility.
We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. When you access our Instagram page and become active on our page, for example by posting comments or giving ‘hearts’, after having granted us your consent pursuant to Art. 6 (1) (a) GDPR, Instagram records your IP address and other information stored by cookies on your device.
This information is used to provide us, as the controller of the Instagram page, with statistical information about the usage behaviour of users of our Instagram page, and is therefore also transmitted to us by Instagram. Instagram uses this data to show targeted and personalised advertising to its users and to create interest-based user profiles. The data collected is anonymous to us and not accessible, and is only usable for us in the context of measuring the effectiveness of advertising placements. You may withdraw your consent at any time with effect for the future. As a rule, no additional costs are incurred for this.
Together with Instagram (Meta), we are jointly responsible pursuant to Art. 26 GDPR for the processing of the so‑called ‘Page Insights’. This data is collected by Instagram and made available to us in aggregated form. The agreement on joint controllership can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum
According to this agreement, Meta assumes primary responsibility for fulfilling your data subject rights. You may exercise your rights both against us and directly against Meta. Further information on the handling of your personal data can be found in Instagram’s privacy statement: https://help.instagram.com/519522125107875.
In other respects, Instagram (Meta) processes personal data as an independent controller.
We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies. On our pages, the so‑called Insight Tag of the social network LinkedIn is implemented. This tag enables the collection of data relating to visits to our website, including URL, referrer URL, IP address, device and browser characteristics, time stamps, and page views.
The processing of personal data takes place, pursuant to Art. 6 (1) (a) GDPR, on the basis of the consent you have given. We process the data in order to be able to observe your behaviour and analyse your interactions on our LinkedIn page, assess the image of our company and our products, track the conversion of campaigns, and better understand the wishes and needs of our users.
Where we use LinkedIn Insights data, we are, pursuant to Art. 26 GDPR, jointly responsible together with LinkedIn for the processing of this data. The agreement on joint controllership can be viewed here: https://legal.linkedin.com/pages-joint-controller-addendum
According to this agreement, LinkedIn assumes primary responsibility for fulfilling your data subject rights. You may exercise your rights both against us and directly against LinkedIn. Further information on the collection of data, on purposes, scope, further processing and use, as well as on your rights, can be found in LinkedIn’s privacy notice: https://www.linkedin.com/legal/privacy-policy.
Outside of joint controllership for Insights, LinkedIn acts as an independent controller.
YouTube
We use the platform YouTube.com on our website. The contracting party in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (further processing may be carried out by Google LLC, USA), for the purpose of uploading our own videos and making them publicly accessible.
Generally, we are not responsible for the content of internet pages to which links are provided. When you visit our website and play the videos, YouTube/Google receives information confirming that you have accessed the corresponding sub-page of our website. If you are logged into Google, this data is directly associated with your account.
If you do not want your data to be associated with your YouTube profile, you must log out before activating the button. YouTube/Google stores data even if you do not have a Google user account. When the relevant pages are accessed, the IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), the content of the request (specific internet page), access status/HTTP status code, the respective transmitted amount of data in bytes, the website from which the request originates (link), the browser used, the operating system and its interface, as well as the language and version of the browser software are transmitted, thereby in particular communicating which internet page you have visited.
YouTube/Google stores this data as usage profiles and uses it for the purposes of advertising, market research and/or the needs-based design of its website. Such evaluation takes place in particular, even for users who are not logged in or do not have a corresponding account, in order to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of usage profiles, which you may exercise by contacting YouTube.
The integration of YouTube content takes place in extended data protection mode and with a two-click solution. This means that initially no data is transmitted to YouTube/Google and no cookies are set. Cookies will only be set, and data (such as IP address, time stamp, browser/device information, and page accessed) transmitted to YouTube/Google, if you play an embedded video or give your consent in the cookie settings. The legal basis is your consent pursuant to Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR; technically required elements are based on Section 25 (2) TDDDG.
The information collected by this provider’s cookies is generally sent to a server in the USA and stored there. Any transfers to the USA take place, where applicable, on the basis of the EU-US Data Privacy Framework (DPF) and/or the EU Commission’s Standard Contractual Clauses (SCC). We do not collect or process personal data via YouTube. The disclosure of personal data by Google, in particular to third countries, lies outside the responsibility of A. Moras & Comp. GmbH & Co. KG. Further information on data protection on the YouTube platform can be found at: https://www.google.de/intl/de/policies/privacy
Outside of page integration, Google/YouTube processes data as an independent controller.
TikTok
We use the ‘TikTok Pixel’ from the provider TikTok on our website. The controller is TikTok Information Technologies UK Limited, Aviation House, 125 Kingsway Holborn, London, WC2B 6NH. When you visit our website, and provided you have given express consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG, the TikTok Pixel code implemented on our website establishes a connection with TikTok’s servers to track your behaviour on our website.
