PRIVACY POLICY

INTRODUCTION

In the following data protection policy declaration, we will inform you about the types of personal data that we collect (hereinafter referred to as “data”) the purposes for which we collect it and the extent of data collection. The data protection declaration applies to all processing of personal data carried out by us, both in the context of the provision of services and in particular through our websites, mobile phone applications and also external online presences, for example our social media profiles (collectively referred to as “Online Offer”).

The terms used are not gender specific.

As of November 20, 2019

Overview of data processing operations

The following overview summarises the types of data that will be processed and the purposes for which they will be processed and refers to the subjects of personal data collection.

Types of data processed

Inventory data (e.g. names, addresses).
Content data (e.g. text input, photographs, videos).
Contact details (e.g. e-mail, telephone numbers).
Meta/communication data (e.g. device information, IP addresses).
Usage data (e.g. websites visited, interest in content, access times).
Social data (data subject to the Social Confidentiality Code (§ 35 SGB I, Germany) and processed, for example, by social security institutions, social welfare institutions or pension authorities).
Geographical location data (data that indicates the location of an end-user’s terminal).
Contract data (e.g. subject matter of the contract, term, customer categories).
Payment data (e.g. bank details, invoices, payment history).

Categories of affected persons (data subjects)

Employees (e.g. employees, applicants, former employees).
Business and contractual partners.
Interested parties.
Communication partners.
Users (e.g. website visitors, users of online services).

Purposes of processing

Affiliate tracking.
Provision of our online services and to assess user-friendliness.
Evaluation of online traffic.
Administration and organizational procedures.
Cross-device tracking (cross-device processing of user data for marketing purposes).
Direct marketing (e.g. by e-mail or post).
Feedback (e.g. collecting feedback via online form).
Interest and behavioural marketing.
Contact requests and communication.
Evaluation of the conversion rate (measurement of the effectiveness of marketing measures).
Preparation of user profiles.
Range measurement (e.g. access statistics, detection of returning visitors).
Tracking (e.g. interest/behavioural profiling, use of cookies).
Contractual services and services.
To manage and respond to requests.
Target grouping (identification of target groups relevant for marketing purposes or other content output).

Relevant legal bases

Here we will describe the legal bases of the General Data Protection Regulation (GDPR), which regulates how we process personal data. Please note that in addition to the provisions contained in the GDPR, additional national data protection requirements may apply in your, or our, country of residence.

Consentimiento: el interesado ha dado su consentimiento para el tratamiento de los datos personales que le conciernen para un fin específico o varios fines específicos.
Ejecución del contrato y consultas precontractuales: el tratamiento es necesario para la ejecución de un contrato del cual forma parte el interesado o para la implementación de medidas precontractuales, que pueden llevarse a cabo bajo solicitud del interesado.
Obligación legal: el tratamiento es necesario para el cumplimiento de una obligación legal a la que está sujeto el responsable.
Intereses elegibles:el tratamiento es necesario para salvaguardar los intereses legítimos del responsable o de un tercero, a menos que prevalezcan los intereses o los derechos y las libertades fundamentales del interesado, los cuales requieran la protección de datos personales.

SECURITY

We will take the appropriate technical and organisational measures to ensure a level of protection commensurate with the risk, taking into account the cost of implementation and the nature of the task, the scope and the circumstances of the data processing, as well as the probability of the occurrence of a breach and the extent of the threat to the rights and freedoms of individual persons.

Measures include specifically ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the said data, as well as controlling access, entry, disclosure, securing availability and classification. In addition, we have established procedures that guarantee the exercise of data subjects’ rights, the right to erase data and responses to any data risk. Furthermore, we have already taken into account the protection of personal data when developing and selecting hardware, software and implementing procedures in accordance with the principle of data protection, through technical design features and with data protection-friendly pre-sets.

IP address adjustment: If we can or if the IP address is not required, we may shorten your IP address. In the case of an adjustment to the IP address, also known as “IP masking”, the last octet, i.e. the last two numbers of an IP address, is deleted (the IP address in this context is the identifier individually assigned to an Internet connection by the online access provider). The adjustment to the IP address is intended to prevent identification or make it much more difficult to identify a person by their IP address.

