Privacy policy

Privacy policy
of buchinger-wilhelmi.com

(hereinafter referred to as the “privacy policy”)

With regard to the aspects relevant under data protection legislation and concerning use of the site

www.buchinger-wilhelmi.com
(hereinafter also referred to as the “website”)

we,

Buchinger Wilhelmi Development & Holding GmbH
Wilhelm-Beck-Straße 27
88662 Überlingen

(Legal notice)

(hereinafter also referred to as “we” or “Buchinger Wilhelmi”)

in our capacity as controller under the terms of data protection legislation and as a service provider at the same time would like to inform you of the following.

Your personal data is only processed in the context of the legal provisions under data protection legislation in the European Union, particularly the EU General Data Protection Regulation (hereinafter referred to as the “GDPR”) and, additionally, the German Federal Data Protection Act in the version valid with effect from 25 May 2018 (hereinafter referred to as the “BDSG”) and other legal provisions concerning data protection (hereinafter collectively referred to as “data protection legislation”).

If you would like to take a look at the GDPR yourself, you will find it online at: https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.

This privacy policy applies to our website, which is accessible at the domain www.buchinger-wilhelmi.com, including all sub-domains. However, the information below does not apply to other providers’ third-party websites linked from this website, for example. The terms used, such as “personal data” or “processing” of the same, correspond to the definitions contained in Art. 4 of the GDPR.

 

Overview

1. Subject matter of data protection, categories of data and sources
2. Purposes of processing and legal bases
3. Server log data
4. Communication by email and using the contact form
5. Newsletter / press distribution list
6. Fasting Box Community Forum
7. Cookies
8. Google Analytics
9. Google Ads
10. Meta Pixel & Facebook Conversion API
11. Other services and content from third-party providers
12. Recipients of personal data
13. Data processing in third countries
14. Security
15. Duration of storage
16. Your rights
17. Our data protection officer
18. Amendments

 

1. Subject matter of data protection, categories of data and sources

Personal data is the subject matter of data protection. Personal data is all information which relates to an identified or identifiable natural person. Your personal data therefore includes all the data which permits identification of you personally, such as your name, address, phone number or email address.

We regularly process the following categories of personal data:

• Master data, particularly your surname, first name and title.
• Contact details, particularly your postal address, plus your phone number and email address if necessary.
• Contract data, particularly data which you provide us with for the purpose of performing a contract.
• Content data, particularly text you enter and the data contained in the correspondence between you and us.
• User data, particularly the pages of our website which you visit, access times and your IP address.

If you want to initiate a business relationship with us over our website, you must provide the personal data necessary for establishing and implementing a business relationship, fulfilling the associated contractual obligations and complying with legal obligations. We shall inform you in an appropriate manner (e.g. by indicating mandatory fields in forms) of what data this is on a case-by-case basis.

This personal data mainly comes from your yourself, particularly through your use of our website, your contact requests and any information you provide when concluding a contract.

2. Purposes of processing and legal bases

We process your data only for specific purposes and if an applicable legal regulation permits doing so. We shall process your data using the following legal bases, to name but a few examples:

• Consent (Art. 6, Para. 1, Clause 1, lit. a of the GDPR): We shall only process certain data based on the consent which you have expressly and voluntarily granted beforehand. You have the right to revoke your consent at any time with effect for the future.
• Fulfilment of a contract or implementation of pre-contractual measures (Art. 6, Para. 1, Clause 1, lit. b of the GDPR): We require certain data from you particularly to initiate or implement your contractual relationship with Buchinger Wilhelmi.
• Fulfilment of a legal obligation (Art. 6, Para. 1, Clause 1, lit. c of the GDPR): We also process your personal data for the purpose of fulfilling legal obligations such as regulatory specifications or retention requirements under commercial and tax law.
• Protection of legitimate interests (Art. 6, Para. 1, Clause 1, lit. f of the GDPR): Buchinger Wilhelmi shall process data to protect its or third parties’ legitimate interests. However, this only applies if your interests do not take precedence on a case-by-case basis.

