Privacy policy

The privacy policy for the website http://qneurope.fr can be found below.

is controller for data processing is

QN Europe Deutschland GmbH 
Neuhofstraße 9 
D-64625 Bensheim 
Phone: +49 (6251) 98916-40

Our data protection officer is

Thilo Noack 
SBS DATA PROTECT GmbH 
Hans-Henny-Jahnn-Weg 49 
22085 Hamburg

For the assertion of rights in the context of data protection or for questions regarding the use, collection or processing of your personal data, please contact:

dataprotection.qn@qneurope.com.

Security and protection of your personal data

We consider it our primary task to maintain the confidentiality of the personal data you provide and to protect it from unauthorised access.

As a company under private law, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the provisions of the German Federal Data Protection Act (BDSG). We have taken technical and organisational measures to ensure that both we and our external service providers comply with data protection regulations.

Definitions

The legislator requires that personal data be processed lawfully, fairly and in a manner that is comprehensible to the data subject (“lawfulness, fairness and transparency”). To ensure this, we inform you about the individual legal definitions that are also used in this data protection notice:

Personal data

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing

“Restriction of processing” is the marking of stored personal data with the aim of restricting its future processing.

Profiling

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation

“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

File system

“File system” means any structured collection of personal data that is accessible according to specific criteria, regardless of whether this collection is organised centrally, decentrally or according to functional or geographical aspects.

Controller

“Controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Receiver

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular enquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

Third party

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent

“Consent” of the data subject is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Lawfulness of the processing

The processing of personal data is only lawful if there is a legal basis for the processing. The legal basis for processing may be in particular in accordance with Article 6 (1) (a) – (f) GDPR:

1. The data subject has given their consent to the processing of their personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Information on the collection of personal data

In the following, we provide information about the collection of personal data when using our website. Personal data are e.g. name, address, e-mail addresses, user behaviour.

Collection of personal data when visiting our website

If you use the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:

• IP address
• Date and time of the enquiry
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software

After a technical evaluation, this data is deleted immediately. This data collection serves to safeguard our legitimate interests in the correct presentation of our website offer, which are overriding in the context of a balancing of interests, as well as compliance with the EU General Data Protection Regulation in terms of security and confidentiality in accordance with Art. 6 para. 1 lit. f) GDPR.

Contact us

If you contact us by e-mail or via our contact form, the data you provide (your e-mail address, your name and telephone number if applicable) will be stored by us in order to answer your questions. The legal basis for this is Art. 6 para. 1 lit. a) GDPR. We delete the data collected in this context after storage is no longer necessary, e.g. when your request has been dealt with. Otherwise, processing will be restricted if there are statutory retention obligations. In the event of a contract initiation from the establishment of contact, we process the data in accordance with the legal basis Art. 6 para. 1 lit. b) GDPR.

Notification via WhatsApp

We use the WhatsApp service to send messages to our customers. The provider of the service is Meta Platforms Ireland Limited, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland. When you place an order on our website, we ask you to tick a box to give your consent for us to notify you of the order status via WhatsApp. The purpose of this is to provide you as a customer with a better overview of the status of your order.

The following data is processed when you use WhatsApp:

• Registration data, such as profile name and mobile phone number
• Telephone numbers in the mobile phone address book
• Usage and log information (information on the use of the service)
• Transaction data (e.g. payment receipts)
• Connection data, such as details of the mobile phone network,
• Connection and device information, such as operating system, device ID, device location (if location functions are used), mobile phone or internet provider, browser type, IP address, browser type
• Status information (“Last online” status)
• Order number

Processing will only take place if you have given us your consent to do so. The legal basis for this processing is Art. 6 para. 1 lit. a) GDPR.

In this context, we ourselves are only a user of the service and the functions provided by WhatsApp. We have no influence whatsoever on WhatsApp’s terms and conditions. This also and especially applies to the data protection conditions associated with the use of WhatsApp. If you contact us via WhatsApp, this means that not only we come into contact with all personal data that you disclose in this context, but also WhatsApp.

We also have no influence on the type and scope of the data processed by the provider, the type of processing and use or the transfer of this data to third parties, in particular to countries outside the European Union where an adequate level of data protection cannot be guaranteed.

We use technical and organisational measures to ensure the security of your data. WhatsApp uses end-to-end encryption.

Further information on data protection at WhatsApp can be found at the following link: https://www.whatsapp.com/legal/#privacy-policy .

