Data protection statement
I. Name and address of the data controller
The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations, is the:
II. General information with regard to data processing
1. Extent of the processing of personal data
In principle, we process the personal data of our users only insofar as this is necessary to provide a functioning website and our content and services. The processing of the personal data of our users is regularly carried out only with the consent of the user. An exception applies in such cases where the prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law.
2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data owner for the processing operations involved with personal data, Art. 6 para. 1 (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
With regard to the processing of personal data required for the performance of a contract to which the data owner is a party, Art. 6 para. 1 (b) of the GDPR serves as the legal basis. This also applies to any processing operations required to carry out pre-contractual actions.
Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 (c) of the GDPR serves as the legal basis.
If the processing is required to safeguard the legitimate interests of our company or a third party, and the interests, fundamental rights and basic freedoms of the data owner do not outweigh the former interest, then Art. 6 para. 1 (f) of the GDPR serves as the legal basis.
3. Data deletion and duration of storage
The personal data of the data owner will be deleted or blocked as soon as the purpose of the storage no longer applies. In addition, such storage may be provided for by European or national legislative authorities in EU directives, laws or other regulations to which the data controller is subject. Blocking or deletion of the data also takes place whenever a storage period prescribed by the standards mentioned expires, unless there is a requirement for further storage of the data for conclusion of a contract or for fulfilment of the contract.
III. Provision of the website and creation of log files
1. Description and scope of the data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected :
- information about the browser type and version used
- the operating system of the user
- the Internet service provider of the user
- the IP address of the user
- the date and time of the access
- the websites from which the system of the user comes to our website
- the websites which are accessed by the user's system through our website.
The data is also stored in the log files of our system. Storage of this data, together with other personal data of the user, does not take place.
3. Legal basis for the data processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 (f) of the GDPR.
4. Purpose of the data processing
Temporary storage of the IP address by the system is necessary in order to allow delivery of the website to the computer of the user. To serve this purpose, the user's IP address must be kept for the duration of the session.
The storage in log files is carried out in order to ensure the functionality of the website. In addition, the data is used by us to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
For these purposes, our legitimate interest in the data processing is based upon Art. 6 para. 1 (f) of the GDPR.
5. Duration of the storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. Where the collection of data for the preparation of the website is involved, this will apply when the respective session is completed.
Where storage of the data in log files is involved, this will mean after seven days at the latest. An extended storage period is possible. In this case, the IP addresses of the users will be deleted or distorted, so that an assignment of the calling client is no longer possible.
6. Objection and removal options
The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Consequently, the user has no right to file any objection in this regard.
Description and scope of the data processing
2. Legal basis for the data processing
The legal basis for the processing of personal data using cookies is Art. 6 para. 1 (f) of the GDPR.
3. Purpose of the data processing
The user data collected by using the technically necessary cookies will not be used to create user profiles.
The use of the analysis cookies takes place for the purpose of improving the quality of our website and its contents. By using the analysis cookies, we learn how the website is used and so we can constantly optimise our offer. For these purposes, our legitimate interest lies in the processing of personal data according to Art. 6 para. 1 (f) of the GDPR.
4. Duration of the storage, objection and removal options
5. Additional information with regard to Google Analytics
Specifically, we use Google Analytics, a web analytics service provided by Google Inc. (https://www.google.com/intl/en/about/) (1600 Amphitheater Parkway, Mountain View, CA 94043, USA, hereinafter "Google"). The use of Google Analytics is carried out on the basis of Art. 6 para. 1 P. 1 (f) of the GDPR. By using this we want to ensure a customised design and the continuous optimisation of our website. In addition, we use Google Analytics in order to record statistically the use of our website and to evaluate it for the purpose of optimising our offer for you. These interests should be regarded as justified within the meaning of the aforementioned provision.
In this regard, pseudonymised usage profiles are created and cookies (please see point 4) are used. The information generated by the cookie about your use of this website such as
- the browser type/version,
- the operating system used,
- the referrer URL (the previously visited page),
- the host name of the accessing computer (IP address),
- the time of the server request,
are transmitted to a Google server in the US and stored there. The information is used in order to evaluate the usage of the website, to compile reports on website activity and to provide other services related to website activity and internet usage for the purposes of market research and creating a customised design for this website. This information may where necessary also be transferred to third parties if required by law, or if third parties process this data in the order. Under no circumstances will your IP address be merged with any other data provided by Google. The IP addresses are anonymised, so that their assignment is not possible (IP masking).