Please refer to Section 13 to find out how you can object to such processing and under which conditions we have to stop or restrict our processing activities.

Please bear in mind that this is not a complete or exhaustive list of the potential legal bases; rather, these are only examples which should make the legal bases under data protection legislation more transparent. Please refer to the information in the following sections for more detailed information about the legal bases of the individual data processing activities on our website.

3. Server log data

Visiting our website may cause the following information to be saved about access:

• The requesting terminal device’s IP address,
• The file retrieved,
• The http response code,
• The previous website from which you are visiting our website (referrer URL),
• The date, time and time zone of the server request,
• The browser type and version,
• The operating system used on the requesting terminal device,
• The search terms used to find the website via Google, for example.

We process this data based on Art. 6, Para. 1, Clause 1, lit. f of the GDPR for the purpose of making the website available, ensuring technical operation and guaranteeing the security of our IT systems. In this regard, we pursue the interest of enabling use of our website and its technical functionality and permanently maintaining the same. This data is automatically processed when our website is accessed. You cannot use our website without providing it. We do not use this data for the purpose of drawing conclusions about your identity.

The automatically collected data shall generally be deleted after 7 days unless we exceptionally require it for longer for the purposes mentioned above. We shall delete the data immediately after the purpose ceases to apply in a case such as this.

You cannot object to the collection and storage of your server log data because this data is absolutely essential for smooth operation of the website.

4. Communication by email and using the contact form

If you contact us by email, your voluntarily provided contact details (such as your name and email address) shall only be collected, processed and used for a specific purpose, i.e. either to record and, if necessary, respond to your request(s) or for technical administration purposes.

You can also contact us using a contact form provided in the “Contact” section. If you use this contact form, we collect and store the following data:

• Salutation
• Surname and first name
• Email address
• Your request / message to us

You are more than welcome to (voluntarily) provide us with your:

• Title
• Address
• Date of birth

The data you provide is transferred by your browser to our server, where it is converted into an email which is then sent to us. Your contact details are only collected, processed and used for a specific purpose, i.e. to record and, if necessary, respond to your request.

Data which is transferred in the context of communication using the contact form or by email is processed based on Art. 6, Para. 1, Clause 1, lit. b of the GDPR if it is provided to initiate a contractual relationship, or based on Art. 6, Para. 1, Clause 1, lit. f of the GDPR. In the latter case, we have a legitimate interest in processing contact requests sent to us voluntarily.

We delete the data you provide as soon as the purpose for which it was collected ceases to apply in full, subject to fulfilment of continuing legal retention requirements.

If your data is processed based on legitimate interests, you can object to the storage of your personal data at any time.

However, please note that we cannot guarantee complete data security, particularly when communicating using the contact form or by email. Please, therefore, refrain from sending confidential information such as bank or credit card details, etc., in these ways. We recommend using a secure transmission path, such as postal communication, to send confidential information.

5. Newsletter / press distribution list

We use what is referred to as the “double opt-in procedure” to send the newsletter and sign up for our press distribution list, i.e. we will not send you a newsletter or a press release by email until we have received your prior express confirmation that we should activate the newsletter or press distribution list service. We will then send you a notification email asking you to confirm that you wish to receive our newsletter or our press releases by clicking on a link contained in the email. Once this separate double opt-in procedure is complete, you have given your consent to receiving the newsletter or press releases.

We only send newsletters or press releases following proper subscription, i.e. with your consent based on Art. 6, Para. 1, Clause 1, lit. a of the GDPR. Insofar as the content of a newsletter or press release is specifically described in the course of subscription, such content is decisive for the scope of the consent. Moreover, our newsletters and press releases contain information about our products, offers, promotions and company.