QN Europe Partner Account

When you open a partner account, the data you provide will be stored and processed by us for contractual purposes. We delete the data arising in this context after storage is no longer required. Otherwise, processing will be restricted due to statutory retention obligations.

The processing is carried out on the basis of Art. 6 para. 1 lit. b) GDPR

Virtual office for sales partners

When you use our Virtual Office, we collect your personal data to the extent specified there. The processing is carried out on the basis of Art. 6 para. 1 lit. b) GDPR. You can close your sales partner account at any time by notifying us; your account will then be deleted. All data that is relevant under tax law is excluded from deletion, as a retention period of 10 years is required by law in this regard.

Art. 6 para. 1 lit. b) GDPR serves as the legal basis.

Data collection and processing for payments by Novalnet

The controller has integrated components of Novalnet AG (Novalnet AG, Feringastr. 4, 85774 Unterföhring (“Novalnet AG”)) into the website.

Novalnet is a full payment service provider that handles payment processing, among other things. If the data subject selects a payment method during the ordering process in the online shop, the data subject’s data is automatically transmitted to Novalnet. By selecting a payment option, the data subject consents to the transfer of personal data for payment processing. The transmission of your data to Novalnet is based on Art. 6 para. 1 lit. a) GDPR (consent) and Art. 6 para. 1 lit. b) GDPR (processing for the fulfilment of a contract).

The personal data transmitted to Novalnet is usually first name, surname, address, gender, email address, IP address and, if applicable, date of birth, telephone number, mobile phone number and other data required for payment processing. The personal data associated with the respective order is also required for the processing of the purchase contract. In particular, there may be a mutual exchange of payment information, such as bank details, card number, expiry date and CVC code, details of goods and services, prices.

The transmission of data serves in particular to verify identity, process payments and prevent fraud. The controller will transfer personal data to Novalnet in particular if there is a legitimate interest in the transfer. The personal data exchanged between Novalnet and the controller may be transmitted by Novalnet to credit agencies. The purpose of this transfer is to check identity and creditworthiness.

Novalnet also passes on personal data to service providers or subcontractors if this is necessary for the fulfilment of contractual obligations or if the data is to be processed.

The data subject has the option to withdraw their consent to the processing of personal data from Novalnet at any time. A revocation does not affect personal data that must be processed, used or transmitted for (contractual) payment processing.

http://www.novalnet.de/novalnet-Datenschutz.

Other payment methods

Data collection and processing for “payment on account” or “payment by SEPA direct debit” via InfinitePay.

For the payment methods “payment on account” or “SEPA direct debit” processed by InfinitePay, the purchase price claim is assigned to Financial Management Solutions GmbH (trading as “InfinitePay”), Haifa-Allee 28, 55128 Mainz, Germany (hereinafter “InfinitePay”). The data required for the processing of payments will be transmitted to InfinitePay. One of the main purposes of the data transfer is to enable InfinitePay to carry out an identity and credit check in order to process your purchase using the means of payment you have selected.

The processing is carried out on the basis of Art. 6 para. 1 lit. f) GDPR due to the legitimate interest in offering various payment methods and the legitimate interest in protection against payment defaults. You have the right to object to this processing of your personal data at any time for reasons arising from your particular situation, which is based on Art. 6 para. 1 lit. f) GDPR, by notifying us.

You can find InfinitePay’s privacy policy here: https://www.infinitepay.de/datenschutzhinweise

If you would like information about the use of your personal data, you can contact datenschutz@fms-mainz.de at any time.

The provision of the data is necessary for the conclusion of the contract with the payment methods you have selected. Failure to provide the data means that the contract cannot be concluded with the payment methods you have requested.

Cookie Consent Tool

We use the Borlabs cookie consent tool to obtain effective user consent for cookies and cookie-based applications that require consent. By integrating this tool, a banner is displayed to users when they access the page, in which consent for certain cookies and/or cookie-based applications can be given by ticking the box. The tool blocks the setting of all cookies requiring consent until the respective user gives their consent by ticking the box. This ensures that such cookies are only set on your end device if you have given your consent. So that the cookie consent tool can clearly assign page views to individual users and individually record, log and store the consent settings you have made for a session duration, certain user information (including the IP address) is collected when our website is accessed by the cookie consent tool, transmitted to the server of the cookie consent tool provider and stored there. This data processing is carried out in accordance with Art. 6 para. 1 lit. f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website. Another legal basis for the data processing described is Art. 6 para. 1 lit. c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.

