HiKOKI Newsletter

1. Controller of personal data

This website is operated by

Metabowerke GmbH
Metabo-Allee 1
D-72622 Nürtingen
Germany

which you can contact via e-mail to: de-marketing.hikoki@koki.eu

This means that you can contact Metabowerke GmbH with any questions regarding data protection on the website, in particular if you wish to assert your rights.

2. Purpose

This document outlines the specific information that we are obligated to provide to data subjects in the EU and EEA under the General Data Protection Regulation ((EU) 2016/679 GDPR) established by the EU. These regulations specify the rights of data subjects and the protocols for managing personal data.

3. Scope of this privacy policy

This document covers our processing of your personal data on our website https://hikoki-powertools.eu/en/.

4. Contact information for Data Protection:

Data Protection Officer
Metabowerke GmbH 
Metabo-Allee 1 
D-72622 Nürtingen
Germany
dpo@enobyte.com

5. Legal grounds of our processing

We will only process your personal data if there is a legal basis to do so. Under GDPR, there are three legal bases that we use.

(1) Consent (Art. 6 (1) a) GDPR) – If consent is freely provided by you, we are allowed to process your personal data only for the purpose for which the consent was given.

(2) Contractual obligation (Art. 6 (1) b) GDPR) – If we have a contract with you, we will need to store and use some information about you. The same is true if we take necessary steps at your request prior to entering into a contract.

(3) Legitimate interest (Art. 6 (1) f) GDPR) – Legitimate interest allows us to process personal data if it is necessary for our legitimate interests and your interests or fundamental rights and freedoms do not outweigh our interest. We will inform below if we do such processing and what interests we pursue.

6. Use of this website

When you visit our website, the servers automatically save server log file information sent by your browser. This information includes:

Content data
- Any text you enter or files you upload

Usage data
- Websites visited
- Date and time of your request

Metadata
- Your IP-address
- Your computers time zone
- Your computers date and time
- The website you requested
- Which website you came from
- Information about your browser (version, language, fonts installed)
- Information about your operating system (version, language)
- Potentially other information your browser sends via the HTTP protocol.

Temporary storage of the IP-address by the system is necessary to display website content on your device. The information is used exclusively to maintain the technical operation of the servers and the network and ensure its security. The legal basis is our legitimate interest to provide the website in a secure manner (Article 6 (1) f) GDPR).

We automatically delete all server-logs within 14 days. We store the logs for this time to see suspicious activities in our server and protect our infrastructure from outside attacks such as DDoS.

We use an external hosting provider to serve the website. The provider receives and stores the content data, usage data and metadata on our behalf. We use following external hosting providers:

(1) Cloudflare, Inc.
We use Cloudflare, Inc. as our CDN-provider to load some pictures, videos and elements of this website. The CDN-provider will receive usage data and metadata of your visit. By using a CDN, we can more efficiently provide you with the information you requested and keep our website secure. The legal basis for this use is our legitimate interest (Article 6 (1) f) GDPR).

Cloudflare, Inc. is located in 101 Townsend St, San Francisco, CA 94107. USA.
You can review their privacy policy here: 
https://www.cloudflare.com/en-gb/privacypolicy/

(2) Leaseweb Netherlands B.V.
We use Leaseweb Netherlands B.V. as our Hosting-provider to host our services of this website. The legal basis for this use is our legitimate interest (Article 6 (1) f) GDPR).

Leaseweb Netherlands B.V. is located in Hessenbergweg 95, 1101 CX Amsterdam, The Netherlands. 
You can review their privacy policy here: 
https://www.leaseweb.com/en/about-us/legal/personal-data-protection-acts
 

6.1 Contact form

If you use our contact form (https://hikoki-powertools.eu/en/contact/), we will receive and store the information you have entered additional to the information described above.

Some fields in the contact form are mandatory, so you have to fill these in to send your message. Others are optional, and you can decide if you want to provide the information.
We will use the information you have entered to respond to your message and take any actions you may have requested.
We do not use the information for other purposes and delete after 6 month, unless a legal obligation forces us to keep the information for longer.