You can prevent the installation of cookies by setting your browser software accordingly; however, we would like to point out that in this case not all the functions of this website may be fully exploited.
You may also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google, by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de).
As an alternative to the browser add-on, especially for browsers on mobile devices, you can prevent the collection by Google Analytics by clicking on this link: Disable Google Analytics
An opt-out cookie will be set which will prevent the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must reset the opt-out cookie.
For more information about data protection in connection with Google Analytics, please see the Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=de).
V. Use of social media plug-ins
We are currently using the following social media plug-ins: Facebook, Google+, YouTube. Here we use the so-called two-click solution. That means, when you visit our site, no personal data is initially passed on to the providers of the plug-ins. You can identify the provider of the plug-in by the marking on the box above its initial letter or logo. We give you the option to communicate directly with the provider of the plug-in via the button. Only if you click on the marked field and enable it will the plug-in provider receive the information that you have accessed the appropriate website for our online service. In addition, the data mentioned in section III of this statement is transmitted. Where Facebook and YouTube are concerned, the IP address is anonymised immediately after collection in accordance with the respective providers in Germany. By enabling the plug-in, personal data will be transmitted by you to the respective plug-in provider and stored there (with American providers in the USA). Since the plug-in provider carries out the data collection, in particular via cookies, we recommend that you to delete all cookies before clicking on the greyed-out box via the security settings of your browser.
We have no influence upon the collected data and data processing operations, nor are we aware of the full extent of any data collection, the purposes of the processing, or the retention periods. We also have no information with regard to the deletion of the data collected by the plug-in provider.
The plug-in provider stores the data collected about you as usage profiles and uses them for purposes of advertising, market research and/or customised website design. Such an evaluation is carried out in particular (also for non-logged-in users) for the presentation of customised advertising and in order to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To this end you must contact the respective plug-in provider to exercise it. By using the plug-ins, we offer you the option to interact with the social networks and other users, so that we can improve our offer and make it more interesting for you as a user. The legal basis for the use of plug-ins is Art. 6 para. 1 P. 1 (f) of the GDPR.
The data transfer takes place regardless of whether you have an account with the plug-in provider and are logged on to them. If you are logged on to the plug-in provider, your data collected from us will be assigned directly to your existing account with the plug-in provider. If you press the enabling button and, for example, if you link to the site, the plug-in provider also stores this information in your user account and shares it publicly with your contacts. We recommend you to log out regularly after using a social network, but especially before enabling the button, as this will prevent you from being assigned to your profile with the plug-in provider.
For more information on the purpose and scope of the data collection and its processing by the plug-in provider, please refer to the data protection statements of these providers below. There you will also find further information about your rights and settings options for the protection of your privacy.
Addresses of the respective plug-in providers and URL with their data protection notices:
- Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php; further information with regard to the data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook has committed itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
- Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de. Google has committed itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
- YouTube LLC., 901 Cherry Ave, San Bruno, California 94066, USA; https://policies.google.com/privacy?hl=de&gl=de
VI. Contact form and email contact
1. Description and scope of the data processing
On our website, a contact form is available, which can be used for making contact by electronic mail. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored. This data is:
Name, telephone number, country, email address, subject matter, message content, message language, date and time of the message.
For the processing of the data within the scope of the sending process, your consent is obtained and referred to this data protection statement.
Alternatively, making contact is possible by using the email address provided. In this event, the user's personal data transmitted by email will be stored. In this regard, there is no disclosure of the data to third parties. The data is used exclusively for processing the conversation.
2. The legal basis for the data processing
The legal basis for the processing of the data is the existence of the consent of the user in accordance with Art. 6 para. 1 (a) of the GDPR.
The legal basis for the processing of the data transmitted in the course of sending an email is Art. 6 para. 1 (f) of the GDPR. If the email contact aims to conclude a contract, then the additional legal basis for the processing can be found in Art. 6 para. 1 (b) of the GDPR.