By using our website, information (e.g. IP address) may be accessed or information (e.g. cookies) may be stored in your end devices. This access or storage may involve further processing of personal data within the meaning of the GDPR.

In cases in which such access to information or such storage of information is absolutely necessary for the technically error-free provision of our services, this is done on the basis of § 25 TDDDG (Telecommunications Digital Services Data Protection Act) 

German Telecommunications Digital Services Data Protection Act (TDDDG)

The legal basis for the storage and retrieval of information in the end user’s terminal equipment is consent in accordance with Section 25 TDDDG. This consent is requested when the website is accessed.

According to Section 25 TDDDG, consent is not required if the storage of information in the end user’s terminal equipment or access to information already stored in the end user’s terminal equipment is absolutely necessary so that the provider of a telemedia service can provide a telemedia service expressly requested by the user. You can see from the cookie settings which cookies are to be classified as absolutely necessary (often also referred to as “technically necessary cookies”) and therefore fall under the exemption rule of Section 25 (2) TDDDGG and therefore do not require consent.

Please note that the legal basis for the downstream processing of personal data is then derived from the GDPR. The relevant legal bases for the processing of personal data on this website can be found further on in this privacy policy.

Use of cookies

In addition to the aforementioned data, cookies or similar technologies such as pixels (hereinafter generally referred to as “cookies”) are used on your computer when you use and visit our website. Cookies are either small databases that are stored by your browser on your end device to store certain information, or image files such as pixels. The next time you visit our website with the same end device, the information stored in cookies is subsequently sent back either to our website (“first party cookie”) or to another website to which the cookie belongs (“third party cookie”).

The stored and returned information enables the respective website to recognise that you have already accessed and visited it with the browser on your end device. We use this information to optimise the design and display of the website according to your preferences. Only the cookie itself is identified on your end device. Any further storage of personal data will only take place with your express consent or if this is absolutely necessary in order to be able to use the service offered and accessed by you accordingly.

This website uses the following types of cookies, the scope and function of which are explained below:

• Strictly necessary cookies (type a)
• Functional and performance cookies (type b)
• Cookies requiring consent (type c)

Strictly necessary cookies (type a)

Strictly necessary cookies guarantee functions without which you cannot use our websites as intended. These cookies are used exclusively by us and are therefore first party cookies. This means that all information stored in the cookies is sent back to our website.

Strictly necessary cookies are used, for example, to ensure that you as a registered user always remain logged in when accessing various subpages of our website and therefore do not have to re-enter your login details each time you access a new page.

The use of strictly necessary cookies on our website is possible without your consent. For this reason, strictly necessary cookies cannot be deactivated or activated individually. However, you have the option of generally deactivating cookies in your browser at any time (see below).

Functional and performance cookies (type b)

Functional cookies enable our website to save information you have already entered (e.g. registered name or language selection) and to offer you improved and more personalised functions based on this. These cookies only collect and store anonymised information so that they cannot track your movements on other websites.

Performance cookies collect information about how our websites are used in order to improve their attractiveness, content and functionality. These cookies help us, for example, to determine whether and which subpages of our website are visited and what content users are particularly interested in. In particular, we record the number of visits to a page, the number of subpages accessed, the time spent on our website, the order of the pages visited, which search terms led you to us, the country, region and, if applicable, the city from which the access is made, as well as the proportion of mobile devices that access our websites. We also record movements, “clicks” and scrolling with the computer mouse in order to understand which areas of our website are of particular interest to users. As a result, we can tailor the content of our website more specifically to the needs of our users and optimise our offering. The IP address of your computer transmitted for technical reasons is automatically anonymised and does not allow us to draw any conclusions about the individual user.

You can object to the use of functional and performance cookies at any time by adjusting your cookie settings accordingly.
Legal basis: Art. 6 para. 1 lit. f) GDPR

Cookies requiring consent (type c)

Cookies that are neither absolutely necessary (type a) nor functional or performance cookies (type b) are only used after you have given your consent.

We also reserve the right to use information that we have obtained by means of cookies from an anonymised analysis of the usage behaviour of visitors to our websites in order to show you specific advertising for certain of our products on our own websites. We believe that you as a user benefit from this because we display advertising or content that we assume, based on your surfing behaviour, matches your interests and you are therefore shown less random advertising or certain content that may be of less interest to you.