Our mandatory fields are:
- Email-address: We need this to respond to you

If you do not want to give certain information, you can also enter false data. However, in some cases we will not be able to respond to your message if information is missing.

Our basis for this processing is our contractual obligation if your message concerns purchasing or services offered by us.
If you have a general request, our legal basis is legitimate interest, as we want to give you the best service we can.

6.2 Registration for promotional campaigns for end customers

You can register yourself at the MyHiKOKI portal. To do so, you must create an account. Your data is processed in order to provide our promotional campaigns. Furthermore, data is processed in case of any recall campaigns involving HiKOKI products. Cross-brand data management is carried out between different group companies within the framework of a balancing of interests.

You can manage or delete your account at any time through your personal login. If you delete your account and do not provide us with the necessary information and documents, we will not be able to begin or continue the business relationship you have requested. Otherwise, your account will remain active until it is revoked.

We make use of the services of Coeln Concept GmbH, Uhlstraße 19-23, 50321 Brühl, Germany, in order to provide the portal. We have concluded a Data Processing Agreement with this company. For further information on the purpose and scope of data collection, as well as the further processing and use of the data by Coeln Concept, your relevant rights and setting options to protect your privacy, please see the Coeln Concept data privacy information: https://www.coelnconcept.de/datenschutzerklaerung

6.3 Chat function

At https://ai.hikoki-powertools.eu, we offer an AI-based chat function that allows you to obtain requirement-specific product information about our range of HiKOKI products. For the chat function, we use the Open AI API platform provided by OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. No personal data is required to use the AI-based chat function. We strongly recommend not to enter any personal information, as the chat function can be used efficiently without this information while your privacy remains unaffected. If you do enter personal data, the legal basis for the associated data processing is your consent (Art. 6 (1) (a) GDPR). In addition, the content you enter—regardless of whether it contains personal data—may be used to continuously improve our overall customer experience. This includes analyzing chat content to better tailor products, services, and information offerings to customer needs, and further developing and customer-oriented design of our product portfolio.
 

6.4 Newsletter and Marketing Automation

On the MyHiKOKI portal, you can register to have the HiKOKI newsletter sent to you and register for direct digital communications. If you register for the newsletter, you will receive interesting information, offers and news about HiKOKI and our products from us. You can revoke your consent to use your data for advertising purposes at any time.

We use Marketing Automation Tool Click, a service of ClickDimensions LLC 5901, Peachtree Dunwoody Road, Suite C370, Atlanta GA 30328, USA, to send out digital advertisements. This tool enables marketing functions with a focus on inbound marketing, lead management, multi-channel measures and campaign measurements. Its functions include email marketing, campaign automation, web intelligence, surveys, web forms, landing pages and much more, and these support us in appealing to potential and existing customers through a wide range of digital channels. The data elements used in marketing automation include contact details (email address, name, etc.), email events (open rate, click rate, unsubscribe rate, etc.), web form and survey submissions, profile management (contact data sets), web tracking data (IP addresses, page impressions and views, URLs, timestamps, operating system data, etc.). Further information is available in the ClickDimensions data privacy policy www.clickdimensions.com/about/privacy-policy/.

6.5 Cookies on this website

Cookies are small text files that any website can write into your browser. Cookies may be set by ourselves (first party cookies), or by third parties. If we set a cookie in your browser, other websites cannot read it. If other third parties set a cookie in your browser, any other website which uses the same third party cookies can read the information stored in these cookies.
This allows for tracking functionality across websites. If we use third party cookies, we will always ask for your consent before placing these cookies.

Below you can see a list of first party cookies which we set:

The following table shows a list of third party cookies we use:

6.6. Geolocation

To use the dealer locator, we need to collect your location via geolocation, as otherwise it is not possible to display the nearest dealers. If you consent to the use of your location, we will process your geolocation data solely for the purpose of carrying out the dealer search. The location data is processed only for the duration of the retailer search and is subsequently deleted. It is not stored permanently. The legal basis for the processing of your geolocation data is your consent. You may withdraw your consent at any time via the ‘Cookie Settings’ button in the footer, with effect for the future.
 

