Privacy Notice

Responsible for data processing

The responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other legal data protection provisions is:

Contact person / Data protection officer

General information on data processing

Scope of the processing of personal data

We only process personal data of our users insofar as this is necessary to provide a functional website and our content and services.

As a matter of principle, we only process personal data of our users to the extent that this is necessary to provide a functional website and our content and services. The processing of personal data of our users is regularly carried out only with the consent of the user. An exception applies in those cases in which obtaining prior consent is not possible for actual reasons and the processing of the data is permitted by legal regulations.

Legal basis for the processing of personal data

Insofar we obtain consent from the data subject for processing operations involving personal data, Article 6 (1) lit. (a) of the EU General Data Protection Regulation (GDPR) is the legal basis for personal data processing.

When processing personal data that is necessary for the performance of a contract to which the data subject is party, Article 6 (1) lit. (b) GDPR is the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

Insofar as the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6 (1) lit. (c) GDPR is the legal basis.

Where the processing of personal data is necessary in order to protect the vital interests of the data subject or another natural person, the legal basis is Article 6 (1) lit. (d) GDPR.

If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 (1) lit. f DSGVO is the legal basis for the processing.

Provision of the website and creation of log files

Description and scope of data processing

The following data is collected in any case:

• Date of access
• Name of the operating system installed on the accessing device
• Name of the browser used
• Source system via which the access was made
• The IP address of the accessing device

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

Data processing when creating accounts

When creating an account, the so-called “double opt-in” procedure is used. This means that after your registration, we send you an e-mail to the e-mail address you provided, which contains a link that you must call to confirm the creation of this account.

The following data, in addition to the above, is stored when an account is created:

• E-mail address
• Name and first name
• Mobile phone number (if provided)
• Date and time of the times of registration and confirmation

The following data can optionally be provided by you after the account has been created:

• Additional e-mail address(es)
• Salutation and title
• Date of birth
• Additional telephone number(s)
• Postal address(es)
• Security-specific settings (security questions and answers; two-factor authentication)

Each time you log in with an existing account on our website, our system automatically collects further data on the basis of previously mentioned information. The following data is collected during actions in the logged-in state:

• Date of access
• Purpose or action on the website (e.g. changing/re-setting passwords; failed log-on attempts etc.)
• Name of the operating system installed on the accessing device
• Name of the used browser
• Source system via which the access was made
• The IP address of the accessing device, with the last two bytes masked before the first storage (example: 192.168.xxx.xxx). The abbreviated IP address cannot be associated with the accessing computer.
• An estimate of the location of the accessing client based on the IP address

Legal basis for data processing

The legal basis for temporary storage of data and the log files is Article 6 (1) lit. (f) GDPR.

Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. A temporary recording of the actions carried out by the user on our website takes place exclusively for the purpose of traceability for the user himself. An evaluation of the data for other purposes does not take place in this context. The storage in log files is done to ensure the functionality of the website. In addition, the data helps us to optimise the website and to ensure the security of our IT systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes also constitute our legitimate interest in data processing pursuant to Article 6 (1) lit. (f) GDPR.

Retention period

The data is erased as soon as it is no longer required to achieve the purpose which it was collected. In the case of the collection of data for the provision of the website, this is the case when the relevant session has ended. In the case of storage of data in log files, this is the case after seven days at the latest. Further retention beyond this is possible. In this case, the IP addresses of the users are erased or modified so that an assignment of the calling client is no longer possible.

Objection and elimination option

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

Rights of data subjects

You have various rights with regard to the processing of your personal data. We list them in the following, but there are also references to the articles (GDPR) and/or paragraphs (BDSG (2018)) which provide even more detailed information.

Right of access by the data subject (Article 15 GDPR; § 34 BDSG)

You may request confirmation from the controller whether we process personal data related to you. This includes the right to obtain access to information as to whether the personal data concerning you is transferred to a third country or to an international organisation.

Right to rectification (Article 16 GDPR)

You have a right of rectification and / or completion vis-à-vis the controller if the personal data processed related to you is inaccurate or incomplete. The controller must perform rectification immediately.

Right to erasure / “Right to be forgotten” / Right to restriction of processing (Article 17/18 GDPR; § 35 BDSG)

You have the right to request the immediately erase of your personal data from the controller. As an alternative, you may request to restrict the processing from the controller, whereby restrictions are referred to in the GDPR/BDSG under the articles and/or sections mentioned.

Notification obligation regarding rectification or erasure of personal data or restriction of processing (“Right to be informed”) (Article 19 GDPR)

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obligated to communicate such rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

Right to data portability (Article 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. In addition to the scenarios presented in and provisions of the GDPR, it must be noted that portability of mass data / user data is limited to technical readability. The right to data portability does not include that the data created by the user in a proprietary format is converted by the controller into a commonly used, i.e. standardised format.

Right of objection (Article 21 GDPR; § 36 BDSG)

You have the right to object to the processing if this is based only on the controller weighing any interests (see Article 6 (1) lit. (f) GDPR). Right to withdraw consents in terms of data protection laws (Article 7 (3) GDPR) You have the right to withdraw your consent under data protection laws at any time. The withdrawal of consent does not affect the lawfulness of processing based on such consent before its withdrawal.

Right to withdraw consent for data processing (Article 7 (3) GDPR)

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to complain to a supervisory authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.