If you later decide you no longer wish to receive newsletters or press releases from us, you can revoke your consent at any time. Sending a message in text form (e.g. email, letter) to the contact details provided above or to datenschutz@buchinger-wilhelmi.com is sufficient for us in this regard. You will of course also find an unsubscribe link in every newsletter and every press release.

The newsletter and press releases are sent via “MailChimp”, a newsletter distribution platform provided by the US company Rocket Science Group LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. In this regard, data processing is carried out on our behalf based on a data processing agreement (order processing contract) which we have concluded with MailChimp. Under the terms of this agreement, MailChimp undertakes to protect our users’ data, to process such data only on our behalf and, in particular, not to disclose such data to third parties.

The email addresses of our newsletter recipients and members of the press distribution list, as well as other data of the recipients described in this information, are stored on MailChimp’s servers in the USA. MailChimp uses this information to send and evaluate the newsletter on our behalf. Furthermore, according to its own information MailChimp can use these data to optimise or improve its own services, e.g. to technically optimise how the newsletter and press releases are sent and presented or for economic purposes, in order to determine which countries the recipients come from. However, MailChimp does not use our newsletter recipients’ data or data from members of the press distribution list in order to write to them directly or to disclose their data to third parties.

We trust in MailChimp’s reliability, IT security and data security. MailChimp is certified under the EU/US Privacy Shield Agreement and therefore undertakes to comply with EU data protection regulations.

You can view the data protection provisions of MailChimp here: https://mailchimp.com/legal/privacy/. MailChimp also uses the Google Analytics analysis tool and integrates this tool in the newsletter and press releases where necessary. Information about Google Analytics can be found below in the relevant section.

We would like to make you aware that, after the newsletter and press release have been sent, we will evaluate your user behaviour in relation to our newsletter. With regard to this evaluation, the emails that are sent contain what are referred to as either “web beacons” or “tracking / counting pixels”. These are single-pixel image files that link to our website and therefore allow us to evaluate your user behaviour in relation to our newsletter and our press releases. This is done by collecting technical information, e.g. about your browser, your system, your IP address and the time of access. In addition, there are web beacons, which are assigned to your email address and linked to your own ID.

Web beacon tracking is not possible if you have disabled the display of images in your email program by default. In this case, however, the newsletter and press releases will not be displayed to you in full and you may be unable to use all the functions. The aforementioned tracking takes place if you opt to display the images manually.

6. Using our Fasting Box Community Forum

(1) Our Community forum can be viewed without having to sign in. If you’d like to actively contribute to our Community forum, you must register with your email address, a password and choose a username. You don’t have to use your real name, you can use a pseudonym instead. We’ve set up a double opt-in for this service, i.e. you’ll receive an email where you’ll have to confirm your email address and that you’d like to receive notifications. You can unsubscribe from these notifications at any time, for example by clicking on the link in the email or using the contact details provided. We’ll store your data and the date you register for the service as well as your IP address until you unsubscribe from the notification service.

(2) When you open a Community forum account and up until you close the account, we’ll store all the information regarding your activity in the Community forum, i.e. public posts, wall posts, etc., in addition to your registration details, in order to run the Community forum. The legal basis is Art. 6 (1) Clause 1 (b) of the GDPR.

(3) When you delete your account, your public statements, in particular posts in the Community forum, will remain visible for all viewers, but your account will no longer be available and will be identified in the Community forum as “[guest]”. All other data will be deleted.

7. Cookies

The website uses cookies and similar technologies such as HTML5 storage (hereinafter collectively referred to as “cookies”) to be able to optimally design the website. To name but a couple of examples, this makes navigation easier and allows for a high level of user friendliness.