SSL encryption (https): In order to protect your data transmitted via our online offer, we use SSL encryption. You can detect encrypted connections by the prefix https:// in the address bar of your browser.

Transfer and disclosure of personal data

In the context of our processing of personal data, the data may be transferred to other parties, companies, legally independent organizational units or persons or be disclosed to them. Recipients of this data may include, for example, financial institutions in the context of payment transactions, service providers entrusted with IT tasks or providers of services and content that are integrated into a website. In such case, we will comply with the legal requirements and in particular arrange corresponding contracts or agreements with the recipients of your data, which will ensure adequate protection of your data.

As part of the order processing service, we transmit the necessary data for the dispatch of the goods to our fulfilment service provider in Germany and also to the shipping service provider commissioned by this company (DHL).

Use of cookies

Cookies are text files that are stored by a browser on the user’s computer and contain data from websites or domains visited. A cookie is primarily used to store the information about a user during or after his visit to a website. The stored information may include, for example, the language settings on a website, the login status, a shopping cart or the location where a video was viewed. The term cookies also includes other technologies that perform the same functions as cookies (e.g. when user information is stored as pseudonymous online identifiers, also known as “user IDs”).

The following types of cookies and functions are distinguished:

Temporary cookies (also referred to as session cookies): Temporary cookies are deleted at the latest after a user has left a web page and closed his browser.
Permanent cookies: Permanent cookies remain stored even after closing the browser. For example, the login status can be saved, or preferred content can be displayed directly when the user returns to that website. These cookies may also store user interests for measuring reach or marketing purposes.
First-party cookies: First-party cookies are set by us.
Third-party cookies: Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
Necessary cookies (also: essential or absolutely necessary): Cookies may be essential for the operation of a website (e.g. to store log-in details or other user entries or for security purposes).
Statistical, marketing and personalisation cookies: Cookies are also used in the context of reach measurement and when the interests of a user or their behaviour (e.g. viewing specific content, benefits of functions, etc.) are stored on individual websites as a user profile. These profiles are used in order to display, for example, content that corresponds to the potential interests of a particular user. This method is also referred to as “tracking”, i.e. tracking the potential interests of users. Whenever we use cookies or “tracking” technologies, we will inform you separately in our privacy policy or by requesting consent.

Notes on legal bases:

The legal basis on which we process your personal data with the help of cookies depends on whether we ask you for your consent. If this is the case and you have given consent to the use of cookies, the legal basis for processing your data is that of declared consent. Otherwise, the data received by cookies will be processed on the basis of our legitimate interests (e.g. for business operational purposes regarding our online offer and for its improvement) or, if the use of cookies is essential, in order to fulfil our contractual obligations.

General notices on revocation and opposition (opt-out):

Depending on whether the processing is based on consent or legal permission, you have the option at any time to revoke your consent or to object to the processing of your data (collectively referred to as ‘opt-out’) through the use of cookie technologies. You can declare and effect your objection by adjusting your browser settings, e.g. by disabling the use of cookies (which may result in the functionality of our online offer being limited). An objection to the use of cookies for online marketing purposes can also be expressed by using a variety of services, especially in the case of tracking, with the websites http://optout.aboutads.info and http://www.youronlinechoices.com/. In addition, you may receive further opportunities for objection within the scope of the information on the service providers and cookies used.

Processing of cookie data based on consent:

Before we process or have data processed within the context of cookie use, we ask users for consent which may be revoked at any time. Until consent has been given, only cookies that are necessary for the operation of our online offer will be used. Their use is based on our legitimate business interest and the interest of the users in order to achieve the expected functionality of our online offer.

Types of data processed: usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjects: users (e.g. website visitors, users of online services).
Legal bases: consent (Art. 6, sec. 1, p. 1, letter a. GDPR, Germany), legitimate interests (Art. 6, sec.1, p. 1, letter f. GDPR, Germany).

Commercial and business services

We process data pertaining to our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractors”) within the framework of contractual and comparable legal relationships as well as other related measures and for the purpose of facilitating communication with the contractual partners (or pre-contractual), e.g. in order to answer enquiries.

