This English translation is provided for convenience only. The German version is legally binding.
This privacy policy explains which personal data we process when you visit our website and when you contact us, for what purposes and on what legal basis this is done, and what rights you have. Personal data is any data by which you can be personally identified.
1. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Forster Stahl- und Anlagenbau GmbH
Am Forst 6
92637 Weiden
Germany
Telephone: +49 961 381 787 – 0
Email: aforster(at)forster-gmbh.de
Represented by the Managing Director Anton Forster. No data protection officer has been appointed, as the legal requirements for this are not met. If you have any questions about data protection, please contact us at the address above.
2. Hosting
Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, on servers in Germany. All data arising when you visit the website is processed on this server unless stated otherwise in this policy. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6(1)(f) GDPR).
3. Visiting the website and server log files
Each time a page is accessed, your browser automatically transmits data to our server, which is stored there in log files:
- IP address of the requesting device
- date and time of access
- page or file accessed and amount of data transferred
- notification of whether the request was successful
- website from which you reached our site (referrer)
- browser and operating system used
We need this data to deliver the website, to ensure its stability and security, and to detect and fend off attacks. It is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted automatically after 14 days.
Protection against attacks
To protect against attacks, we use a firewall on the server and the security plugin Wordfence. This involves evaluating the IP address, requested address, time and browser identifier of requests; suspicious requests are logged and the IP address concerned may be blocked temporarily. The evaluation takes place on our server. To detect attacks, Wordfence compares data with its manufacturer Defiant, Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA; in the process, IP addresses of suspicious requests may be transferred to the USA. The legal basis is our legitimate interest in the security of the website (Art. 6(1)(f) GDPR). Wordfence log entries are deleted after 30 days at the latest.
Encryption
Our website is transmitted exclusively in encrypted form via HTTPS (TLS). This means that data you send to us cannot be read by third parties.
4. Cookies and consent
Cookies are small text files that your browser stores on your device. We set technically necessary cookies on the basis of Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR; all others only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
We manage your consent with the cookie banner of the Complianz plugin, which runs on our server. Your choice is stored in cookies (cmplz_…) on your device so that the banner does not appear again on every visit; these cookies are technically necessary and are deleted after 365 days. You can change or withdraw your consent at any time with effect for the future using the “Manage consent” button at the bottom of the page. Details of the cookies used can be found in our Cookie Policy.
5. Visitor statistics
If you consent to the “Statistics” category in the cookie banner, we analyse the use of our website with the Burst Statistics plugin. The plugin runs on our own server; no data is transferred to the manufacturer or other third parties. We record pages viewed, time spent on them, the page you came from, browser, operating system, device type and approximate location (country and town), which is determined from the IP address. The IP address itself is not stored. To recognise returning visits, the plugin sets a cookie (burst_uid), which is deleted after 30 days.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, no analysis takes place. You can withdraw your consent at any time using “Manage consent” at the bottom of the page.
6. Fonts, images, videos and links to social networks
We deliver fonts, images and videos from our own server; no data is transferred to third parties such as Google or YouTube. We refer to our profiles on LinkedIn, Facebook, Instagram and YouTube with simple links only. Only when you click such a link are you forwarded to the respective provider, which then processes data under its own responsibility; its privacy notices apply.
7. Contacting us
If you contact us by email or telephone, we process your details (for example name, email address, telephone number and your request) in order to answer your enquiry. If your enquiry concerns a quotation or an order, the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The data is deleted once your enquiry has been dealt with conclusively, unless statutory retention obligations (for example six or eight years for business correspondence under commercial and tax law) prevent this.
Please note that emails are generally not encrypted in transit. If possible, please send us confidential documents by other means.
8. Applications
We accept applications by email. The controller in each case is the company of the Forster Group that advertises the position and whose contact address is given in the job advert. We process your details and documents (for example contact details, CV, references) solely to decide on your application. Only the persons involved in the selection process have access. The legal basis is Art. 6(1)(b) GDPR (initiation of an employment relationship); where you voluntarily provide special categories of data, for example on a severe disability, additionally Art. 9(2)(b) GDPR.
If you are hired, your documents are transferred to your personnel file. Otherwise, we delete them six months after the application process has ended so that we can defend ourselves against any claims under the German General Equal Treatment Act (AGG). Longer storage, for example for future vacancies, only takes place with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
9. Recipients and storage period
We only pass on your data as described in this policy or where we are legally obliged to do so. We store personal data only for as long as is necessary for the respective purpose or required by statutory retention periods; the specific periods are given in the individual sections. No automated decision-making, including profiling, takes place.
10. Your rights
You have the following rights with regard to your personal data:
- access (Art. 15 GDPR)
- rectification (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdrawal of consent with effect for the future (Art. 7(3) GDPR)
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
To exercise your rights, an informal message to the address given in section 1 is sufficient.
Last updated: 17 October 2026