Cookies are small identifiers which our web server sends to your browser and which your terminal device stores if the appropriate default setting is made. They can be used to determine whether communication with us has already taken place from your terminal device, among other things. They are therefore used to make use more convenient for you and to optimise our website. This processing is carried out based on Art. 6, Para. 1, Clause 1, lit. f of the GDPR with regard to essential cookies and based on Art. 6, Para. 1, Clause 1, lit. a of the GDPR if you have given your consent with regard to the storage and use of our own additional cookies or cookies from third-party providers. Personal data can be stored in cookies if doing so is technically necessary or you have given your consent to this effect.

If you use our website, you can grant us your consent with regard to the use and storage of our own additional cookies or cookies from third-party providers on your terminal device. You can revoke any consent that you grant with regard to the use and storage of cookies at any time with effect for the future by disabling the cookie settings on this website by changing the configuration.

Furthermore, you can also select “Do not accept any cookies” in your browser settings (also in relation to essential cookies). Please refer to your browser’s Help function for the processes for technical administration and deletion of cookies in your browser settings.

You can also technically prevent the storage and use of all cookies using free browser add-ons such as “Adblock Plus” (adblockplus.org/de) in combination with the “EasyPrivacy” list (easylist.to) or “Ghostery” (ghostery.com).

8. Web analysis tools / Google Analytics /  Hotjar

This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses third-party cookies to identify the frequency of use of certain areas of our website and preferences. The information generated by the cookie about your use of our website (including your truncated IP address) is generally transmitted to a Google server in the United States and stored there. Data processing is based on our legitimate interest, namely our interest in the analysis, optimization and cost-effective operation of our online offering. Google is certified under the Privacy Shield agreement, under which it guarantees to observe European data protection law.

 

Google will use this information on our behalf and under an order processing agreement to analyse your use of the website, compile reports on website activities for us and provide us with additional services in connection with use of the website and Internet usage.

 

We only use Google Analytics with the IP anonymization function activated. This means that the user’s IP address will be truncated by Google within member states of the European Union (EU) or in other states that are party to the Agreement on the European Economic Area. In exceptional cases only, the full IP address will be transmitted to a Google server in the United States and abbreviated there. The IP address transmitted by your browser will not be combined with other data held by Google.

 

The data will be deleted as soon as they are no longer required for the purposes for which we recorded them. In our case, this is generally after 36 months.

 

You can prevent the storage of these cookies for Google Analytics by adjusting the settings in your browser or installing add-ons. In addition, you can prevent the information about your use of the website generated by the cookie (including your IP address) from being passed on to Google and being processed by Google by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout?hl=en.

 

More information about the use of data by Google, options for settings and for raising objections is available on Google’s websites under the following links:

• https://policies.google.com/technologies/partner-sites?hl=en (“How Google uses information from sites or apps that use our services”),
• https://www.google.com/policies/technologies/ads (“Data use for advertising purposes”),
• https://www.google.com/settings/ads (“Control the information Google uses to show you ads”).

Use of Hotjar
On our website we use the analysis tool provided by Hotjar Ldt. (Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julians STJ1000, Malta; “Hotjar”).
The data processing serves the purpose of designing, optimising and analysing our website according to your needs.
The tool is used to randomly record the movements of visitors to the website. This creates a protocol of mouse movements, scrolling behaviour, dwell time and clicks on the website (what is known as the heat map).
For this purpose Hotjar uses, among other things, cookies. These can involve the collection of, among other things, the following information: IP address (in anonymous form), information about the device you are using (screen size, devices, unique device identifier), information about the browser you are using, location data (country only), preferred language for displaying the website, operating system used. Detailed information on the cookies used and the function and the storage period of these can be found here:
https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookies (https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookies)
This data is used to create user profiles under a pseudonym. The data is not used to personally identify the visitor of the website and is not merged with personal data of the bearer of the pseudonym. Hotjar is contractually prohibited from selling the collected data to other third parties.
The use of cookies or comparable technologies is carried out with your consent on the basis of Art. 25 para. 1 p. 1 TTDSG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the legality of the processing carried out with your consent up to the withdrawal.
For more information about data protection when using Hotjar, please visit: https://www.hotjar.com/legal/policies/privacy/#enduserenglish (https://www.hotjar.com/legal/policies/privacy/#enduserenglish)