3. Purpose of the data processing
The processing of the personal data from the input mask is used by us only for the processing of the contact information. In the event of any contact via email, this also includes the required legitimate interest in the processing of the data. The other personal data processed during the sending process serves to prevent any misuse of the contact form and to ensure the security of our information technology systems.
4. Duration of the storage
The data will be deleted as soon as it is no longer required for the purpose of its collection. For the personal data from the input form of the contact form and that sent by email, this will occur when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.
The additional personal data collected during the sending process will be deleted at the latest after a period of seven days.
5. Objection and removal options
The user has the possibility to revoke their consent to the processing of the personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot continue.
All personal data stored in the course of establishing contact will be deleted in this case.
VII. Integration of Google Maps
We use the map service Google Maps. The provider is Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter “Google”). The use of Google Maps allows for an attractive presentation of our online offers and the possibility to find quickly the places which we have indicated on the website. This represents a legitimate interest within the meaning of Art. 6 para. 1 (f) of the GDPR.
In order to use the Google Maps features, it is necessary to store your IP address. The information is usually transmitted to a Google server in the US and stored there. The provider of this site has no influence on this data transfer.
Data processing takes place regardless of whether Google provides a user account onto which you are logged, or if there is no user account. When you are logged on to Google, your data will be assigned directly to your account. If you do not wish to be assigned to your profile on Google, you must log out before enabling the button. Google stores your data as usage profiles and uses them for purposes of advertising, market research and/or the customised design of its website. Such evaluation will be carried out in particular (even for users who are not logged on) in order to provide appropriate advertising and to inform other users about your activities on our website. You have a right to object to the creation of these user profiles, and Google must comply with this accordingly.
Further information regarding the purpose and the extent of the data collection and its processing can be found in the data protection statements of the provider. There you will also find further information about your rights and settings options for the protection of your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal information in the US and has committed itself to the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.
VII. Rights of the data owner
If your personal data is processed, you are the data owner within the terms of the GDPR and you have the following rights with regard to the data controller:
1. Right to information
You may request confirmation from the data controller as to whether personal information relating to you is being processed by us.
If such processing is available, you may request information from the data controller using the following information:
- the purposes for which the personal data is processed;
- the categories of personal data which are processed;
- the recipients or categories of recipients to whom the personal data relating to you has been or will be disclosed;
- the planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;
- the existence of a right to rectification or deletion of personal data relating to you, a right to restriction of processing by the data controller or a right to object to such processing;
- the existence of a right of appeal to a supervisory authority;
- all available information about the origin of the data, if the personal data is not collected from the data owner;
- the existence of automated decision-making including profiling in accordance with Art. 22 para. 1 and 4 of the GDPR and – at least in these cases – meaningful information about the logic involved, and the portability and intended impact of such processing with regard to the data owner.
You have the right to request information about whether your personal information will be transmitted to a third country or to an international organisation. In this connection, you may request the appropriate guarantees in accordance with Art. 46 of the GDPR in connection with the transmission.
2. Right to rectification
You have a right to rectification and/or completion with respect to the data controller, if the processed personal data relating to you is incorrect or incomplete. The data controller must make the correction immediately.
3. Right to restriction of the processing
You may request the restriction of the processing of your personal data under the following conditions:
If the processing of personal data relating to you has been restricted, this data may only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest with regard to the Union or a member state.
- if you deny the accuracy of your personal information for a period of time sufficient enough t to allow the data controller to verify the accuracy of your personal information;
- the processing is unlawful and you refuse to delete the personal data and instead demand the restriction of the use of personal data;
- the data controller no longer needs your personal information for processing purposes, but you need it to enforce, exercise or defend your legal rights, or
- if you have filed an objection against the processing in accordance with Art. 21 para. 1 of the GDPR, and it is not yet certain whether the legitimate reasons of the data controller outweigh your reasons.
If the limitation of the processing according to the aforementioned conditions are restricted, you will be informed by the data controller before the restriction is lifted.
