We thank you very much for your interest in our company. Data protection is of particularly high importance to the management of Kiesewetter KG. The use of the websites of Kiesewetter KG is basically possible without giving any personal data. As soon as a person concerned wants to make use of special services of our company, processing of personal data could be necessary. When processing of personal data will be necessary and if there is no legal basis for such processing, we will generally ask the person concerned for a consent. The processing of personal data, for example name, address, e-mail address or phone number of a person concerned, will always be made in line with the data protection basic regulations and in accordance with the country-specific data protection regulations valid for Kiesewetter KG. With this privacy statement our company wants to inform the public about kind, extent and purpose of the personal data, collected, used and processed from us. Furthermore, persons concerned are informed about their legal rights by this privacy statement. Kiesewetter KG, as person responsible for the processing (hereafter controller), has implemented numerous technical and organizational measures, to ensure an as completely as possible protection of the personal data, processed through this website. Nevertheless internet-based data transmissions can generally have security holes, so that an absolute protection cannot be guaranteed. Therefore each person concerned is free to submit us personal data on alternative ways, such as by phone.
The privacy statement of Kiesewetter KG is based on the terminology, used from the European regulators of the data protection guidelines with the edict of the General Data Protection Regulation (GDPR). Our privacy statement shall be simple to be read and understood as well for the public as for our customers and business partners. To ensure this, we first want to explain the used terminology. In this privacy statement we use, amongst others, following definitions:
a, personal data
‘personal data’ means any information relating to an identified or identifiable natural person (hereafter ‘person concerned’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by attribution to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
b, person concerned
‘person concerned’ is each identified or identifiable natural person, who’s personal data is processed by the controller.
‘processing’means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, matching or linking, restriction, erasure or obliteration.
d, restriction of processing
‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future.
‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or change of location.
‘pseudonymisation’ means the processing of personal data in such a manner, that the personal data can no longer be attributed to a specific person concerned without the use of additional information, provided, that such additional information is kept separately and is subject to technical and organizational measures to ensure, that the personal data is not attributed to an identified or identifiable natural person.
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data is disclosed, whether it is a third party or not. However, public authorities, which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State, law shall not be regarded as recipients.
j, third party
‘third party’ means a natural or legal person, public authority, agency or body other than the person concerned, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
‘consent’ of the person concerned means any freely given, specific, informed and unambiguous indication of the wishes of the person concerned, by which he or she, by a statement or by a clear confirming action, signifies agreement to the processing of personal data relating to him or her.
2. Name and address of the controller
Person responsible in the sense of the General Data Protection Regulation, other data protection laws, valid in the member states of the European Union, and other regulations with data protection character is:
3. Name and address of the controller’s data protection officer is:
Attn. Sebastian Scholz
Each person concerned can address directly to our data protection officer with all questions and suggestions concerning data protection at any time.
Numerous websites and servers are using cookies. Many cookies contain a so-called cookie-ID. A cookie-ID is a unique identification of the cookie. It consists of a string, by which websites and servers can be allocated to the correct web browser, in which the cookie is stored. This enables visited websites and servers to distinguish the browser of the person concerned from other internet browsers that contain other cookies. A particular web browser can be recognized and identified by the unique cookie ID.
By using cookies, Kiesewetter KG can provide users of this website with more user-friendly services that would not be possible without the setting of cookies.
The person concerned can prevent the setting of cookies through our website at any time by means of a corresponding setting of the internet browser used, and can thus permanently contradict the setting of cookies. Furthermore, already set cookies can be deleted at any time by an internet browser or other software programs. This is possible in all common internet browsers. If the person concerned deactivates the setting of cookies in the internet browser used, not all functions of our website may be fully usable.
5. Recording of general data and information
The website of Kiesewetter KG collects a series of general data and information with each visit to the website by a person concerned or an automated system. This general data and information is stored in the log files of the server. Such stored data and information can be: (1) The browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system accesses our website (so-called referrers), (4) the sub-web pages which are accessed via an accessing system on our website, (5) the date and time of access to the website, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information, which are used in the case of attacks on our information technology systems.
When using this general data and information Kiesewetter KG does not draw conclusions about the person concerned. Rather this information is required, to (1) correctly deliver the contents of our website, (2) to optimize the contents of our website as well as the advertising for it, (3) to ensure the continuous functioning of our information technology systems and the technology of our website, and (4) to provide prosecution authorities with the information necessary for law enforcement in the case of a cyberattack. Kiesewetter KG evaluates this anonymously collected data and information both statistically and with the aim of increasing data protection and data security in our company, in order to ultimately ensure the best possible level of protection for the personal data processed by us. The anonymous data of the server log files are stored separately from all personal data provided by a person concerned.