 

 

9. Google Ads

Use of Google Ads conversion tracking
Our website uses the online marketing program “Google Ads”, including conversion tracking (evaluation of user actions). Google conversion tracking is a service operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).
If you click on adverts placed by Google, a cookie is placed on your computer for conversion tracking. These cookies have limited validity, do not contain any personal data and thus cannot be used for personal identification. If you visit certain pages on our website and the cookie has not yet expired, we and Google can recognise that you have clicked on the advert and were forwarded to this page. Every Google Ads customer receives a different cookie. It is therefore not possible to track cookies relating to the websites of Ads customers.
The information collected using the conversion cookie serves the purpose of producing conversion statistics. This allows us to find out the total number of users who have clicked on our adverts and were forwarded to a page equipped with a conversion tracking tag. However, they do not receive any information with which could be used to personally identify users.
Your data may be transmitted to the USA. For the USA, no adequacy decision from the EU Commission is available.The data transfer takes place, among other things, on the basis of standard contractual clauses as suitable guarantees for the protection of personal data, which can be viewed at: https://policies.google.com/privacy/frameworks (https://policies.google.com/privacy/frameworks) and https://business.safety.google/adscontrollerterms/ (https://business.safety.google/adscontrollerterms/).
The use of cookies or comparable technologies is carried out with your consent on the basis of Art. 25 para. 1 p. 1 TTDSG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the legality of the processing carried out with your consent up to the withdrawal.
You will find more information as well as Google’s data privacy policy at: https://www.google.com/policies/privacy/ (https://www.google.com/policies/privacy/)
“We use “advanced conversions”, for more information see: Advanced Conversions – Google Ads Help.
We use the “consent mode”, for more information see: About consent mode – Google Ads Help.

Use of the remarketing or “similar target groups” function by Google Inc.
Our website uses the remarketing or “similar target groups” function by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).
This application serves to analyse visitor behaviour and visitor interests.
Google uses cookies to analyse website use, forming the basis for producing interest-related adverts. Cookies allow for the recording of website visits as well as anonymised data on the use of the website. The personal data of website visitors is not saved. If you then visit another website in the Google display network you will then be shown adverts which are more likely to take previous areas of product and information interest into account.
Your data may be transmitted to the USA. For the USA, no adequacy decision from the EU Commission is available. The data transfer takes place, among other things, on the basis of standard contractual clauses as suitable guarantees for the protection of personal data, which can be viewed at: https://policies.google.com/privacy/frameworks (https://policies.google.com/privacy/frameworks).
The use of cookies or comparable technologies is carried out with your consent on the basis of Art. 25 para. 1 p. 1 TTDSG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the legality of the processing carried out with your consent up to the withdrawal.
You can find more detailed information on Google remarketing as well as the associated data privacy policy at: https://www.google.com/privacy/ads/ (https://www.google.com/privacy/ads/)

 

