PRIVACY POLICY
I. Who is responsible for data processing on this website?
Controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:
Habermaass GmbH & Co. KG August-Grosch-Str. 28-38, 96476 Bad Rodach (hereinafter HABA)
Tel.: +49 9564 929-60100
Fax: +49 9564 929 662300
E-mail: kundenservice@haba.de
Register Court Coburg, HRA 5220
VAT ID No.: DE 815 831 282 WEEE Reg. No.: DE 51463378
The personally liable partner is Habermaass Administration GmbH, August-Grosch-Str. 28-38, 96476 Bad Rodach, Germany, Register Court Coburg, HRB 4746, which in turn is represented by the managing director Dr. Mario Wilhelm.
If you have any questions about data protection, you can reach our Data protection officer by post: Habermaass GmbH & Co. KG, Data Protection, August-Grosch-Str. 28-38, 96476 Bad Rodach or by e-mail: kundenservice@haba.de and the subject: Data protection.
II. Which data is stored for which purpose?
1. For processing the order:
We will request and use your personal data with mandatory fields in the online shop or for telephone orders. Mandatory information is: salutation (gender), first and last name, address, date of birth (for purchase on account) and your email address.
All further information is voluntary. To deliver your order, we pass your delivery address to the carrier commissioned with delivery. In addition, we may pass your payment data to our house bank. For the processing of personal data that is necessary for the performance of a contract or the implementation of pre-contractual measures with you, Art. 6(1)(b) GDPR serves as the legal basis.
Customer account: You can shop with us as a guest or voluntarily create a customer account through which we can store your data for later purchases. When registering the customer account, the data you provide are stored revocably. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
2. Payment processing:
As part of payment in our online shop we collect certain personal data from you in order to fulfill the contract with you. The legal basis for this is Art. 6(1)(b) GDPR.
a. Purchase on account and advance payment
For the payment methods purchase on account and advance payment we receive the information you provided such as account holder, IBAN, bank institution and purpose of payment. The legal basis for the data processing associated with this is Art. 6(1)(b) GDPR.
b. PayPal
When paying with PayPal your payment data are forwarded to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing. If you want to pay your order in the online shops with PayPal, the amount to be paid by you together with first and last name, delivery address, email address, telephone number and IP address will be transmitted to PayPal so that you can authorize the payment to us via PayPal. The legal basis for the data processing associated with this is Art. 6(1)(b) GDPR, i.e., the processing of your data is necessary for the performance of the agreement on payment of your purchase via PayPal. The data transmitted to PayPal may be passed on by PayPal to credit agencies for identity and credit checks. Further data protection information can be found in PayPal's privacy policy https://www.paypal.com/de/webapps/mpp/ua/privacy-full can be found.
c. Payment by credit card
We also offer you the option to make your payments by credit card. The legal basis for the data processing associated with this is Art. 6(1)(b) GDPR, i.e., the processing of your data is necessary for the performance of the agreement on payment of your purchase by credit card. When paying by credit card the following data are processed:
Card type (American Express, Mastercard or VISA),
Name of the cardholder,
Card number,
Security code,
Expiration date.
Note on credit check:
In the context of the contractual relationship we transmit personal data collected about the application, execution and termination of this business relationship as well as data on non-contractual or fraudulent behavior to CRIF Bürgel GmbH, Leopoldstraße 244, 80807 Munich.
The legal bases for this transmission are Art. 6(1) sentence 1 lit. b, f GDPR. The data exchange with CRIF Bürgel GmbH also serves to fulfill legal obligations to carry out creditworthiness checks (§§ 505a and 506 of the Civil Code). CRIF Bürgel GmbH processes the received data and also uses it for profiling (scoring) in order to provide its contractual partners in the European Economic Area and in Switzerland and, if applicable, in further third countries (if an adequacy decision by the European Commission exists for them) with information, among other things, for assessing the creditworthiness of natural persons.
Further information about the activities of CRIF Bürgel GmbH can be found in their information sheet or online at www.crifbuergel.de/de/datenschutz can be viewed.
3. Questions about the product:
On our website you can ask questions about the product. Your contribution will be published with the username you provided. We recommend using a pseudonym instead of your real name. Providing a username and email address is required; all other information is voluntary. We need your email address to contact you in case a third party objects to your comment as unlawful, in which case this is our legitimate interest. We reserve the right to delete comments if they are objected to as unlawful by third parties. The legal basis for this is Art. 6(1)(f) GDPR.