We process this data in order to fulfil our contractual obligations, to protect our rights and for the purposes of the administrative tasks associated with this information as well as that of the business organization. Within the scope of the applicable law, we only transfer data belonging to contractual partners to third parties to the extent that is necessary for the aforementioned purposes or to fulfil legal obligations or when it is carried out with the consent of the contractual partners (e.g. to telecommunications, transport and other auxiliary service providers as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). The contractual partners will be informed about any other forms of processing, e.g. for marketing purposes, within the framework of this data protection declaration.

We will inform the contracting parties before or within the scope of the data collection, e.g. in online forms, by means of special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We will delete the data when the period of legal warranty and comparable obligations expires, i.e. usually after 4 years, unless the data is stored in a customer account, e.g. as long as it has to be stored for legal reasons (e.g. for tax purposes this is usually 10 years). Data disclosed to us in the context of an order by the contractual partner, we delete in accordance with the specifications of the order, in principle after the order has been fulfilled.

Whenever we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply to the relationship between the users and the providers.

Customer account:

Contractors can create an account on our website (e.g. customer or user account, usually “customer account”). If registration of a customer account is required, contractual partners will be informed, and the information required for registration will be specified. Customer accounts are not public and cannot be indexed by search engines. As part of the registration as with any subsequent registrations and uses of the customer account, we store customer IP addresses together with access times in order to confirm the registration and to prevent any misuse of the customer account.

When a customer terminates their client account, the data relating to that account will be deleted, unless retention is required for legal reasons. It is the responsibility of the customers to secure their data in the event of termination of the customer account.

Shop and e-commerce:

We process client data in order to enable them to select, purchase and order their chosen products, goods and/or related services, as well as payment and delivery, or execution.

Required information is marked as such in the context of the order or comparable acquisition process and includes the information required for delivery, provision and payment as well as contact information in order to facilitate any enquiry or consultation.

Functions and Events:

We process the data of participants at functions, events and similar activities offered by or hosted by us (hereinafter referred to uniformly as “Participants” and “Events”) in order to enable them to participate in the events and to use the services or promotions associated with that participation.

If we process health-related data, religious, political or other special categories of data in this context, this is done within the scope of the necessary (e.g. at thematically oriented events or for purposes of health care, safety or with the consent of the persons concerned).

The required information is marked as such in the finalisation of the order or comparable contract and includes the information required for the provision of services and billing as well as contact information in order to facilitate enquiries or consultations. All the information we receive from end customers, employees or other persons is processed in accordance with the pertinent legal and contractual requirements.

Types of data processed: inventory data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact data (e.g. e-mail, telephone numbers), contract data (e.g. contract subject matter, term, customer category), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjects: interested parties, business and contractual partners, customers.
Purposes of processing: contractual services and services, contact requests and communications, administrative and organizational procedures, management of enquiries and responses, security measures.
Legal bases: Performance of the contract and pre-contractual enquiries (Art. 6, sec.1, p. 1, letter b. GDPR, Germany), legal obligation (Art. 6, sec.1, p.1, letter c. GDPR, Germany), Legitimate interests (Art. 6 sec. 1 s. 1 paragraph. f. GDPR).

Payment service provider

Within the context of contractual and other legally binding relationships, in accordance with legal obligations or otherwise on the basis of our legitimate interests, we offer efficient and secure payment options to clients and, in addition to banks and credit institutions, may use other payment service providers (collectively, “payment service providers”).

The data processed by the payment service providers includes inventory data, such as names and addresses, bank details including account numbers or credit card numbers, passwords, transaction numbers and checksums, as well as contract, total and recipient-related information. The information is necessary in order to execute the transactions. However, the data entered will only be processed and stored by the payment service providers. This means that we do not receive any account or credit card-related information, only information with confirmation of the payment or failure to complete the transaction. This data may be transmitted by the payment service providers to business and credit information agencies. The purpose of this transmission is to verify identity and creditworthiness. In this instance, we refer to the terms and conditions and data protection notices regarding payment service providers.