10. Meta Pixel & Facebook Conversion API

Use of Meta Pixel
We use Meta Pixel from Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”) on our website.
Meta and we are jointly responsible for the collection of your data and the transfer of this data to Meta when the service is integrated. The basis for this is an agreement between us and Meta on the joint processing of personal data, in which the respective responsibilities are defined. The agreement is available at https://de-de.facebook.com/legal/terms/businesstools (https://de-de.facebook.com/legal/terms/businesstools). According to this agreement, we are responsible in particular for the fulfilment of the information obligations in accordance with Arts 13 and 14 GDPR, for compliance with the security requirements of Art. 32 GDPR with regard to the correct technical implementation and configuration of the service, and for compliance with the obligations in accordance with Arts 33 and 34 GDPR, insofar as a violation of the protection of personal data affects our obligations under the agreement on joint processing. Meta is responsible for enabling the rights of the data subject in accordance with Arts 15-20 GDPR, for complying with the security requirements of Art. 32 GDPR with regard to the security of the service, and for complying with the obligations of Arts 33 and 34 GDPR, insofar as a breach of personal data protection concerns Meta’s obligations under the joint processing agreement.
The application serves to address the visitor to the website with interest-related advertising on the social networks Facebook and Instagram. We have implemented Meta’s remarketing tag on our website for this purpose. This tag sets up a direct connection to Meta’s servers when you visit our website. This informs the Meta server which of our web pages you have visited. Meta assigns this information to your personal Facebook and/or Instagram user account. When you visit the social networks Facebook or Instagram, you will then be shown personalised, interest-related ads.
The application also serves the purpose of creating conversion statistics. This allows us to find out the total number of users who have clicked our adverts and were forwarded to a page equipped with a conversion tracking tag as well as what actions are taken after being redirected to this website. However, they do not receive any information which could be used to personally identify users.
Within the meta pixel, we are using the expanded alignment function. The expanded alignment allows us to transfer to Meta (Facebook) different types of data (e.g., place of residence, federal state, zip code, hashed email addresses, names, gender, date of birth or phone number) of our customers and prospects we collect through our website. As a result of this activation, we can tailor the offers presented in our advertising campaigns on Facebook to individuals interested in what we offer even more precisely. Moreover, this expanded alignment optimizes the allocation of website conversions and expands custom audiences.
Your data may be transmitted to the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself in accordance with the TADPF and has thus undertaken to comply with European data protection principles.
The processing of your personal data is carried out with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the legality of the processing carried out with your consent up to the withdrawal.
For this purpose, you can deactivate the remarketing function “Custom Audiences”. You can find more detailed information on Meta’s collection and use of data and your associated rights and options for protecting your privacy in Meta’s privacy policy: https://www.facebook.com/about/privacy/.

Facebook Conversion API
We have integrated Facebook Conversion API on this website. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected is also transferred to the USA and other third countries.
Facebook Conversion API enables us to record the website visitor’s interactions with our website and pass them on to Facebook in order to improve advertising performance on Facebook.
In particular, the time of the call, the website called up, your IP address and your user agent as well as other specific data (e.g. products purchased, value of the shopping basket and currency) are recorded for this purpose. You can find a complete overview of the data that can be collected here: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters.
The use of this service is based on your consent according to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TTDSG. The consent can be revoked at any time.
Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 DSGVO). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Facebook. The processing by Facebook that takes place after the forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook tool and for the data protection-secure implementation of the tool on our website. Facebook is responsible for the data security of the Facebook products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert the data subject rights with us, we are obliged to forward them to Facebook.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.
You can find further information on protecting your privacy in Facebook’s data protection information: https://de-de.facebook.com/about/privacy/.

11. Other services and content from third-party providers

We use plugins from third-party providers on our website to incorporate their content and services such as maps or fonts (hereinafter collectively referred to as “content”). Your data is processed in this regard based on our legitimate interests (Art. 6, Para. 1, Clause 1, lit. f of the GDPR) in the economic operation and optimisation (particularly user friendliness) of our website and in analysing how it is used, as well as in guaranteeing the security of our technical systems.

The third-party providers of such content always receive information about your IP address, because the content cannot be transferred to your terminal device without it. The IP address is required to show the content. The third-party providers may also store cookies on your terminal device if you have given your consent with regard to the use and storage of cookies from third-party providers.