4. Contact by post, email or contact form:
If you contact us in this way, the personal data transmitted by post, email or online contact form will be processed. If you contact us via the contact form, the following data are required: gender, name, address data, email address, reason for the enquiry and your personal message.
This data is used exclusively for processing the conversation. The legal basis for the processing of your data is your consent within the meaning of Art. 6(1)(a) GDPR. If your message is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data processed in this context will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected (conversation, contract fulfillment). Furthermore, you have the option to object to the processing of personal data by contacting us via the contact channels listed under Section I.
5. Information about products:
HABA may also process the data you provided in order to inform you by post about other interesting products from our entire portfolio or to send you emails with technical information about our webshop.
The legal basis for this is our legitimate interest under Art. 6(1)(f) GDPR. As a customer you will also occasionally be informed by e-mail about similar offers / goods to your purchase from the Habermaass GmbH & Co. KG group that may be of interest to you.
You receive this information on the basis of § 7(3) UWG, in which our legitimate interest lies. You can of course object to the further receipt of such messages at any time for the future without incurring any costs other than the transmission costs at the basic rates. An objection is possible via the contact details listed under Section I.
6. When subscribing to the newsletter:
With your consent you can subscribe to our newsletter, with which we inform you about our current offers. The newsletter sent by HABA may also sometimes advertise goods and services of Habermaass GmbH & Co. KG if these match your interests in our products. We use the services of Emarsys – emarsys eMarketing Systems AG, Märzstraße 1, 1150 Vienna, Austria to support email delivery.
For registration to our newsletter we use the so-called double opt-in procedure. That means that after you register we send an email to the specified email address in which we ask you to confirm that you want to receive the newsletter. We store your IP address used and the times of registration and confirmation. The purpose of the procedure is to prove your registration and to be able to clarify any possible misuse of your personal data.
The only mandatory information for sending the newsletter is your email address. Providing further, separately marked data is voluntary and is used to be able to address you personally. The legal basis for sending the newsletter is your consent under Art. 6(1)(a) GDPR.
You can revoke your consent to receive the newsletter at any time and unsubscribe. You can declare the revocation by clicking the link provided in each newsletter, or by contacting the contact addresses listed under Section I.
We point out that when sending the newsletter we analyze your user behavior. For this analysis the emails sent include so-called web beacons or tracking pixels of our email delivery service provider Emarsys, as well as our web analytics technology Exactag. This technology allows us to record your opening and click behavior. Furthermore, this data can be linked with the behavior of this pseudonymous profile on our website. With the data obtained in this way we create a user profile to tailor the newsletter to your individual interests. In doing so we record when you read our newsletter, which links you click in it and deduce your personal interests from this. We link these data with actions you have taken on our website.
7. When visiting the website:
If you call up our website, data from the system of the calling computer/device are automatically collected. These are the following data:
IP address,
Date and time of the request,
Time zone difference,
Content of the request,
Access status / HTTP status code,
Amount of data transferred,
Website from which the request comes,
Browser,
Operating system and its interface,
Language and version of the browser software.
These data are also logged and stored in the log files of our system on the basis of Art. 6(1)(f) GDPR. Our legitimate interest in processing these data is that processing of these data enables the delivery of the website to your computer in the first place and guarantees the functionality of the website. In addition, these data are necessary to ensure the security of our IT systems. \nThe data are deleted as soon as the purpose of collection ceases to apply, that is, in the case of collection of data for website provision when the respective session is ended and in the case of data storage in log files after at most seven days. There is no storage of these data together with other personal data collected from you.
8. Further services:
We also offer further services that you can use if you are interested. The information is provided by you voluntarily and based on your consent under Art. 6(1)(a) GDPR or for the processing of a resulting contractual relationship under Art. 6(1)(b) GDPR. Your data may have to be passed on to our carefully selected service providers for the provision of services. The following services are currently offered:
Sending press releases,
Participation in customer loyalty campaigns,
Participation in contests,
Personalization of product orders,
Spare parts service.
III. Are cookies processed?
Our website uses cookies in several places. They are used to make our offering more user-friendly, effective, and secure.
1. What are cookies?
A cookie is a small data file that is transferred by us to your browser when you surf our site. We use cookies for the following purposes:
So that we can recognize you on future visits, to display desired preferences in the shopping cart (language, delivery country, username),
so that you can use additional specific services, e.g. displaying the site in your language, personalizing our site, etc.,
so that we can tailor our site even better to your needs.