6. Registration on our website
The person concerned has the possibility to register on the website of the controller by providing personal data. Which personal data is hereto transmitted to the controller arises from the respective input mask used for the registration. The personal data entered by the person concerned will be collected and stored solely for internal use by the controller and for his own purposes. The controller may pass on this personal data to one or more processors, such as a parcel service, who also use the personal data only for internal use, ascribed to the controller.
By registering on the website of the controller, the IP address, assigned by the internet service provider (ISP) of the person concerned, the date and the time of registration are also stored. The storage of this data takes place against the background, that only in this way the misuse of our services can be prevented, and these data will make it possible to clarify committed offenses in case of need. In this respect, the storage of this data is required to hedge the controller. A disclosure of these data to third parties does not take place, unless there is a legal obligation to passing on or the disclosure serves law enforcement.
The registration of the person concerned through voluntary stating of personal data, serves the controller for providing the person concerned with contents or services that, due to the nature of the things, can only be offered to registered users. Registered persons are free to let modify the personal data given at registration at any time or to get it completely deleted from the database of the controller.
The controller will at any time upon request, provide information to each person concerned, as to which personal data about the person concerned is stored. Furthermore, the controller corrects or deletes personal data, at the desire or indication of the person concerned, insofar as this does not conflict with any statutory storage requirements. All employees of the controller are available to the person concerned as a contact person in this relation.
7. Subscription of our newsletter
On the website of Kiesewetter KG the users are given the opportunity to subscribe to the newsletter of our company. Which personal data is transmitted to the controller by ordering of the newsletter arises from the input mask used for this purpose.
Kiesewetter KG informs its customers and business partners at regular intervals by means of a newsletter about offers of the company. The newsletter of our company can only be received by the person concerned if (1) the person concerned has a valid email address and (2) the person concerned registers for the newsletter.
When subscribing to the newsletter, we also store the IP address of the computer system, assigned by the Internet Service Provider (ISP) and used by the person concerned at the time of registration, as well as the date and time of registration. The collection of this data is necessary to retrace the (possible) misuse of the e-mail address of a person concerned at a later date and therefore serves as legal safeguards for the controller.
The personal data collected in the context of registering for the newsletter will be used exclusively to send our newsletter. Subscribers to the newsletter might also be informed by e-mail, where this is necessary for the operation of the newsletter service or a registration referring to this, as it might be in the case of changes to the newsletter offer or technical changes. There will be no transfer of the personal data, collected as part of the newsletter service, to third parties. Subscription to our newsletter can be cancelled by the person concerned at any time. The consent to the storage of personal data, that the person concerned has given us for the newsletter dispatch, can be revoked at any time. For the purpose of revoking the consent, there is a corresponding link in each newsletter. It is also possible to unsubscribe from the newsletter at any time, directly on the controller's website, or to inform the controller in a different way.
8. Newsletter tracking
The newsletters of the Kiesewetter KG contain so-called counting pixels. A counting pixel is a miniature graphic, which is embedded in such e-mails that are sent in HTML format, to enable log file recording and log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns. With an embedded counting pixel, Kiesewetter KG can see, if and when an e-mail was opened by a person concerned and which links in the e-mail were called by the person concerned.
Such personal data collected by means of the counting pixels contained in the newsletters will be stored and evaluated by the controller in order to optimize the delivery of newsletters and to better adapt the content of future newsletters to the interests of the person concerned. This personal data will not be transferred to third parties. Persons concerned are at any time entitled to revoke the relevant separate consent, which was given over the double-opt-in procedure. After a revocation, this personal data will be deleted by the controller. An unsubscription from the receipt of the newsletter, the Kiesewetter KG automatically interprets as a revocation.
9. Contact opportunities via our website
Due to legal regulations, the website of Kiesewetter KG contains information, which enables quick electronic contact to our company as well as direct communication with us and which also comprises a general address of the so-called electronic mail (e-mail address). If a person concerned contacts the data controller by e-mail or through a contact form, the personal data provided by the person concerned will be automatically stored. Such personal data, voluntarily transmitted by a person concerned to the controller, is stored for the purpose of processing or contacting the person concerned. There is no transfer of this personal data to third parties.