You can revoke any consent that you grant with regard to the storage and use of cookies for the following services by disabling “cookies from third-party providers” (see Section 6, lit. b above). Furthermore, you can also technically prevent the storage and use of cookies by making by making corresponding browser settings or installing browser add-ons.

a)    Google Maps

We use the “Google Maps” service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to display maps. The processed data may include IP addresses and location data in particular, but this information cannot be collected without your consent (generally using corresponding device settings). You will find out more information about Google’s use of data and possibilities with regard to settings and objection at the following links:

• https://www.google.com/intl/de/policies/privacy/partners (“How Google uses data when you use our partners’ sites or apps”),
• https://www.google.com/policies/technologies/ads (“Using data for advertising purposes”),
• https://www.google.de/settings/ads (“Managing the information that Google uses to show you advertising”).

b)    Vimeo

Videos over vimeo.com are integrated on this website. This is a service provided by Vimeo, Inc., 555 West 18th Street, New York, New York 10011, USA (hereinafter referred to as “Vimeo”). A connection is established to Vimeo’s servers in the USA for this purpose. Certain information (such as your IP address) is transferred to Vimeo in this regard. Vimeo may also store cookies on your terminal device if you have given your consent with regard to the use and storage of cookies from third-party providers. We are not aware of the nature and scope of the data that Vimeo collects and have no influence over how it is used. The integration means that Vimeo may also receive information that your browser has accessed the relevant page on this website, even if you do not have a Vimeo user account or are not logged into Vimeo.

According to its own information, Vimeo is certified according to the EU/U.S. Privacy Shield.

The legal basis in relation to the use of cookies is Art. 6, Para. 1, Clause 1, lit. a of the GDPR, because data processing in this regard is based on your consent. Art. 6, Para. 1, Clause 1, lit. f of the GDPR forms an additional legal basis, because we have a legitimate interest in using third-party contents and services for the purposes of economic operation and optimisation of our website.

For more information about Vimeo’s collection and use of your data and your rights in this regard, please refer to Vimeo’s privacy policy at https://vimeo.com/privacy.

You can revoke any consent you grant with regard to Vimeo’s storage and use of cookies by deactivating “cookies from third-party providers” (see Section 6, lit. c above) or by technically disabling such cookies in your browser settings or using browser add-ons; however, we would like to point out that you may be unable to use all of our website’s functions in full in this case.

12. Recipients of personal data

We only disclose your personal data to external recipients if doing so is necessary e.g. to handle or process your order or to provide your contractual services, if we have your consent to this effect or if other legal permission exists.

External recipients may in particular be:

• Processors: These are service providers which we engage to provide services, e.g. in the fields of technical infrastructure and maintenance of our website. We select such processors carefully and regularly review them to ensure that your privacy remains protected. These service providers may only use the data for the purposes specified by us and under our instructions. We are authorised to use such processors in compliance with the legal requirements set forth in Art. 28 of the GDPR.
• Public agencies: These are authorities, state institutions and other public / legal bodies such as supervisory authorities, courts, public prosecutors or financial authorities. Personal data is only transferred to such public agencies for compelling legal reasons. The legal basis of such transfer may be Art. 6, Para. 1, Clause 1, lit. c of the GDPR.
• Non-public agencies: Service providers and auxiliary persons to whom the data concerning performance of our contract is transferred based on a legal obligation or to protect legitimate interests, such as shipping service providers, payment service providers, tax advisors or auditors. Transfer is then carried out based on Art. 6, Para. 1, Clause 1, lit. b, c and/or f of the GDPR.

13. Data processing in third countries

Generally speaking, we do not process your data outside of the European Union (EU) or the European Economic Area (EEA). However, if we transfer your data to third countries outside of the EU or the EEA on a case-by-case basis (e.g. to carry out an order from a third country), before disclosure we ensure that exceptional circumstances permissible by law exist, that the recipient has an adequate data protection level or that you have given your consent to your data being transferred. An adequate data protection level is, for example, guaranteed by the recipient being certified under the EU/U.S. Privacy Shield Agreement, conclusion of the EU standard contractual clauses or the presence of binding corporate rules (BCRs).

14. Security

We take technical and organisational security precautions to protect your personal data against accidental or deliberate manipulation, loss and destruction or against access by unauthorised individuals. Our security measures are adapted accordingly to the current state of the art in each case.