The storage of personal data only takes place with your explicit consent or when this is strictly necessary to use the offered and requested service accordingly.
Processor agreement: We have concluded a contract for order processing with third-party providers (third-party cookies).
Our website uses the cookie consent technology from OneTrust, 82 St John St Farringdon, London EC1M 4JN, United Kingdom, to obtain your consent for the storage of certain cookies in your browser and to document these in a GDPR-compliant manner.
The use of the cookie consent technology is to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.
2. How can you revoke the use of cookies?
You can revoke your consent to the use of cookies, insofar as they are not strictly necessary cookies, at any time with effect for the future in the cookie settings. This right is granted to you under Art. 7(3) sentence 1 GDPR. You also have the option at any time to disable cookies in your browser. If you disable cookies, certain features on our site may not be available to you and some web pages may not display properly.
3. Which cookies do we use?
Various cookies are set on our website. These can be divided into 3 categories according to their purpose and function:
Strictly necessary cookies,
Functional or performance cookies,
Marketing and analytics cookies.
a. Strictly necessary cookies
Strictly necessary cookies ensure functions so that you can use our website at all. As a rule, these cookies are only set in response to actions you take that correspond to a service request, such as setting privacy preferences, logging in, or filling out forms. You can set your browser to block these cookies or to be notified accordingly. If you make these settings, some areas of the website may then not function.
Legal bases for the use of strictly necessary cookies are Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligation) and/or Art. 6(1)(f) GDPR (balancing of interests, based on our legitimate and overriding interest in the technically smooth provision of our website).
aa. OneTrust cookie consent
Our website uses the cookie consent technology from OneTrust, 82 St John St Farringdon, London EC1M 4JN, United Kingdom, to obtain your consent for the storage of certain cookies in your browser and to document this in a data-protection compliant manner. A cookie is set for this purpose. The use of the cookie consent technology is to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.
bb. Tealium consent preferences
To manage consent preferences for tags from third parties, we set a cookie that is linked to our consumer data platform Tealium. The provider is Tealium, 11095 Torreyana Road, San Diego, CA 92121. The user data itself is hosted on Tealium's servers in Frankfurt am Main, Germany. The legal basis for the processing of your data is Art. 6(1)(c) GDPR.
b. Functional or performance cookies
With these cookies the website is able to provide extended functionality and personalization. They may be set by us or by third-party providers whose services we use on our pages. These cookies also allow us to count visits and traffic sources so that we can measure and improve the performance of our website. If you do not allow these cookies, some or all of these services may not function properly.
The legal basis for the use of functional cookies is Art. 6(1)(a) GDPR in connection with your consent.
Withdrawal:
You have the option to withdraw your consent to the use of functional cookies at any time with effect for the future in the cookie settings. The legal basis for this is Art. 7(3) sentence 1 GDPR.
aa. Google 360 Analytics, Google Tag Manager
Our website uses Google Analytics and Google Tag Manager as web analytics services of Google LLC (“Google”) based in the USA. Google Analytics / Google Tag Manager use cookies that are stored on your computer and enable an analysis of your use of the website. This allows us to regularly improve and make our website more interesting.
The information generated by the cookie about your use of our website (including your IP address in anonymized form) is transmitted to a Google server in the USA and stored there. Google will use this information to evaluate the use of the website, to compile reports about website activity for us as the website operator, and to provide further services related to website use and internet usage.
The legal basis for the processing is Art. 6(1)(a) GDPR.
In addition to withdrawing the functional cookies in the cookie settings, you also have the option to prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
Overview of data protection: https://policies.google.com/?hl=de&gl=de,
Privacy policy: http://www.google.de/intl/de/policies/privacy.
bb. Google Enhanced Conversion
Within the Google Tag Manager as the tag management system we use Google Enhanced Conversions from Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
If you visit our website and are referred by a Google advertisement, we send a hashed identifier and information about possible purchases to Google. For this purpose, the secure one-way hash algorithm SHA256 is applied to the email address collected from you by us before it is sent to Google. The hash data is then matched with signed-in Google accounts. Google processes the data to understand which ad you clicked on, to measure its success, and to provide us with this information in aggregated form. This allows us to track sales and measure the success of ads.