10. Routine erasure and blocking of personal data
The controller processes and stores personal data of the person concerned only for the period, which is needed for reaching the purpose of storage and as far as this was intended by the legislator of the European Guidelines and Regulations or another legislator of laws and regulations, which the controller is subject to.
When the purpose of storage is dropped or when a required retention period, prescribed by the legislator of the European Guidelines and Regulations or another legislator of laws and regulation, runs out, the personal data will be locked or erased routinely and correspondingly to the legal regulations.
11. Rights of the person concerned
a, Right to confirmation
Each person concerned has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. To this the person concerned can address to an employee of the controller at any time.
b, Right to information
Each person concerned has the right to obtain from the controller information about the personal data stored about his or her person, and to get a copy of this information. Furthermore the person concerned has the right to obtain information about following:
- The purposes of the processing
- The categories of personal data concerned
- The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
- Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine this period
- The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the person concerned or to object to such processing
- The right to lodge a complaint with a supervisory authority
- When the personal data is not collected from the person concerned, any available information as to its source
- The existence of automated decision-making, including profiling, according to Article 22 paragraph 1 and 4 GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the person concerned. When personal data is transferred to a third country or to an international organization, the person concerned has the right to be informed of the appropriate safeguards relating to the transfer. To this the person concerned can address to an employee of the controller at any time.
c, Right to rectification
By processing of personal data each person concerned has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the person concerned has the right to have incomplete personal data completed, including by means of providing a supplementary statement. To this the person concerned can address to an employee of the controller at any time.
d, Right to erasure (‘right to be forgotten’)
By processing of personal data each person concerned has the right to obtain from the controller the erasure of personal data concerning him or her, without undue delay, and the controller has the obligation to erase personal data without undue delay, if one of the following grounds applies:
- The personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- The person concerned revokes consent on which the processing is based according to Article 6 paragraph 1 point a), or Article 9 paragraph 2 point a) GDPR, and where there is no other legal ground for the processing.
- The person concerned objects to the processing pursuant to Article 21 paragraph 1 GDPR and there are no overriding legitimate grounds for the processing, or the person concerned objects to the processing pursuant to Article 21 paragraph 2 GDPR.
- The personal data has been unlawfully processed.
- The personal data has to be erased for compliance with a legal obligation in Union or Member State law, to which the controller is subject.
- The personal data has been collected in relation to the offer of information society services referred to in Article 8 paragrpah 1 GDPR.
As far as a person concerned wants to obtain the erasure of personal data stored with Kiesewetter KG because of one of these reasons, he or she can address to an employee of the controller at any time and the erasure will be fulfilled promptly.
When Kiesewetter KG has made the personal data public and our company is obliged pursuant to Article 17 paragraph 1 GDPR to erase the personal data, then Kiesewetter KG, taking account of available technology and the cost of implementation, will take reasonable steps including technical measures, to inform other controllers which are processing the personal data, that the person concerned has requested the erasure by such controllers of any links to, or copy or replication of those personal data. The employee of Kiesewetter KG will arrange for all necessary on a case-by-case basis.
e, Right to restriction of processing
The person concerned has the right to obtain from the controller restriction of processing when one of the following applies:
- The accuracy of the personal data is contested by the person concerned for a period enabling the controller to verify the accuracy of the personal data.
- The processing is unlawful; the person concerned opposes the erasure of the personal data and requests the restriction of its use instead.
- The controller no longer needs the personal data for the purposes of the processing, but it is required by the person concerned for the assertion, exertion or defence of legal claims.
- The person concerned has objected to processing pursuant to Article 21 paragraph 1 GDPR, and it is not yet certain, whether the legitimate reasons of the controller outweigh those of the person concerned.
As far as a person concerned wants to request the restriction of personal data stored with Kiesewetter KG because of one of these requirements, he or she can address to an employee of the controller at any time and the restriction will be fulfilled promptly.
f, Right to data portability
The person concerned has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. Furthermore the person concerned has the right to transmit those data to another controller without hindrance from the controller to which the personal data has been provided, when:
- The processing is based on consent pursuant to Article 6 paragraph 1 point a) or Article 9 paragraph 2 point a) GDPR, or on a contract pursuant to Article 6 paragraph 1 point b) and
- The processing is carried out by automated means, unless the processing is necessary for the exercise of a task in the public interest or in the exercise of public authority, delegated to the controller.
In exercising his or her right to data portability pursuant to Article 20 paragraph 1, the person concerned has the right to have the personal data transmitted directly from one controller to another, where technically feasible and as far as no rights and no freedoms of other persons will be affected.