7. Third Parties

On our websites, we may embed tools and contents loaded from the servers of third party service providers. Examples of this may be graphics, videos, social-media buttons, or other functionalities.
Whenever you access a website which embeds such contents, your IP-address will be transmitted to these third parties.
Occasionally these tools might include so called web beacons, invisible graphics that are used to gather further statistics. If you notice any such web beacon, please notify us and we will strive to remove it from our websites.

Some third-party contents will also set cookies in your browser to store certain information on your usage of the tools and contents.

Occasionally, the third party might connect your information gathered on our websites to other information they have collected in order to build a profile on you.

7.1 Google Analytics

If you have given your consent, this website uses Google Analytics, a web analytics service provided by Google LLC. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). The legal basis for this data processing is your consent (Article 6 (1) a) GDPR).

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.

We use the User ID function. User ID allows us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and to analyze user behavior across devices.

We use Google Signals. This allows Google Analytics to collect additional information about users who have personalized ads enabled (interests and demographics) and ads can be delivered to these users in cross-device remarketing campaigns.

Google Analytics 4 has IP anonymization enabled by default. Due to IP anonymization, your IP-address will be shortened by Google within Member States of the EU or in other states party to the Agreement on the EEA. Only in exceptional cases will the full IP-address be transferred to a Google server in the USA and shortened there. According to Google, the IP-address transferred by your browser as part of Google Analytics will not be merged with other Google data.
During your website visit, your user behavior is recorded in the form of "events". Events can be:

- Page views
- First visit to the website
- Start of session
- Web pages visited
- Your "click path", interaction with the website
- Scrolls (whenever a user scrolls to the bottom of the page (90%))
- Clicks on external links
- Internal search queries
- Interaction with videos
- File downloads
- Seen Ads / clicked Ads

Also recorded:
- Your approximate location (region)
- Date and time of your visit
- Your IP-address (in shortened form)
- Technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
- Your internet service provider
- The referrer URL (via which website/advertising medium you came to this website)

On behalf of the operator Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics 4 serve to analyze the performance of our website.

Recipients of the data are/may be

- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor under Art. 28 DSGVO),
- Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
- Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

For the USA, the European Commission adopted a new adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider to establish an appropriate level of data protection in those countries.

The data sent by us and linked to cookies are automatically deleted after 12 months. The maximum lifespan of Google Analytics cookies is 2 years. The deletion of data whose retention period has been reached occurs automatically once a month.

You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP-address) by Google, and the processing of this data by Google, by

- not giving your consent to the setting of the cookie or
- downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout.

For more information about Google and how Google handles data, please refer to the following link:

- Term of use: https://marketingplatform.google.com/about/analytics/terms/us/
- Data protection: https://support.google.com/analytics/answer/6004245?hl=en
- Use of cookies: https://support.google.com/analytics/answer/11397207?hl=en
- Privacy policy: https://policies.google.com/privacy?hl=en

7.2 Matomo Web Analytics

We use Matomo, an open-source web analytics platform, to analyze and improve the performance of our website. Matomo is configured to operate without cookies, ensuring that no tracking cookies are stored on your device.

Data Processing and Legal Basis

Matomo collects anonymized data about website visits, such as:

    • Pages viewed and time spent on the site
    • Anonymized IP addresses (e.g., shortened IPs to prevent identification)
    • Device type, operating system, and browser version
    • Referring websites (if applicable)

This data is processed based on our legitimate interest (Article 6 (1) f) GDPR) in optimizing our website and ensuring a high-quality user experience. Since Matomo is configured without cookies and anonymizes IP addresses, no personally identifiable information is stored.
For further information on how Matomo processes data, please visit Matomo’s privacy policy (https://matomo.org/privacy-policy/).

8. Social Media

We operate social media pages for the purpose of self-marketing and promotion of our products.
We are present on Instagram, LinkedIn, Facebook and YouTube.

When you visit our sites, the platforms will collect data about your behavior and interests and might provide us with an anonymized analysis of our user groups and interactions. We have no influence over the creation and display of these analyses and cannot stop the collection or processing of your data for this matter.