Google stores the data for a period of 140 days if it was possible to link the conversions to a Google user; otherwise the data is deleted after 60 days.
The legal basis for the processing is Art. 6(1)(a) GDPR.
In addition to withdrawing the functional cookies in the cookie settings, you also have the option to prevent the collection of the data generated by the cookie and related to your use of the website by Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
c. Marketing and analytics cookies
These cookies may be set on our website by our marketing and analytics partners. They may be used by these companies to create a profile of your interests and to show you relevant ads on other websites. If you do not allow these cookies, you will see less targeted advertising.
The legal basis for the use of marketing and analytics cookies is Art. 6(1)(a) GDPR in connection with your consent.
Withdrawal:
You have the option to withdraw your consent to the use of marketing and analytics cookies at any time with effect for the future in the cookie settings. The legal basis for this is Art. 7(3) sentence 1 GDPR.
aa. Optimization of the display of advertising offers using Dynamic Yield
This website uses the services of Dynamic Yield Ltd., Highlands House, Basingstoke Road, Spencers Wood, Reading, Berkshire, England, RG7 1NT (https://www.dynamicyield.com). With the recommendation tool Dynamic Yield, our web offering is optimized to make your website visit a personal experience through tailored recommendations and content. We use the page content you viewed to recommend equivalent or thematically related products or other content relevant to you.
Dynamic Yield collects pseudonymized information about your usage activities on our site for this purpose. Cookies are used in which exclusively pseudonymized information is stored under a randomly generated ID (pseudonym). A direct personal reference is therefore not possible.
The legal basis for the processing of your data is Art. 6(1)(a) GDPR.
In addition to the option in the cookie settings to deselect processing for marketing and analysis purposes, you can also delete the cookies stored on your device after visiting our website or set your web browser so that none of these cookies can be stored on your computer.
bb. Facebook Website Custom Audiences
Users of the social network Facebook, a product of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, should note that the communication tool Website Custom Audiences or Facebook Custom Audience with the Facebook Pixel from Facebook is used on this website. For this purpose, so-called Facebook pixels are integrated on our websites that mark you as a visitor to our website without identifying you as a person. If you later log in to Facebook, a non-reversible and therefore non-personal checksum (profile) is transmitted to Facebook from your usage data for analysis and marketing purposes. Every Facebook user has a unique and device-independent Facebook ID, which makes it possible for us to address users across multiple devices on the social network Facebook. We do not receive any personal information about individual website visitors. Further information about the purpose and scope of data collection and the further processing and use of the data by Facebook as well as your options for settings to protect privacy can be found in Facebook's data protection policies, which are available, among others, at https://www.facebook.com/about/privacy,https://www.facebook.com/ads/website_custom_audiences/ can be found.
The legal basis for the processing of your data is Art. 6(1)(a) GDPR.
In addition to the option in the cookie settings to deselect processing for marketing and analysis purposes, you can also delete the cookies stored on your device after visiting our website or set your web browser so that none of these cookies can be stored on your computer.
cc. Embedding YouTube videos
We have embedded YouTube videos in our online offering that are stored on http://www.YouTube.com stored there and can be played directly from our website. This is an offer from YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, a subsidiary of Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. These are all embedded in 'extended privacy mode', i.e., no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos will the data mentioned below be transmitted. We have no influence on this data transmission.
By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website. This occurs regardless of whether you provide YouTube with a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not want the assignment to your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for advertising, market research, and/or the needs-based design of its website. Such an evaluation is carried out in particular to provide needs-based advertising and to inform other users of the social network about your activities on our website.
The legal basis for the processing of your data is Art. 6(1)(a) GDPR. You have the option at any time to deselect processing for marketing and analysis purposes in the cookie settings.
Further information on the handling of user data can be found in the privacy policy at: https://policies.google.com/privacy?hl=de&gl=de.
dd. Tealium
On this website we use Tealium technologies. The provider is Tealium, 11095 Torreyana Road, San Diego, CA 92121. Tealium is a consumer data platform that enables us to segment and target to obtain a unified view of our website visitors. Tealium collects movement and behavioral data on the website. Furthermore, all transaction data about purchases is sent to Tealium. For this purpose the following personal data are processed: contact details (email, salutation, first and last name, postal address), transaction data (purchases, products purchased, payment method), website behavior data (sessions, views, clicks, conversions).
The cookies are stored for a maximum of 12 months and then deleted.