The terms and conditions and legal data protection notices of the respective payment service providers apply to the payment transactions and are available on the respective websites or transaction applications. We also refer to these for further information and the assertion of rights of revocation, information and other data subjects of affected persons.

Types of data processed:inventory data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contract data (e.g. contract subject matter, term, customer type), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjects:customers, interested parties.
Purposes of processing:Contractual services, contact requests and communications, affiliate tracking.
Legal bases:Performance of the contract and pre-contractual enquiries (Art. 6, sec.1, p. 1, letter b. GDPR, Germany), legitimate interests (Art. 6, sec. 1, p. 1, letter f. GDPR, Germany).

Services and service providers used:

American Express: payment services; service provider: American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany; Website: https://www.americanexpress.com/uk; Privacy Policy: https://www.americanexpress.com/uk/legal/online-privacy-statement.html .
Mastercard: payment services; service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; Website: https://www.mastercard.ik/en-gb.html; Privacy Policy: https://www.mastercard.co.uk/en-gb/about-mastercard/what-we-do/privacy.html .
PayPal: payment services and solutions (e.g. PayPal, PayPal Plus, Braintree); service provider: PayPal (Europe) S.A. r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Website: https://www.paypal.com/uk; Privacy Policy: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full .
Visa: payment services; service provider: Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, UK; Website: https://www.visa.co.uk/; Privacy policy: https://www.visa.co.uk/legal/privacy-policy.html

Registration process and login

Users can create a user account. As part of the registration process, users are asked to provide the necessary information, and this is processed for the purpose of creating and managing the user account on the basis of contractual obligations. he data processed necessarily includes the login information (name, password and an e-mail address). The data entered during registration will be used for the purpose of using the user account and its management.

Users may be informed by e-mail about processes that are relevant to their user account, for example, when technical changes occur. If users have terminated their user account, the data relative to the user account will be deleted unless it is subject to a legal retention obligation. It is the responsibility of users to secure their data before the end of the contract if they are terminating the account. We are entitled to permanently delete all data belonging to the user that we have stored during the term of the contract.

We store the IP address and the time of the action executed by the user as part of the registration and login process as well as the use of the user account. This data is stored on the basis of our legitimate interests as well as that of the users in order to protect against misuse and other unauthorized use. In principle, this data will not be passed on to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so.

- Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text input, photographs, videos), meta/communication data (e.g. device information, IP addresses).
- Data subjects: users (e.g. website visitors, users of online services).
- Purposes of processing: Contractual services and other services, security measures, management and response to enquiries.
- Legal basis: Consent (Art. 6, sec. 1, p. 1, letter a. GDPR, Germany), fulfilment of the contract and pre-contractual enquiries (Art. 6, sec. 1, p. 1, letter b. GDPR, Germany), legitimate interests (Art. 6, sec. 1, s. 1, letter f. GDPR, Germany).

Contact

When contacting us (e.g. via contact form, e-mail, telephone or via social media), the information of the person effecting the enquiry will be processed, insofar as this is necessary to answer the enquiry and carry out any necessary measures requested.

The purpose of the processing of data related to enquiries within the context of contractual or pre-contractual relationships is to fulfil our contractual obligations or to answer (pre)contractual enquiries and, in addition, on the basis of the legitimate interests in order to respond to the enquiries.

Types of data processed: inventory data (e.g. names, addresses), contact details (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos).
Data subjects: communication partners.
Purposes of processing: contact requests and communication.
Legal bases: Performance of the contract and pre-contractual enquiries (Art. 6, sec. 1, p. 1, letter b. GDPR, Germany), legitimate interests (Art. 6, sec. 1, p. 1, letter f. GDPR, Germany).

Provision of the online offer and web hosting

In order to be able to provide our online offer securely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online offer can be accessed. For our services to function we may use their infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance services.