4. Right to deletion
a. Deletion obligations
You may require the data controller to delete immediately your personal information, and the data controller is obliged to delete promptly that information for any of the following reasons:
- Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
- You revoke your consent to the processing supported in accordance with Art. 6 para. 1 (a) of the GDPR or Art. 9 para. 2 (a) of the GDPR and there is no other legal basis for the processing.
- You file an objection against the processing in accordance with Art. 21 para. 1 of the GDPR and there are no legitimate reasons for the processing, or you file an objection against the processing in accordance with Art. 21 para. 2 of the GDPR.
- Your personal data has been processed unlawfully.
- The deletion of personal data relating to you is required for the fulfilment of a legal obligation under the law of the EU or the member state to which the data controller is subject.
- The personal data relating to you has been collected in relation to information society services offered in accordance with Art. 8 para. 1 of the GDPR.
b. Information to third parties
If the data controller has made the personal data relating to you public and is, in accordance with Art. 17 para. 1 of the GDPR, obliged to delete it, taking into account the available technology and the implementation costs, it will take appropriate measures, including technical means, so as to inform the data processors responsible for the personal data that you, as the data owner, have requested the deletion of any links to such personal data or copies or replications of such personal data.
The right to erasure does not exist if the processing is required
- to exercise the right to freedom of expression and information;
- to fulfil a legal obligation required by the law of the Union or of the member states to which the data controller is subject, or to perform a task of public interest or in the exercise of public authority delegated to the data controller;
- for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 (h) and (i) and Art. 9 para. 3 of the GDPR;
- for archival purposes relating to the public interest, for scientific or historical research purposes, or for statistical purposes in accordance with Art. 89 para. 1 of the GDPR, to the extent that the law referred to in section (a) is likely to render impossible or seriously prejudice the achievement of the objectives of that processing, or
- to assert, exercise or defend legal claims.
5. Right to information
If you have asserted the right to rectification, deletion or restriction of processing to the data controller, it is obliged to notify all recipients, to whom your personal data have been disclosed, with regard to this rectification or deletion of the data or this restriction of processing, unless this proves to be impossible or involves a disproportionate effort.
You have the right to be informed about these recipients by the data controller.
6. Right to data portability
You have the right to receive the personally identifiable information, which you have provided to the data controller, in a structured, common and machine-readable format. In addition, you have the right to transmit this data to another data controller without interference from the data controller to which the personal data was provided, insofar as
- the processing is based upon consent in accordance with Art. 6 para. 1 (a) of the GDPR or Art. 9 para. 2 (a) of the GDPR or upon a contract in accordance with Art. 6 para. 1 (b) of the GDPR and
- the processing is carried out using automated procedures.
In exercising this right, you also have the right to ensure that personal data relating to you is transmitted directly from one data controller to another data controller, insofar as this is technically feasible. Freedoms and rights of other persons may not be affected.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task which is in the public interest or in the exercise of official authority which has been transferred to the data controller.
7. Right to object
You have the right at any time, for reasons which arise from your particular situation, to file an objection against the processing of your personal data, which is carried out in accordance with Art. 6 para. 1 (e) or (f) of the GDPR; this also applies to profiling based on these provisions.
The data controller may no longer process the personal data relating to you unless it can demonstrate compelling legitimate reasons for processing which outweigh your interests, rights and freedoms, or if the processing is intended to assert, exercise or defend legal claims.
If the personal data relating to you is processed in order to operate direct mail, you have the right to object at any time to the processing of your personal data for the purposes of such advertising; this also applies to profiling insofar as it is associated with such direct mail.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
Regardless of Directive 2002/58/EC, you have the option, in the context of the use of information society services, to exercise your right to object by means of automated procedures with which technical specifications are used.
8. Right to revoke the data protection consent declaration
You have the right to revoke your data protection declaration at any time. The revocation of consent does not affect the legality of the processing previously carried out upon the basis of the consent before the revocation was made.
9. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority, in particular in the member state of your residence, place of work or the place of alleged infringement, if you believe that the processing of the personal data relating to you violates the GDPR.
The supervisory authority to which the complaint has been submitted will inform the plaintiff of the status and findings related to the complaint, including the possibility of a judicial remedy in accordance with Art. 78 of the GDPR.