Marketing cookies originate from external advertising companies (third party cookies) and are used to collect information about the websites visited by the user in order to create targeted advertising for the user.

Legal basis: Art. 6 para. 1 lit. a) GDPR

Opt-out for marketing cookies

You can also manage cookies used for online advertising via the tools developed in many countries as part of self-regulation programmes, such as https://www.aboutads.info/choices/oder, which is based in the USA, and http://www.youronlinechoices.com/uk/your-ad-choices , which is based in the EU.

Legal basis: Art. 6 para. 1 lit. a) GDPR

Management and deletion of all cookies

In addition, you can set your Internet browser so that the storage of cookies on your end device is generally prevented or you are asked each time whether you agree to the setting of cookies. Once cookies have been set, you can also delete them at any time. You can find out how all this works in detail in the help function of your browser.

We use the following cookies described here for the following purposes:

Google Analytics 4 (GA4)

This website uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which can be used to analyse the use of websites.

When using Google Analytics 4, so-called “cookies” are used. Cookies are databases that are stored on your end device and enable your use of a website to be analysed. The information collected by cookies about your use of the website (including the IP address transmitted by your device, shortened by the last digits, see below) is usually transmitted to a Google server, where it is stored and processed. This may also result in information being transmitted to the servers of Google LLC, based in the USA, where it is processed further. GA4 also offers server-side tracking, which enables us to pseudonymise user data on our own server before transmitting it to Google.

When using Google Analytics 4, the IP address transmitted by your end device when using the website is automatically collected and processed only in a pseudonymised manner, so that the information collected cannot be directly linked to a person. This automatic pseudonymisation takes place by Google truncating the IP address transmitted by your device within member states of the European Union (EU) or other signatory states to the Agreement on the European Economic Area (EEA).

Google uses this and other information on our behalf to evaluate your use of the website, to compile reports on your website activity and usage behaviour and to provide us with other services relating to your use of the website and the Internet. The abbreviated IP address transmitted by your device as part of Google Analytics 4 will not be merged with other Google data. The data collected as part of the use of Google Analytics 4 is stored for 2 months and then deleted.

Google Analytics 4 enables us to recognise the so-called “demographic characteristics” of a user via browser fingerprints. This enables us to analyse cross-device information about the age, gender and interests of website users on the basis of an analysis of interest-based advertising and with the help of third-party information. This makes it possible to determine and differentiate between user groups of the website for the purpose of target group-optimised marketing measures. However, data collected via the “demographic characteristics” cannot be assigned to a specific person and therefore not to you personally. This data collected via the “demographic characteristics” function is stored for two months and then deleted.

All processing described above, in particular the setting of Google Analytics cookies for the storage and reading of information on the terminal device used by you for the use of the website, will only take place if you have given us your express consent to do so in accordance with Art. 6 para. 1 lit. a) GDPR. Without your consent, Google Analytics 4 will not be used during your use of the website. You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service using the “cookie consent tool” provided on the website.

We have concluded a so-called order processing contract with Google for our use of Google Analytics 4, which obliges Google to protect the data of our website users and not to pass it on to third parties.

In order to ensure compliance with the European level of data protection even in the event of a data transfer from the EU or the EEA to the USA and possible further processing there, the provider has certified itself for the Trans Atlantic Data Privacy Framework. You can view the certification under the following link: https://www.dataprivacyframework.gov/s/participant-search

Further legal information on Google Analytics 4 can be found at https://policies.google.com/privacy?hl=de&gl=deund at https://policies.google.com/technologies/partner-sites .

Google Tag Manager

The Google Tag Manager allows marketers to manage website tags via an interface. However, the Tag Manager itself, which uses the tags, works without cookies and does not collect any personal data. The Tag Manager merely triggers other tags. Corresponding explanations for these respective third-party providers can be found in this privacy policy. However, the Google Tag Manager does not use this data. If you have set or otherwise deactivated cookies, this will be taken into account for all tracking tags used with Google Tag Manager, i.e. the tool will not change your cookie settings.

The legal basis is Art. 6 para. 1 lit. a) GDPR

Campaign Manager 360 (formerly Doubleklick)

We use the Campaign Manager 360 service on our website, which is an online marketing tool from Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland (hereinafter referred to as “Google”).

We use the tool for marketing and optimisation purposes, in particular to display ads that are relevant and interesting to you, to improve campaign performance reports or to prevent you from seeing the same ads more than once.