The data processed in the context of the provision of the hosting service may include all information concerning the users of our online offer that occurs within the context of use and communication. This regularly includes the IP address necessary to deliver the contents of online offers to browsers and all entries made within our online offer or from websites.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data from every entry to the server (so-called server log files). The server log files may include the address and name of the retrieved websites and files, the date and time of the retrieval, the amount of data transferred, the notification of successful retrieval, the browser type and version, the user’s operating system, referral URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the case of cyber-attacks, so-called Denial-of-Service attacks) and, on the other hand, to ensure the correct utilization of the servers and their stability.

Types of data processed: content data (e.g. text input, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjects: users (e.g. website visitors, users of online services).
Legal bases: Legitimate interests (Art. 6, sec. 1, p. 1, letter f. GDPR, Germany).

Newsletter and other communications

We only send newsletters, e-mails and other electronic notifications (hereinafter “Newsletter”) with the consent of the recipients or legal permission. If the content of the newsletter is specifically described in the context of registration, it is classed as consent from the users. In general, our newsletters contain information about us and our services.

In order to subscribe to our newsletters, it is sufficient that you provide your e-mail address. However, we may ask you to provide a name in order to address you personally or other information if required for the purposes of the newsletter.

Double opt-in procedure: Subscription to receive our newsletter is basically done in a double opt-in procedure. This means that you will receive an e-mail after registration asking you to confirm your registration. This confirmation is necessary so that no one can log in with a different e-mail address. Subscriptions to the newsletter are logged in order to be able to confirm the registration process in accordance with legal requirements. This includes storing the login and confirmation time as well as the IP address. Any changes to your data stored by the newsletter service provider will also be logged.

Deletion and restriction of processing: We may store e-mail addresses that have been processed for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defence against a future claim. An individual request for cancellation is possible at any time, provided that the existence of prior consent is confirmed at the same time. In the case of obligations to attend objections permanently, we reserve the right to store the e-mail address in a block list (so-called “blacklist”) for this purpose alone.

The registration procedure is logged on the basis of our legitimate interests for the purpose of proving proper conduct. As we commission a service provider to send e-mails, this is based on our legitimate interests to ensure an efficient and secure mailing system.

Information about legal bases: The sending of newsletters is based on the consent of the recipients or, if consent is not required, on the basis of our legitimate interests in direct marketing, to the extent that this is permitted by law, e.g. in the case of existing customer advertising. As we commission a service provider to send e-mails, this is done on the basis of our legitimate interests. The registration process is recorded on the basis of our legitimate interests in order to prove that it was conducted in accordance with the law.

Content: Information about us, our services, promotions and offers.

Success measurement: The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server when opening the newsletter from our server or, if we use a newsletter service provider, from its server. As part of this retrieval, technical information such as information about the browser and your operating system, as well as your IP address and the time of retrieval, are collected first.

This information is used to improve the technical aspects of our newsletter on the basis of the technical data or the target groups and their reading behaviour based on analysis of their polling locations (determined by means of the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. However, it is neither our intention nor, if used, that of the newsletter service provider to observe individual users. Rather, the evaluations serve the purpose of allowing us to recognize the reading habits of our users and to adapt our content or to send different content according to the interests of our users.

The evaluation of the newsletter and the measurement of its success are carried out, subject to express consent from the users, on the basis of our legitimate interests for the purposes of maintaining a user-friendly and secure newsletter system, which serves both our business interests and meets the expectations of the users.

A separate revocation applying solely to the success measurement is unfortunately not possible, and in this case the entire newsletter subscription must be cancelled or must be contradicted.

Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), meta/communication data (e.g. device information, IP addresses), usage data (e.g. websites visited, interest in content, access times).
Data subjects: communication partners.
Purposes of processing: Direct marketing (e.g. by e-mail or by post).
Legal bases: Consent (Art. 6, sec. 1, p. 1, letter a. GDPR, Germany), legitimate interests (Art. 6, sec. 1, p. 1, letter f. GDPR, Germany).
Objection (opt-out): You can cancel your subscription to our newsletter at any time, i.e. revoke your consent or object to receiving further newsletter communication. You can either find a link to unsubscribe from the newsletter at the end of each newsletter or otherwise use one of the above-mentioned contact options, preferably e-mail.