We might receive the following data, separated into categories of users:
- Total number of visits,
- Interactions with our posts,
- Comments,
- Proportion of male and female visitors,
- Origin of the visit,
- Clicks on certain contents such as maps or contact information,
- Reach of our posts

If you directly interact with our content (such as “Liking” or “Reposting” it), we will be able to directly identify you. Should you wish to restrict this linking of your account and our social media page, please use the functionality offered on each platform to unfollow us.

We use these data and our presence on social media to present ourselves in a modern way to a large audience. The usage of this data, as well as the operation of the page is based on our legitimate interest for efficient, effective and interactive promotion acc. to Art. 6 (1) f) of GDPR.

Furthermore, the platforms might use your data for their own purposes for market research and advertisement. Cookies might be stored on your computer, which will analyze your usage behavior. Other information on your devices, internet connection and more can be collected and connected to your account. The platforms might create a profile on you, even if you are not logged in or have no account. These profiles can be used to show you targeted advertisement on different platforms.

In some cases, your data will be processed outside of the European Union. Specifically a data transfer to the US cannot be ruled out. For these cases, we have concluded Standard Contractual Clauses (SCCs) approved by the European Commission with the platform operators.

You have the right to enforce your rights regarding our social media pages and the Page-Insights at any time against us or the platform. However, we advise you that in any case, the platform will deal with the request. Should you have any questions, you may contact us via the contact details mentioned above.

Further information on the platforms:

(1) Instagram

Instagram are Social Media platforms, offered by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, with the parent company based in 1 Hacker Way, Menlo Park, California 94025, United States.

As part of our presence on Instagram, data is collected and processed by Meta. Meta provides insights and analytics regarding user interactions with our Instagram profile.

You can reference Instagram's privacy policy here:
https://privacycenter.instagram.com/policy

If you have an Instagram account, you may manage your privacy and advertising preferences here: https://www.instagram.com/accounts/privacy_and_security/

(2) LinkedIn

LinkedIn is a professional networking platform provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, with the parent company LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

You can reference their privacy policy here:
https://www.linkedin.com/legal/privacy-policy

To adjust your advertising preferences and turn off personalized ads, please follow the link below:
https://www.linkedin.com/psettings/advertising

(3) YouTube

YouTube is a video platform, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, with the parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

You can reference their privacy policy here:
https://policies.google.com/privacy

To change your setting for ads and turning of personalized ads, please follow the link below:
https://adssettings.google.com/authenticated

(4) Facebook

Facebook is a social media platform provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, with the parent company Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA.

You can reference their privacy policy here: 
https://www.facebook.com/privacy/policy/

To adjust your advertising preferences and manage personalized ads, please visit the following link:
https://www.facebook.com/adpreferences/ad_settings

9. Transfer of personal data to third countries

In order to fulfill the contract with the customer or to carry out the procedure according to the request of the customer prior to the conclusion of the contract, we may transfer personal data to a third country (including those countries where the adequate level of data protection have not been qualified). We shall use appropriate security and confidentiality measures in accordance with this Privacy Policy and laws when transferring customer’s personal data.

10. Retention periods of personal data

We will generally delete your personal data as soon as we no longer require it for the purposes for which we collected it. If any legal obligation stops us from deleting your information for a certain time, we will stop access to this information, store it securely and delete it after our legal obligation has ended.

11. Your rights

At any time you can exercise your rights by contacting us or our Data Protection contact directly. Please be aware that we might ask for some sort of verification of identity in order to safeguard other data subjects. These verification will be made as non-intrusive as possible.

You have the following rights:

(1) Right of access
(2) Right to rectification and erasure
(3) Right to restriction of processing
(4) Right to data portability
(5) Right to withdraw your consent

11.1 Right to lodge a complaint

At any time, you may lodge a complaint about our data processing activities with a supervisory authority.

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Website: https://www.baden-wuerttemberg.datenschutz.de

11.2 Right to object

You have the right to object to any processing we do on grounds of our legitimate interest, if your particular situation challenges our balance of interests.
Unless we can demonstrate legitimate grounds for processing which overrides your interests, rights, and freedoms, and if we do not need your personal data for the establishment, exercise of defense of legal claims, we will no longer process your personal data.

09/2026

.