Among other things, the Campaign Manager 360 service uses cookies, i.e. small databases that are stored locally in the cache of your web browser on your end device. Google uses a cookie ID to record which adverts are displayed in which web browser. This prevents adverts from being displayed more than once. Search Ads 360 can also use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, if you see a Campaign Manager 360 advert and later visit the advertiser’s website using the same web browser and make a purchase there.

According to Google, the aforementioned cookies do not contain any personal data. By using the tool, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of Campaign Manager 360. To the best of our knowledge, Google receives the information that you have accessed the relevant part of our website or clicked on one of our adverts. If you have a user account with Google and are registered, Google can assign the visit to your user account. Even if you are not registered with Google or have not logged in, it is possible that Google will find out your IP address and save it.

Art. 6 para. 1 sentence 1 lit. a) GDPR serves as the legal basis.

In order to ensure compliance with the European level of data protection even in the event of a data transfer from the EU or the EEA to the USA and possible further processing there, the provider has certified itself for the Trans Atlantic Data Privacy Framework. You can view the certification under the following link: https://www.dataprivacyframework.gov/s/participant-search

Further information on the use of data by Google, on setting and objection options and on data protection can be found on the following Google website: https://policies.google.com/privacy?hl=de&gl=de

SocailMedia:

Facebook fan page

We have integrated a component of the Facebook service on our website, which is a link to our Facebook fan page. We use the technical platform of Meta Platforms Ireland Limited, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland (hereinafter: Facebook) for the information service offered here.

According to the ECJ, there is joint responsibility within the meaning of Art. 26 GDPR between Facebook and the operator of a Facebook fan page for the personal data processed via the Facebook fan page. For this reason, we have concluded an agreement with Facebook on joint responsibility.

When you access a Facebook fan page, the IP address of your end device is transmitted to Facebook. According to Facebook, this IP address is anonymised and deleted after 90 days, at least if it is a German IP address. In addition, Facebook stores further information about the end devices of its users, e.g. the Internet browser used. This may enable Facebook to assign IP addresses to individual users. If you are logged into your Facebook account while visiting our fan page, a cookie with your Facebook ID will be stored on your device. This cookie enables Facebook to recognise that you have visited our fan page and how you have used it. Facebook uses this information to present you with customised content or advertising. If you do not want this, you should log out of your Facebook account or deactivate the “stay logged in” function. We also recommend deleting the cookies on your device and closing and restarting your browser. This process deletes Facebook information that Facebook can use to establish a link to you. However, if you wish to use the interactive functions of our fan page, you will have to log in to Facebook again using your Facebook login information. This will also allow Facebook to create a link to you again. Facebook does not conclusively and clearly state how it uses the data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are assigned to individual users, how long Facebook stores this data and whether data from a visit to the Facebook page is passed on to third parties, and we are not aware of this. In this respect, we can only refer you as a user of our fan page to Facebook’s information on data protection. The data collected about you in this context is processed by Facebook and may be transferred to countries outside the European Union.

Facebook describes in general terms what information Facebook receives and how it is used in its data usage guidelines. There you will also find information on how to contact Facebook and the settings options for adverts. The data usage guidelines are available at the following link: http://de-de.facebook.com/about/privacy . Objection options (so-called opt-out) can be set here: https://www.facebook.com/settings?tab=ads and here http://www.youronlinechoices.com

The provider has signed the standard contractual clauses of the prevailing EU data protection regulations https://ec.europa.eu/info/law/law-topic/data-protection/publications/standard-contractual-clauses-controllers-and-processors .

Insight function

Facebook also provides a range of statistical data for fan page operators as part of the “Insights” function. These statistics are generated and provided by Facebook. As the operator of the fan page, we have no influence on the generation of this data and, in particular, we cannot prevent this function. As part of the “Insights” function, we are shown the following information for the categories “fans”, “subscribers”, “people reached” and “people interacting” for a selectable period of time: Page activities such as page views, page previews, actions on the page; reach activities such as “likes”, people reached and recommendations, post activities such as post interactions, video views, comments, shared content. In addition, we are provided with statistical information about the Facebook groups that are linked to our fan page. In accordance with the Facebook terms of use, which every user has agreed to when creating a Facebook profile, we can also identify the subscribers and fans of the page and view their profiles and other information shared by them. Facebook provides more information on this at the following link: http://de-de.facebook.com/help/pages/insights.