To assert the right to data portability the person concerned can address to an employee of Kiesewetter KG at any time.
g, Right to object
The person concerned has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is based on Article 6 paragraph 1 point e) or f) GDPE, including profiling based on those provisions.
Kiesewetter KG will then no longer process the personal data, unless we can prove compelling legitimate grounds for the processing, which outweighs the interests, rights and freedoms of the person concerned, or the processing is for the assertion, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, the person concerned has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent, that it is related to such direct marketing.
Where the person concerned objects to processing for direct marketing purposes, Kiesewetter KG will no longer process the personal data for such purposes.
Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89 paragraph 1), the person concerned, on grounds relating to his or her particular situation, has the right to object to processing of personal data concerning him or her, unless the processing is necessary for the exercise of a task carried out for reasons of public interest.
For the exertion of the right to object, the person concerned can address to an employee of Kiesewetter KG at any time.
The person concerned is also free, in connection with the use of services of the information society, notwithstanding Directive 2002/58 /EC, to exercise his or her right to object by means of automated procedures, at which technical specifications are used.
h, Automated individual decision-making, including profiling
The person concerned has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision
- is necessary for signing or fulfillment of a contract between the person concerned and the controller;
- is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the rights, freedoms and legitimate interests of the person concerned; or
- is based on the person’s concerned explicit consent.
In the cases referred to in points 1. and 3. Kiesewetter KG will implement suitable measures to safeguard the rights and freedoms as well as the legitimate interests of the person concerned, inherent at least the right to obtain intervention of a person on the part of the controller, to express his or her own point of view and to challenge the decision.
For the assertion of those rights the person concerned can address to an employee of Kiesewetter KG at any time.
i, Right to revoke a data protection consent
The person concerned at any time has the right to revoke a consent to processing of personal data.
To assert the right to revoke the data protection consent the person concerned can address to an employee of Kiesewetter KG at any time.
12. Data protection in applications for employment and in the application process
The controller collects and processes personal data from applicants for the purpose of handling the application procedure. The processing can also be done electronically. This is particularly the case, if an applicant submits corresponding application documents to the controller by electronic means, for example by e-mail or via a web form available on the website. If the controller concludes a contract of employment with an applicant, the transmitted data will be stored for the purposes of handling of the employment relationship, in accordance with the law. If no employment contract is concluded with the applicant by the controller, the application documents will be automatically deleted two months after the announcement of the decision of rejection, unless deletion precludes other legitimate interests of the controller. Other legitimate interest in this sense is for example a burden of proof in a procedure under the General Equal Treatment Act.
13. Data protection regulations for application and use of Facebook
The controller has integrated components of the company Facebook on this website. Facebook is a social network. A social network is an internet-based social meeting place, an online community that typically allows users to communicate with each other and interact in virtual space. A social network can serve as a platform to exchange opinions and experiences, or allows the internet community to provide personal or company-related information. Amongst others Facebook allows social network users to create private profiles, upload photos and a networking via friend requests.The operating company of Facebook is Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The controller for the processing of personal data, if person concerned lives outside the US or Canada, is the Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland.
At each visit to one of the individual pages of this website, which is operated by the controller and on which a Facebook component (Facebook plug-in) has been integrated, the internet browser on the information technology system of the person concerned will automatically be triggered by the respective Facebook component to download a presentation of the corresponding Facebook component. An overview of all Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/?locale=en_US. As part of this technical process, Facebook receives information about which specific subpage of our website is visited by the person concerned.
If the person concerned is simultaneously logged in to Facebook, Facebook recognizes with each visit to our website by the person concerned and during the entire duration of the respective stay on our website, which specific subpage of our website the person concerned visits. This information is collected through the Facebook component and assigned by Facebook to the respective Facebook account of the person concerned. If the person concerned activates one of the Facebook buttons integrated on our website, for example the "Like" button, or if the person concerned makes a comment, Facebook assigns this information to the personal Facebook user account of the person concerned and saves this personal data.
Facebook always receives information via the Facebook component, that the person concerned has visited our website, if the person concerned is logged in to Facebook at the same time as accessing our website; this happens regardless of whether the person concerned clicks on the Facebook component or not. If such a transfer of this information to Facebook is not wanted by the person concerned, the transfer can be prevented by logging out of his or her Facebook account before calling our website.
The data policy published by Facebook, which is available at
https://de-de.facebook.com/about/privacy/, provides information on the collection, processing and use of personal data by Facebook. It also explains which options Facebook offers to protect the privacy of the person concerned. In addition, different applications are available, which make it possible to suppress data transmission to Facebook. Such applications can be used by the person concerned to suppress data transmission to Facebook.