Your personal data, which is transferred in the context of using our website, is transferred securely on our end by means of encryption. In this regard, we use the encryption protocol Transport Layer Security (TLS), which is more commonly known under its predecessor’s name, Secure Socket Layer (SSL).

Our employees are bound by data secrecy.

15. Duration of storage

We only store your personal data for as long as is necessary for fulfilment of the purposes or – if you have given us your consent – as long as you do not revoke your consent. Storage of your data may particularly be necessary if the data is still required to fulfil contractual services and to be able to check or defend warranty or guarantee claims if necessary.

We shall no longer process your personal data unless further processing of the same is permitted or even stipulated as an obligation according to the relevant legal regulations (e.g. in the context of retention requirements under commercial and tax law).

We also delete your personal data if we are obligated to do so for legal reasons.

16. Your rights

You are entitled to a number of rights as a data subject affected by data processing. In detail, these are:

• Right of access (Art. 15 of the GDPR): You have the right to receive information about the personal data we have saved about you.
• Right to correction and deletion (Arts. 16 and 17 of the GDPR): You can request that we correct incorrect data and – if the legal requirements have been met – that we delete your data.
• Right to restriction of processing (Art. 18 of the GDPR): If the legal requirements have been met, you can request that we restrict processing of your data.
• Right to data portability (Art. 20 of the GDPR): If you have provided us with data based on a contract or consent, if the legal requirements exist you may request receipt of the data you provided in a structured and common format, or that we transfer the same to another controller.
• Right to object to data processing based on legitimate interests (Art. 21 of the GDPR): You have the right on grounds relating to your particular situation to object to our data processing activities at any time if doing so is based on legitimate interests under the terms of Art. 6, Para. 1, Clause 1, lit. f of the GDPR. If you exercise your right to object, we shall stop processing your data unless we can demonstrate compelling legitimate grounds for further processing which override your rights.
• Objection to cookies: You can also object to the use of cookies at any time. If you would like to object to the use of certain cookies, please note the information provided in Section 5.
• Revocation of consent (Art. 7 of the GDPR): If you have granted us consent to process your data, you can revoke the same at any time with effect for the future. The lawfulness of processing your data until such time that you revoke your consent remains unaffected by this.
• Right to lodge a complaint with the supervisory authority (Art. 77 of the GDPR): You can also lodge a complaint with the competent supervisory authority if you believe that processing of your data violates applicable law. To do so, you can choose to contact either the data protection authority responsible for your place of residence, your workplace or the place of the suspected violation or the data protection authority responsible for us. The supervisory authority responsible for us is the Baden-Württemberg State Officer for Data Protection and Freedom of Information (LfDI), which can be contacted on the following details: Königstraße 10a, 70173 Stuttgart, Tel.: +49 (0)711 615541-0, Fax: +49 (0)711 615541-15, Email: poststelle@lfdi.bwl.de, Web: baden-wuerttemberg.datenschutz.de.

If you have any questions concerning the topic of processing of your personal data, your rights as a data subject and any consent granted, you are more than welcome to contact our data protection officer on the communication channels mentioned in Section 14. Please also contact our data protection officer directly if you would like to exercise your rights as a data subject.

17. Our data protection officer

We have appointed a company data protection officer. You can contact them as follows:

Mr RA Ulf Neumann, LL.M.
Lederstraße 134
72764 Reutlingen
Telefon: +49 7121 347654-0
Fax: +49 7121 347654-9
E-Mail: info@neumann.law

18. Amendments

From time to time, it may be necessary to adapt the contents of this privacy policy. We therefore reserve the right to amend this privacy policy at any time. We shall seek your consent insofar as the same is required to make an amendment. We will also publish the amended version of the privacy policy here. You should therefore re-read the privacy policy if you visit our website again.

 

Last updated:  12.08.2022