Online marketing

We process personal data for online marketing purposes, which may include the marketing of advertising space or the presentation of advertisements and other content (collectively, “content”) based on the potential interests of users and measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (“cookie”) or using similar methods whereby information relevant to the presentation of the aforementioned content for the user is stored. This information may include, for example, content viewed, websites visited, online networks used, but may also include communication partners and technical information, such as the browser used, operating system used and information on usage times. If users have consented to the collection of their location data, this can also be processed.

The IP addresses of users are also stored. However, we use available IP masking methods (i.e., pseudonymisation by shortening the IP address) to protect our users. As a general rule, the online marketing process does not store clear user data (such as e-mail addresses or names), but pseudonyms. This means that we, together with the providers of our online marketing procedures, do not know the actual identity of the users, only the information stored in their profiles.

The information in the profiles is usually stored in cookies or using similar procedures. These cookies can generally also be used on other websites that use the same online marketing method, read and analysed for the purposes of displaying content as well as supplemented with further data and stored on the server of the online marketing process provider.

xceptionally, additional real data can be assigned to the profiles. This is the case, for example, if the users are members of a social network whose online marketing procedures we use, and the network connects the profiles of the users to the aforementioned information. We kindly ask you to note that users can make additional agreements with the providers, e.g. by consent in the context of registration.

In principle, we only have access to summarised information about the success of our advertisements. However, in the context of conversion analysis, we can check which of our online marketing procedures have led to a successful conversion, i.e., to a user engaging in a contract with us. Conversion measurement is used solely to analyse the success of our marketing efforts.

Unless otherwise stated, we ask you to assume that any cookies used will be stored for a period of two years.

Information on legal bases: If we ask the users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, user data will be processed on the basis of our legitimate interests (i.e. interest in efficient, economical and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Audience analysis with Google Analytics: We use Google Analytics to choose the ads displayed on Google and its partners’ advertising services and only those users who have shown an interest in our online offering or display certain characteristics (e.g. interests in particular topics or products determined by the websites they have visited) that we transmit to Google ( “Remarketing”, or “Google Audience Analytics”). With the help of remarketing audiences, we also aim to ensure that our ads coincide with potential interest from users.

Facebook pixels: With the help of the Facebook pixel, Facebook is able to recognise the visitors to our online offer as a target group for displaying advertisements (so-called “Facebook ads”). Accordingly, we use the Facebook pixel to display the Facebook ads we wish to use to those users on Facebook and within the services of the partners that cooperate with Facebook (so-called “Audience Network” https://www.facebook.com/audiencenetwork/) https://es-la.facebook.com/audiencenetwork/who have also shown an interest in our online offering or who display certain characteristics (e.g. interest in certain topics or products that are apparent from the websites they have visited) that we then transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads meet the potential interest of users and are not intrusive or repetitive. With the help of the Facebook pixel, we can also understand the effectiveness of Facebook ads for statistical and market research purposes by seeing if users have been redirected to our website after clicking on a Facebook ad (so-called “conversion measurement”).

Types of data processed: usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), location data (data indicating the location of an end-user’s terminal), social data (data that is subject to the social Confidentiality Code (Section 35 SGB I, Germany) and are processed e.g. by social security institutions, social welfare institutions or pension authorities.

Data subjects: users (e.g. website visitors, users of online services), interested parties, customers, employees (e.g. employees, applicants, former employees), communication partners.
Purposes of processing: Tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, evaluation of visiting actions, interest-based and behavioural marketing, profiling (creating user profiles), conversion measurement (measurement of the effectiveness of marketing measures), reach measurement (e.g. access statistics, detection of return visitors), targeting (identification of target groups relevant for marketing purposes or other output of content), cross-device tracking.
Security measures: IP masking (pseudonymisation of the IP address).
Legal bases: Consent (Art. 6, sec. 1, p. 1, letter a. GDPR, Germany), legitimate interests (Art. 6, sec. 1, p. 1, letter f. GDPR, Germany).
Objection (opt-out): We refer to the data protection policies of the respective providers and the option of objection indicated to the providers (“opt-out”). Unless an explicit opt-out option has been given you may switch off cookies in your browser settings. However, this may limit the functionality of our online services. We therefore also recommend the following opt-out options, which are offered specifically in certain areas: a) Europe: https://www.youronlinechoices.eu, (b) Canada: https://www.youradchoices.ca/choices, (c) USA: https://www.aboutads.info/choices, (d) Cross-territorial: http://optout.aboutads.info.