The user data itself is hosted on Tealium's servers in Frankfurt am Main, Germany.
The legal basis for the processing of your data is your consent within the meaning of Art. 6(1)(a) GDPR.
You have the option at any time to deselect processing for marketing and analysis purposes in the cookie settings.
Further information on data processing by Tealium at: https://tealium.com/privacy-policy/.
ee. Google Ads
We use Google Ads from Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Through Google Ads we can draw attention to our attractive offers on Google search result pages, other external sites and within the Google Display Network. Our interest is to show you advertising that may be of interest to you. We also use the retargeting function to display targeted offers to visitors to our site.
These advertising media are delivered by Google via so-called 'ad servers'. For this purpose we use ad server cookies through which certain parameters for measuring success, such as ad impressions or clicks, can be measured. If you reach our website via a Google ad, a cookie is stored on your device by Google Ads. Typically the following analytics values are stored for this cookie: the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (indicating that the user no longer wishes to be addressed).
These cookies enable Google to recognize your web browser. If a user visits certain pages of an ads customer's website and the cookie stored on their computer has not yet expired, Google and the ads customer can recognize that the user clicked on the ad and was redirected to that page. Each ads customer is assigned a different cookie. Cookies therefore cannot be tracked across ads customers' websites. Google provides us with statistical evaluations. Based on these evaluations we can see which of the advertising measures used are particularly effective. We do not receive further data from the use of the advertising media, in particular we cannot identify users based on this information.
The legal basis for the processing of your data is Art. 6(1)(a) GDPR.
In addition to the option in the cookie settings to deselect processing for marketing and analysis purposes, you can prevent this tracking procedure in various ways: a) by an appropriate setting of your browser software, in particular suppressing third-party cookies so that you do not receive ads from third parties; b) by disabling cookies for conversion tracking by setting your browser to block cookies, https://www.google.de/settings/ads, whereby this setting is deleted when you delete your cookies; c) by permanently disabling in your browsers Firefox, Internetexplorer or Google Chrome under the link http://www.google.com/settings/ads/plugin.
Further information about data protection at Google can be found here: http://www.google.com/intl/de/policies/privacy.
ff. Google Customer Match
We use Google Customer Match as part of our Google Ads advertising activities, particularly for remarketing. This enables us to display targeted advertising content to you via the Google Display Network, in Google Search, and on YouTube. For this purpose, your email address encrypted as a hash value is matched with the email address stored with the Google account. As a result of the one-way encryption, Google does not gain access to the actual email addresses. Google does not share the information with third parties, including other advertisers.
The legal basis for the processing of your data is Art. 6(1)(a) GDPR.
You have the option at any time to deselect processing for marketing and analysis purposes in the cookie settings.
Further information about data protection at Google can be found here: http://www.google.com/intl/de/policies/privacy.
IV. Are social plug-ins used?
On the basis of Art. 6 para. 1 lit. f GDPR, we use social plugins on our website for advertising purposes of the social networks Facebook, Pinterest, Instagram and YouTube. Plugins are small programs or extensions used to enable these additional functions.
In order to increase the protection of your data when visiting our website, the plugins are integrated into the site using the so-called '2-click solution'. This integration ensures that when a page of our website that contains such plugins is called up, no connection to the servers of Facebook, Google and Pinterest is made yet. Only when you activate the plugins and thereby give your consent to the transmission of data does your browser establish a direct connection to the servers of Google, Facebook or Pinterest. The content of the respective plugin is then transmitted directly from the provider to your browser and embedded in the page. By integrating the plugins, the providers receive the information that your browser has accessed the relevant page of our website, even if you do not have a profile with the respective provider or are not currently logged in. This information (including your IP address) is transmitted by your browser directly to a server of the respective provider and stored there. If you do not want social networks to collect data about you via our website, you must log out of the social networks before visiting our website.
We have integrated the social plug-ins of the following companies on our website:
Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland; http://www.facebook.com/policy.php; further information on data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications as well as http://www.facebook.com/about/privacy/your-info#everyoneinfo.
Google LLC., 1600 Amphitheater Parkway, Mountain View, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de.
Pinterest Europe Ltd, WeWork, 2 Dublin Landings, N Wall Quay, Dublin 1, D01 V4A3, https://policy.pinterest.com/de/privacy-policy.