We process the data in order to be able to observe your behaviour and analyse your interactions on our TikTok page, assess the image of our company and our products, better understand the wishes and needs of our users, and enable contemporary communication. You may withdraw your consent at any time with effect for the future. As a rule, no additional costs are incurred for this. Personal data such as your IP address and your email address, as well as other information such as device ID, device type and operating system, may also be transmitted to TikTok. TikTok uses email or other login or device information to identify users of our website and to associate their actions with a TikTok user account.
TikTok uses this data to show targeted and personalised advertising to its users and to create interest-based user profiles. The data collected is anonymous to us and not accessible, and is only usable for us in the context of measuring the effectiveness of advertising placements. As a rule, your data is processed within the EU or the EEA. For this purpose, a corresponding data protection agreement has been concluded with TikTok. Where personal data is transferred to countries outside the EU or the EEA, this is carried out under the Standard Contractual Clauses adopted by the European Commission. TikTok’s privacy policy can be found here: https://www.tiktok.com/legal/new-privacy-policy?lang=de-DE.
Where we and TikTok jointly decide on the purposes and means of processing within the framework of the TikTok Pixel, we and TikTok act as joint controllers in accordance with Art. 26 GDPR. In this case, TikTok assumes primary responsibility for fulfilling your data subject rights; you may assert your rights both against us and directly against TikTok.
Outside of any joint controllership, TikTok processes data under its own responsibility.
We have a profile on the social media platform Pinterest. The provider is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Visiting our account triggers data processing operations relevant to data protection.
Please note: If you are logged in with your social media account and visit our profile, the operator of the social media portal may associate this visit with your user account. It is possible that your personal data may be collected even if you are not logged in or do not have a Pinterest account. Such data collection generally takes place via cookies stored on your device or by recording your IP address. Using the data collected in this way, the operators of the social media platforms can create user profiles in which your preferences and interests are stored.
In this way, interest-based advertising can be shown to you both within and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be shown on all devices on which you are or were logged in. Please note that we cannot fully track or influence all processing operations on the social media platforms. By processing data via our Pinterest account, we aim to inform customers and interested parties about our products and services, offers and promotions, competitions, and company news, and to generally interact with users. In addition, we process your data to analyse your interactions on our account and thereby understand how our company and products are perceived by customers and interested parties.
This enables us to better understand the needs of our visitors and to respond to them in future. The legal basis for this processing, depending on the circumstances, is Art. 6 (1) (b) GDPR (e.g. product enquiries) or our legitimate interest in communicating with users/interested parties and in public relations for advertising purposes pursuant to Art. 6 (1) (f) GDPR. Where you have given Pinterest consent to data processing with effect for us, the legal basis is Art. 6 (1) (a) GDPR.
We point out to you that you use our Pinterest account and its functions under your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating). Please note that, when you use Pinterest, your data may be processed outside the EU, in particular in the USA. This may entail risks for you as a user, for example in asserting your data subject rights, which we as the operator of the Pinterest profile cannot exclude.
As user data is held exclusively by Pinterest, we have no access to it. The data collected directly by us via our social media presence is deleted from our systems once the purpose for storage ceases to apply, you request deletion, withdraw your consent, or the purpose for storing the data ceases to apply.
Cookies stored on your device remain until you delete them. Mandatory statutory provisions, in particular retention periods, remain unaffected. We point out that we have no influence over the period of retention of your data stored by the operators of social networks for their own purposes. Further information can be found in Pinterest’s privacy statement: https://policy.pinterest.com/de/privacy-policy
As a rule, Pinterest processes the use of its services under its own responsibility.
We have a profile on XING. The provider is New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. XING uses advertising cookies and processes your personal data that you voluntarily provide (including name, email address, CV, and information about your use of the social network). If you wish to deactivate advertising cookies, please use the following link: https://privacy.xing.com/de/datenschutzerklaerung/informationen-die-wir-auf-grund-ihrer-nutzung-von-xing-automatisch-erhalten/bereitstellung-unseres-dienstes
We process your data for the statistical evaluation of visitors to our XING profile, and when you contact us via the XING platform or apply for a posted position via XING, for precisely these purposes. In such cases, XING collects your data and makes it available to us. The processing of your personal data in the event of an application is governed by our applicant privacy statement. Details on the processing of your personal data by XING can be found in XING’s privacy statement at: https://privacy.xing.com/de/datenschutzerklaerung/druckversion
XING is independently responsible for its own further processing of personal data.
Questions
You can contact the Data Protection Officer of A. Moras & Comp. GmbH & Co. KG, Mr Bernd Fuhlert of TRIARI.US GmbH, Müller-Breslau Straße 28, 45130 Essen, by email at: datenschutz@schaebens.de
Right to amend
We reserve the right to amend this Privacy Statement as necessary to reflect legal changes or modifications to our data processing. The respective current version is available at any time on this website. Last updated: September 2025.