Services and service providers used:

Google Tag Manager: Google Tag Manager is a tool that allows us to manage website tags using a single interface (including Google Analytics and other Google marketing services within our online offering). The Tag Manager itself (which implements the tags) does not process any personal data belonging to users. With regard to the processing of users’ personal data, reference is made to the following information on Google services. Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com/about/; Privacy Policy: https://policies.google.com/privacy; Privacy Shield (Privacy Level for Processing Data in the U.S.): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
Google Analytics: Online marketing and web analytics; Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy Policy: https://policies.google.com/privacy; Privacy Shield (Privacy Level for Processing Data in the U.S.): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; Opt-out: Opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=gb, settings for displaying advertisements: https://adssettings.google.com/authenticated.
Google Ads and Conversion Measurement: We use the online marketing tool “Google Ads” to place ads on the Google advertising network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who may potentially have an interest in the ads. We also measure the conversion rate of the ads. However, we only receive data regarding the total number of anonymous users who clicked on our ad and were redirected to a page with a “conversion tracking tag”. However, we do not receive any information that can be used to identify particular users. Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Privacy Shield (Privacy Level for Processing Data in the U.S.): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
Facebook-Pixel: Facebook pixels; Service providers: https://www.facebook.comhttps://www.facebook.com, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; Website: https://www.facebook.com; Privacy Policy https://www.facebook.com/about/privacy; Privacy Shield (Privacy Level for Processing Data in the U.S.): https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active ; Opt-out: https://www.facebook.com/settings?tab=ads.

SOCIAL MEDIA PRESENCE

We maintain an online presence on social media in order to communicate with active users there or to offer information about our products and services.

We would like to point out that users’ data may be processed outside the European Union. This may generate risks for users as it could, for example, make it more difficult to enforce users’ rights. With regard to U.S. providers that are certified under the Privacy Shield or offer guarantees of a secure level of privacy, we would like to point out that they are committed to complying with EU data protection standards.

Furthermore, users’ data from social media networks are habitually processed for market research and advertising purposes. For example, user profiles can be created based on user behaviour and the resulting interests of those users. The user profiles can in turn be used to display advertisements inside and outside the networks, for example, which presumably correspond with the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the user’s usage behaviour and the interests of the users are stored. Additionally, data may also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective processing methods and the opt-out, we refer to the data protection declarations and information from the operators of the respective networks.

In the case of requests for information and the exercise of data subjects’ rights we would also like to point out that these can be asserted most effectively by the providers. Only the providers have access to users’ data and are able to take direct action and provide information. If you still need help, you can contact us.

Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjects: users (e.g. website visitors, online service users).
Purposes of processing: contact enquiries and communication, tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, range measurement (e.g. access statistics, detection of returning visitors).
Legal bases: Legitimate interests (Art. 6, sec. 1, p. 1, letter f. GDPR, Germany).

Services and service providers used:

Instagram: Social media; Service provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com; Privacy Policy: http://instagram.com/about/legal/privacy.
Facebook: Social media; Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; Website: https://www.facebook.com; Privacy Policy https://www.facebook.com/about/privacy; Privacy Shield (Privacy Level for Processing Data in the U.S.): https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active ; Opt-out: Ad settings https://www.facebook.com/settings?tab=ads; Additional information on data protection: Agreement on the joint processing of personal data on Facebook pages: https://www.facebook.com/legal/terms/page_controller_addendum, Privacy notices for Facebook pages: https://es-la.facebook.com/legal/terms/information_about_page_insights_data.
LinkedIn: Social media; Service providers: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Privacy Shield (Privacy Level for Processing Data in the U.S.): https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

PLUGINS, EMBEDDED FUNCTIONS AND CONTENT

We incorporate functional and content elements from the servers of respective providers (hereinafter referred to as “Third Party Providers”) in our online offering. These may include graphics, videos, social media buttons, and posts (hereinafter referred to collectively as “content”).