V. To which categories of recipients may we disclose your data?
The data we collect is not sold. We disclose the information we receive to third parties exclusively for the following purposes:
Affiliated companies (HABA Group B.V. & Co. KG, HABA Supply Chain GmbH & Co. KG, Habermaass GmbH & Co. KG and, among others, their brands JAKO-O and Wehrfritz) for reconciling the address database on the basis of Article 6(1)(f) GDPR, if they are either subject to this privacy policy or follow policies that provide at least as much protection as this privacy policy.
Processors and vicarious agents: We engage other companies and individuals to perform tasks for us. Examples include, among others, support in organizing events, sending letters or e-mails, maintaining our contact lists, analyzing our databases and advertising activities. These service providers receive from us the personal information about you that is required to perform their tasks. However, they are not allowed to use it for other purposes. In addition, Cloud outsourcing partners or Hosting service providers act as processors for us.
Payment/payment service providers
Shipping service providers
Brand manufacturers and publishers: We enable, within the framework of Article 6(1)(f) GDPR, carefully selected shipping companies, brand manufacturers and publishers and our affiliated companies to send you information and offers as part of promotional postal mailings. For third-party marketing purposes, only such data will be disclosed where this is legally permitted. If you do not wish this, you can object to our use of your data for advertising purposes at any time.
Providers of credit and creditworthiness information
In all other cases we will inform you if personal information is disclosed to third parties.
VI. Is personal data transferred to an international organization or a third country?
We generally do not transfer your data to an international organization.
In the event of a data transfer to recipients located outside the European Union or the European Economic Area (a so-called third country), this is carried out on the basis of the European Commission's so-called standard contractual clauses as an appropriate safeguard to ensure the level of protection of your personal data.
VII. What profiling do we perform?
For the establishment and performance of the business relationship, we do not generally use fully automated decision-making pursuant to Article 22 GDPR.
VIII. What measures are taken to secure my data?
To prevent loss or misuse of the data stored with us, we take extensive technical and organizational security precautions that are regularly reviewed and adapted to technological progress. Among other things, we use SSL (RSA 1024-bit) as encryption and security software, i.e., all your personal data (name, address, credit card number, bank code, account number, etc.) are encrypted and transmitted securely over the Internet. This procedure is used successfully throughout the World Wide Web. You can recognize it by a symbol (closed padlock) in the lower status bar of your browser indicating that you are in the secure area.
IX. How long do we store your data?
As a rule, we anonymize and/or delete your personal data as soon as they are no longer necessary for the purposes mentioned above and insofar as we are not required to retain them by statutory obligations to provide evidence and to keep records (e.g., under the Commercial Code, Fiscal Code).
X. What rights do you have?
The GDPR primarily regulates your rights in Articles 15 to 22. Accordingly, you have at any time the right to information about the data stored concerning you, their origin and recipients, as well as the purpose of storage. In addition, you have the right to request erasure of your data as well as a restriction of processing, the rectification of your data and the transfer of your data in a commonly used machine-readable format. In addition, there is the information about the existence of automated decision-making including profiling pursuant to Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved as well as the scope and the intended effects of such processing concerning you.
Objection or withdrawal against the processing of your data: If you have given consent to the processing of your data, you may withdraw it at any time with effect for the future by contacting the postal or e-mail address listed under section I. Case-specific right to object: To the extent that we base the processing of your personal data on a balancing of interests pursuant to Art. 6(1)(f) GDPR, you may object to the processing. This also applies to profiling based on that provision within the meaning of Art. 4(4) GDPR. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of a justified objection, we will examine the matter and will either stop or adjust the data processing or present to you our compelling legitimate grounds on the basis of which we will continue the processing.
Of course, you can object to the processing of your personal data for purposes of advertising and data analysis at any time; this also applies to profiling insofar as it is connected with such direct marketing. Please direct your objection to advertising to the postal or e-mail address listed under section I.
XI. Which supervisory authority can you contact?
You have the option of contacting the address of the data protection officer named above. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your workplace or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes data protection laws. The supervisory authority responsible for us is:
Bavarian State Office for Data Protection Supervision P.O. Box 606 91511 Ansbach Germany Telephone: +49 (0) 981 53 1300 Fax: +49 (0) 981 53 98 1300 Email: poststelle@lda.bayern.de
If you wish to file a complaint, you can use the supervisory authority's online complaint form (https://www.lda.bayern.de/de/beschwerde.html) to do so.
The free Adobe Reader is required, which can be downloaded here.