We use this data, which is available in aggregated form, to make posts and activities on the fan page more attractive to users, e.g. to plan the content and timing of posts.

We store the information transmitted by Facebook at most for as long as your interest in deletion or anonymisation does not prevail. If you no longer wish the data processing described here to take place in the future, please remove the link between your user profile and our fan page by using the functions “I no longer like this page” and/or “No longer subscribe to this page”.

We recommend that you address any requests for information or other questions regarding your rights listed at the end of this privacy policy directly to Facebook, as only Facebook has full access to user data. Should you nevertheless address your enquiry to us, it will of course still be processed and also forwarded to Facebook.

To protect your rights and personal data, we have integrated Facebook with a so-called two-click solution, which only transmits data to Meta after you have explicitly activated the function.
Legal basis: Art. 6 para. a) GDPR.

Instagram

We have integrated a component of the Instagram service on our website. Instagram is a service that qualifies as an audiovisual platform and enables users to share photos and videos and also to redistribute such data in other social networks.

The operating company of the Instagram services is Meta Platforms Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.

With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which an Instagram component (Insta button) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to the download of a display of the corresponding Instagram component of Instagram. During the course of this technical procedure, Instagram is made aware of what specific sub-page of our website was visited by the data subject.

If the data subject is logged in to Instagram at the same time, Instagram recognises which specific sub-page the data subject is visiting each time the data subject accesses our website and for the entire duration of their stay on our website. This information is collected by the Instagram component and assigned by Instagram to the respective Instagram account of the data subject. If the data subject clicks on one of the Instagram buttons integrated on our website, the data and information transmitted with it is assigned to the personal Instagram user account of the data subject and stored and processed by Instagram.

Instagram always receives information via the Instagram component that the data subject has visited our website if the data subject is logged in to Instagram at the same time as accessing our website; this takes place regardless of whether the data subject clicks on the Instagram component or not. If the data subject does not want this information to be transmitted to Instagram in this way, they can prevent the transmission by logging out of their Instagram account before accessing our website.

Further information and the applicable data protection provisions of Instagram can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

To protect your rights and personal data, we have integrated Instagram with a so-called two-click solution, which only transmits data to Meta after you have explicitly activated the function.
Legal basis: Art. 6 para. a) GDPR.

Registration

When you register on our website, we collect your personal data to the extent specified there. The processing takes place on the basis of Art. 6 para. 1 lit. b) GDPR. You can close your account at any time by notifying us; your account will then be deleted. All data that is relevant under tax law is excluded from deletion, as a retention period of 10 years is required by law in this regard.

Other processing purposes

Some laws and regulations may require the collection and processing of personal data (e.g. tax laws, commercial laws, trade and export regulations, anti-money laundering laws, other compliance obligations). If such legal obligations are based on laws and regulations of the EU or EU member states, the legal basis for the processing of personal data is Article 6 para. 1 sentence 1 lit. c) GDPR. If such legal obligations are based on laws and regulations of third countries (non-EU), compliance with these legal obligations may constitute a legitimate interest. In this case, the legal basis for the processing of personal data is Article 6(1)(1)(f) GDPR. The latter also applies to the processing of personal data for the purpose of complying with our guidelines, codes of conduct and regulations.

Enforcement of rights: We also process your personal data in order to assert our rights and enforce our legal claims. We also process your personal data in order to be able to defend ourselves against legal claims. Finally, we process your personal data insofar as this is necessary to prevent or prosecute criminal offences. In this context, we process your personal data to protect our legitimate interests in accordance with Article 6 (1) sentence 1 lit. f) GDPR (legal basis), insofar as we assert legal claims or defend ourselves in legal disputes or we prevent or investigate criminal offences (legitimate interest).

Consent: If you have given us your consent to process personal data for certain purposes (e.g. sending information material and offers, support with payment processing), the lawfulness of this processing is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR (legal basis). You can withdraw your consent at any time. Please note that the revocation is only effective for the future and does not affect the processing until then.

Duration of processing

We only process your data for as long as is necessary to fulfil our contract or applicable legal provisions and to maintain our relationship with you. We will inform you about the specific storage period of the data in the respective description of the individual data processing. If you do not find any specific information on the storage period there, it is not possible for us to specify one because it depends on various individual factors (e.g. the term of the contract, assertion of claims, etc.). In these cases, we base the duration of storage on the principle of data minimisation and proportionality.