The incorporation presupposes that the third parties of this content process the IP address of users, since they could not send content to their browser without an IP address. The IP address is therefore required for the presentation of this content or any functions. We make every effort to only use content from the respective providers who only use the IP address for the delivery of content. Third parties may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on pages of a website. This pseudonymous information can also be stored in cookies on the user’s device and may include, amongst other things, technical information about the browser and operating system, websites referenced, the time of the visit as well as other information regarding the use of our online offer, as well as this being linked to information from other sources.

Types of data processed: usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos).
Data subjects: users (e.g. website visitors, users of online services).
Purposes of processing: provision of our online offer and user-friendliness, contractual services and service, tracking (e.g. interest/behavioural profiling, use of cookies), feedback (e.g. collecting feedback via online form).
Legal bases: Legitimate interests (Art. 6, sec. 1, p. 1, letter f. GDPR, Germany), consent (Art. 6, sec. 1, p. 1, letter a. GDPR, Germany).

SERVICES AND SERVICE PROVIDERS USED:

Google Fonts: We incorporate fonts from Google, whereby users’ data is used solely for the purpose of displaying the fonts in the browsers of the users. This incorporation is based on our legitimate interests in a technically safe, maintenance-free and efficient use of fonts, their uniform presentation and taking into account any possible licensing restrictions for their incorporation. Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy; Privacy Shield (Privacy Level for Processing Data in the U.S.): https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&status=Active.
Shariff: We use the privacy-proof “Shariff” buttons “Shariff” is designed to provide greater privacy on the web and to replace the usual “share” buttons on social media. It is not the user’s browser, but the server on which this online offer is located, that connects to the server of the respective social media platforms and, for example, queries the number of likes. The user remains anonymous. More information about the Shariff project is available from the developers of the magazine c’t: https://www.heise.de/ct/artikel/Shariff-Social-Media-Buttons-mit-Datenschutz-2467514.html; Service provider: Heise Medien GmbH & Co. KG, Karl-Wiechert-Allee 10, 30625 Hannover, Germany; Website: https://www.heise.de/ct/artikel/Shariff-Social-Media-Buttons-mit-Datenschutz-2467514.html; Privacy Policy: https://www.heise.de/Datenschutzerklaerung-der-Heise-Medien-GmbH-Co-KG-4860.html.

Modification and updating of the Privacy Policy

We kindly ask you to regularly review the content of our privacy policy. We will adjust the Privacy Policy whenever changes to the data processing we perform make this necessary. We will inform you as soon as the changes require any form of participation on your part (e.g. consent) or any other individual notification.

Rights of data subjects

As a data subject, you have certain rights under the GDPR, which arise in particular from Articles 15 to 18 and 21 of the German GDPR legislation:

Right to object: For reasons arising from your particular situation, you have the right to object at any time to the processing of your personal data, which is subject to Article 6, sec. 1, letter e. of the German GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such advertising purposes; this also applies to profiling in so far as it is related to direct marketing.
Right to withdraw consent: You have the right to revoke given consents at any time.
Right to access: You have the right to request confirmation as to whether your data is being processed and to obtain information about this data as well as to access any further information and request a copy of the data in accordance with current legislation.
Right to rectification: You have the right to request the completion of your data or the correction of any inaccurate data concerning you in accordance with current legislation.
Right to deletion and restriction of processing: You have the right to request that data concerning you is deleted immediately or alternatively to demand a restriction of the processing of your data in accordance with current legislation.
Right to data portability: You have the right to request a copy of the data concerning you in a structured, simple and machine-readable format in accordance with current legislation or to request portability to another data controller.
Right of complaint to a supervisory authority: You also have the right, in accordance with current legislation, to contact a supervisory authority, in the Member State of your habitual residence, workplace or the place where an alleged infringement has taken place, if you believe that the processing of personal data concerning you is in breach of the GDPR.

Created with free Datenschutz-Generator.de by Dr. Thomas Schwenke