14. Data protection regulations for application and use of Google Analytics (with anonymization function)
The controller has integrated the component Google Analytics (with anonymization function) on this website. Google Analytics is a web analytics service. Web analysis is the elicitation, collection and analysis of data about the behavior of visitors on websites. Among other things, a web analysis service collects data about from which website a person concerned has come to another website (so-called referrers), which subpages of the website were accessed to or how often and for which length of stay a subpage was viewed. A web analysis is mainly used to optimize a website and to cost-benefit analysis of internet advertising.
The operating company of the Google Analytics component is Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA.
The controller uses the addendum "_gat._anonymizeIp" for web analytics via Google Analytics. By means of this addendum, the IP address of the internet connection of the person concerned will be shortened and anonymized by Google, if the access to our website is from a Member State of the European Union or from another state party to the Agreement on the European Economic Area.
The purpose of the Google Analytics component is to analyze flows of visitors on our website. Amongst others, Google uses the obtained data and information to evaluate the use of our website, to compile online reports for us, showing the activities on our websites, and to provide other services related to the use of our website.
Google Analytics sets a cookie on the information technology system of the person concerned. What cookies are, has already been explained above. By using this cookie Google is enabled to analyze the usage of our website. Each time one of the pages of this website, which is operated by the controller and on which a Google Analytics component has been integrated, is accessed, the internet browser on the information technology system of the person concerned is automatically triggered by the respective Google Analytics component to submit data to Google for online analysis purposes. As part of this technical process, Google gets knowledge of personal data, such as the IP address of the person concerned, which amongst others serves Google to track the origin of the visitors and clicks, and subsequently make possible commission settlements.
The cookie stores personal information, such as access time, the location from which access was made, and the frequency of visits to our website by the person concerned. Each time our website is called, this personal data, including the IP address of the internet connection used by the person concerned, is transferred to Google in the United States of America. This personal data is stored by Google in the United States of America. Google might transfer such personal data collected through the technical process to third parties.
The person concerned can prevent the setting of cookies through our website, as shown above, at any time by means of a corresponding setting of the internet browser used, and can thus permanently contradict the setting of cookies. Such a setting of the internet browser used would also prevent Google from setting a cookie on the information technology system of the person concerned. In addition, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programs.
Furthermore, the person concerned has the option to object to collection of data, generated by Google Analytics and related to the use of this website, as well as to processing of this data by Google and prevent from this.
Additional information and Google's privacy statement can be found at https://www.google.com/intl/en/policies/privacy/ and http://www.google.com/analytics/terms/en.html. Google Analytics is explained in more detail at https://www.google.com/intl/de_de/analytics/.
15. Data protection regulations for application and use of YouTube
The controller has integrated components of YouTube on this website. YouTube is an internet video portal, which allows publishers of videos to upload videos for free and other users to view, judge and comment these, as well for free. YouTube allows publications of all kinds of videos, wherefore as well complete films and TV broadcasts, as also music videos, trailers or videos which are recorded from users themselves, can be called over the internet portal.
Operating company of YouTube is The YouTube LCC, 901 Cherry Ave., San Bruno, CA 94066, USA. The YouTube LCC is a subsidiary of the Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
At each visit to one of the individual pages of this website, which is operated by the controller and on which components of YouTube (YouTube video) have been integrated, the internet browser on the information technology system of the person concerned will automatically be triggered by the respective YouTube component to download a presentation of the corresponding YouTube component. Additional information on YouTube can be found at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google receive information about which concrete subpage of our website is visited by the person concerned.
If the person concerned is logged in to YouTube at the same time, YouTube recognizes by calling a subpage containing a YouTube video, which concrete subpage of our website the person concerned visits. This information is collected by YouTube and Google and associated with the respective YouTube account of the person concerned.
YouTube and Google will always receive information through the YouTube component, that the person concerned has visited our website, if the person concerned is simultaneously logged in to YouTube at the time of calling our website. This happens regardless of whether the person clicks on a YouTube video or not. If such transmission of this information to YouTube and Google is not wanted by the person concerned, it can prevent the transmission by logging out of his or her YouTube account before calling our website.
YouTube's privacy statement is available at https://www.google.com/intl/en/policies/privacy/ and gives information about the collection, processing, and use of personal data by YouTube and Google.