Business documents are stored for a maximum of 6 and 10 years in accordance with the provisions of the German Commercial Code and the German Fiscal Code.

As long as you do not object or revoke your consent, we will use your data to maintain and intensify our trusting business relationship for our mutual benefit.

If you wish your data to be deleted, we will delete your data immediately, provided that there are no legal obligations to retain it.

Rights of the data subject

• Revocation of consent

If the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

• Right to confirmation

You have the right to request confirmation from the controller as to whether we are processing personal data concerning you. You can request confirmation at any time using the contact details above.

• Right to information

If personal data is processed, you can request information about this personal data and the following information at any time:

1. a) the purposes of the processing;
2. b) the categories of personal data that are processed;
3. c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. e) the existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by the controller or a right to object to such processing;
6. f) the existence of a right of appeal to a supervisory authority;
7. g) if the personal data are not collected from the data subject, all available information about the origin of the data;
8. h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
9. i) If personal data is transferred to a third country or to an international organisation, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer. We will provide a copy of the personal data that is the subject of the processing. We may charge a reasonable fee based on administrative costs for any further copies you request as an individual. If you make the request electronically, the information shall be provided in a commonly used electronic format, unless otherwise specified. The right to receive a copy in accordance with Article 20 must not adversely affect the rights and freedoms of others.

• Right to rectification and completion

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• Right to erasure (“right to be forgotten”)

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and we are obliged to erase personal data without undue delay where one of the following grounds applies:

1. a) The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
2. b) The data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing.
3. c) The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
4. d) The personal data have been processed unlawfully.
5. e) The deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.

If the controller has made the personal data public and is obliged to erase it in accordance with para. 1, he shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that a data subject has requested them to erase all links to this personal data or copies or replications of this personal data.

The right to erasure (“right to be forgotten”) does not exist if the processing is necessary:

• to exercise the right to freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
• for the assertion, exercise or defence of legal claims.

• Right to restriction of processing

You have the right to demand that we restrict the processing of your personal data if one of the following conditions is met:

1. a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
2. b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
4. d) the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted in accordance with the above conditions, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

• Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where one of the following applies

1. a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR, and
2. b) the processing is carried out by automated means.

When exercising the right to data portability pursuant to para. 1, you have the right to obtain that the personal data be transferred directly from one controller to another controller, insofar as this is technically feasible. The exercise of the right to data portability does not affect the right to erasure (“right to be forgotten”). This right does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

• Right of objection

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

You have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you which is carried out for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), unless the processing is necessary for the performance of a task carried out for reasons of public interest.

You can exercise your right to object at any time by contacting the respective controller.

• Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

• Right to an effective judicial remedy

Without prejudice to any available administrative or extrajudicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under this Regulation have been infringed as a result of the processing of your personal data in non-compliance with this Regulation.

Children

Our services are generally aimed at adults. Persons under the age of 18 should not transmit any personal data to us without the consent of their parents or legal guardians.

Privacy policy for applicants

We are pleased that you are interested in us and that you are applying or have applied for a position in our company. We would like to provide you with the following information on the processing of your personal data in connection with your application.

Which of your data do we process? And for what purposes?

We process the data that you have sent us in connection with your application in order to check your suitability for the position (or any other open positions in our company) and to carry out the application process.

What is the legal basis for this?

The legal basis for the processing of your personal data in this application procedure is Art. 6 para. 1 lit. b) GDPR. According to this, the processing of data is permitted if it is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures.

Should the data be required for legal prosecution after completion of the application process, data processing may be carried out on the basis of the requirements of Art. 6 GDPR, in particular to safeguard legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR. Our interest then lies in the assertion or defence of claims.

How long will the data be stored?

Applicants’ data will be deleted after 6 months in the event of rejection.

In the event that you have consented to further storage of your personal data, we will transfer your data to our applicant pool. There the data will be deleted after two years.

If you have been accepted for a position as part of the application process, the data from the applicant data system will be transferred to our personnel information system.

To which recipients is the data passed on?

Your application data will be reviewed by the HR department after we receive your application. Suitable applications are then forwarded internally to the department managers responsible for the respective open position. The next steps are then agreed. Within the company, only those persons have access to your data who need it for the proper course of our application procedure.

Where is the data processed?

The data is processed exclusively in data centres in the Federal Republic of Germany.

Legal effectiveness

If sections or individual terms of this statement are not legal or correct, the content or validity of the other parts remain uninfluenced by this fact.