16. Method of payment: data protection regulations for PayPal as method of payment
The controller has integrated components of PayPal on this website. PayPal is an online payment service provider. Payments are made through so-called PayPal accounts, which are virtual private or business accounts. Furthermore, PayPal offers the opportunity to process virtual payments through credit cards, if a user does not have a PayPal account. A PayPal account is managed via an email address, which is why there is no classic account number. PayPal makes it possible to trigger online payments to third parties or to receive payments. PayPal also takes on fiduciary functions and offers buyer protection services.
The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.
If the person concerned selects "PayPal" as method of payment during the order process in our online shop, data of the person concerned will be automatically transmitted to PayPal. By selecting this method of payment the person concerned consents to the transfer of personal data required for payment processing.
The personal data sent to PayPal is usually the first name, surname, address, email address, IP address, telephone number, mobile phone number or other data required for payment processing. For the processing of the purchase contract, also such personal data is necessary, which are in connection with the respective order.
Transmission of the data is for the purpose of payment processing and fraud prevention. The controller will provide PayPal with personal data, in particular if there is a legitimate interest in the transfer. The personal data exchanged between PayPal and the controller might be transferred by PayPal to credit reporting agencies. This transmission is for the purpose of identity and credit check.
PayPal may pass on personal data to involved companies and service providers or subcontractors, as far as this is necessary to fulfill the contractual obligations or to process the data on behalf of.
The person concerned has the possibility to revoke the consent to the handling of personal data towards PayPal at any time. A revocation has no effect on personal data which must be processed, used or transmitted for (contractual) payment processing.
PayPal's applicable privacy statement is available at https://www.paypal.com/webapps/mpp/ua/privacy-full.
17. Legal basis of processing
Article 6 GDPR serves our company as legal basis for processing operations, where we obtain a consent for a certain purpose of processing:
- When processing of personal data is necessary for fulfillment of a contract with the person concerned, such as processing operations for delivery of goods or supply of another service or consideration, then processing is based on Article 6 paragraph 1 point b).
This also applies to such processing operations which are necessary for execution of pre-contract measures, like in cases of inquiries about our products or services.
- When processing of personal data is necessary for a compliance of our company with a legal obligation, e.g. for fulfillment of tax responsibilities, then processing is based on Article 6 paragraph 1 point c).
- In rare precedents processing could be necessary in order to protect the vital interests of the person concerned or of another natural person. This might be the case, if a visitor would be hurt in our company and thereupon his or her name, age, health insurance fund data or other vital information would have to be given to a doctor, hospital of other third parties. Then processing is based on Article 6 paragraph 1 point d).
- Finally processing operations could be based on Article 6 paragraph 1 point f). On this legal basis those processing operations are based on, which are not covered by any of the above-mentioned legal basis, when processing is necessary for protection of the legitimate interests of our company or a third party, unless the interests, fundamental rights and freedoms of the person concerned outweigh.
Such processing operations are particularly allowed to us as they have been especially mentioned by the European legislator. He expressed his opinion that a legitimate interest could supposed to be given, when the person concerned is a customer of the controller (recital 47 sentence 2 GDPR).
18. Legitimate interests in processing, which are pursued by the controller or a third party
Where processing of personal data is based on Article 6 paragraph 1 point f) GDPR, our legitimate interest is the execution of our business activities for the benefit of the well-being of our staff and our shareholders.
19. Duration, for which the personal data will be stored
The criterion for the duration of storage of the personal data is the respective legal retention period. After expiry of the deadline the corresponding data will be erased routinely, unless it is still necessary for performance or initiation of a contract.
20. Legal or contractual rules for providing of the personal data; necessity for the conclusion of contract; obligation of the person concerned to provide the personal data; possible consequences from non-provision
We make you aware of that providing of the personal data partly is prescribed by law (for example tax regulations) or can arise from contractual rules (for example information about the contract partner). Sometimes with conclusion of contract it will be necessary, that the person concerned provides us personal data, which will subsequently be needed to be processed by us. For example, the person concerned is obligated to provide us the personal data, when our company concludes a contract with him or her. A non-provision of the personal data would result in not being able to conclude the contract with the person concerned.
Before providing the personal data the person concerned has to address to one of our employees. Our employee will then advise the person concerned on a case-by-case-basis of whether the providing of the personal data is prescribed legal or contractual, or necessary for the conclusion of contract, whether he or she is obligated to provide the personal data and which consequences could arise from non-provision of the personal data.
21. Existence of an automated decision making
As a responsible company we refrain from an automated decision making or profiling.