Privacy Policy
Protecting your personal data is important to us.
Below we inform you that we collect personal data from you and store it electronically. Your data is stored and processed by us in accordance with the relevant provisions of national data protection legislation and of the General Data Protection Regulation (GDPR).
The controller within the meaning of the above provisions is:
Owner: G.E.I. Deutschland GmbH
The controller’s data protection officer is:
Mr Jean-Jacques Koch
Owner: G.E.I. Deutschland GmbH
Kapellenstraße 18
D-66271 Kleinblittersdorf
Germany
Tel.: +49 (0)68 05 / 91 39 25-0
Email: gei@gei-gitterroste.de
Website: www.gei-gitterroste.de
To keep this privacy policy readable and understandable, we first explain the basic terms used in the GDPR.
Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.
Finish
Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Restriction of processing
Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.
Profiling
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Pseudonymisation
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data are not attributed to an identified or identifiable natural person.
Controller or controller responsible for the processing
The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor
A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient
A recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
Third party
A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Consent
Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Data is collected and processed when you access our website or retrieve a file stored on it. As a rule, this only happens where it is necessary to provide a functioning website and its content and services. Personal data is otherwise generally collected and used only with the corresponding consent. An exception applies where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.
Where we obtain the data subject’s consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.
Where personal data is processed to perform a contract concluded with us, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures.
Where processing of personal data is necessary to comply with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
Where the vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.
Where processing is necessary to safeguard a legitimate interest of our company or of a third party and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
The personal data we collect is erased as soon as the purpose of its storage ceases to apply.
Data is stored where this is provided for by a law, an EU regulation or other provisions.
Data is also erased when a storage period prescribed by those provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.
When our website is accessed, the following are logged:
Browser type / version
Operating system used
Referrer URL (website previously visited) and the pages accessed on our website
IP address
Date and time of the server request
Internet service provider
The legal basis for storing the data and the log files is Art. 6(1)(f) GDPR.
Storage in log files ensures that our website functions properly. It also serves to optimise and secure our systems. The data is not analysed for marketing purposes in this context.
The data we store is erased as soon as it is no longer required to achieve the purpose for which it was collected. This is the case after seven days at the latest. Storage beyond that period is possible; in that case users‘ IP addresses are erased or altered so that the calling client can no longer be identified.
Collecting the data described above is strictly necessary to operate the website. Users therefore have no right to object in this respect.
Our website uses cookies. Cookies are text files stored on the visitor’s computer system when our websites are accessed. Cookies contain a character string that makes it possible to identify the visitor’s browser the next time our website is accessed. We use technically necessary cookies that make our offering more user-friendly, more effective and more secure.
The following data, for example, is stored in the cookies and transmitted:
Login data
Language settings
The data obtained in this way is pseudonymised by us. It therefore cannot be attributed to the visitor. This data is also not stored together with other personal data.
You can set your browser to inform you when cookies are set and to decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or in general. If cookies are not accepted, the functionality of our website may be limited.
Where cookies are also set on our web pages for advertising and/or analysis purposes, we provide separate information about this in this policy.
The legal basis for processing personal data using necessary cookies is Art. 6(1)(f) GDPR.
Technically necessary cookies make websites easier to use. Some features of the website or online shop cannot be offered without cookies, because they require the browser to be recognised even after moving to another page.
The user data collected by technically necessary cookies is not used to create user profiles.
Cookies are stored on the user’s computer and transmitted from it, so users have full control over their use. By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all of its functions to their full extent.
If you contact us via the contact form or by email, you agree to email communication that is transport-encrypted but not content-encrypted. Please inform yourself about the associated risks, for example here: https://www.bsi-fuer-buerger.de.
We provide visitors to our website with a contact form for quick electronic contact. The data entered in the input mask is transmitted to us and stored.
In addition, the user’s IP address and the date and time of transmission are stored at the moment the message is sent.
You may also contact us using the email address provided. In that case the user’s personal data transmitted with the email is stored.
The data is not passed on to third parties. It is used exclusively to process the enquiry.
The legal basis for processing the data is Art. 6(1)(a) GDPR.
The legal basis for processing data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. Where the email contact aims at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis for the processing.
The personal data is processed solely to handle the enquiry. Where contact is made by email, this also constitutes the necessary legitimate interest in processing the data.
The other personal data processed during the sending procedure serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the contact form input mask and the data sent by email, this is the case when the respective conversation with the user has ended. A conversation has ended when the circumstances indicate that the matter concerned has been conclusively clarified.
The additional personal data collected during the sending procedure is erased after seven days at the latest.
If the correspondence results in a business transaction, we are legally obliged to retain the correspondence exchanged for six years (starting from the end of the calendar year in which the respective letter was sent).
Users may withdraw their consent to the processing of their personal data at any time by contacting the controller through the contact options provided on the website. Users who contact us by email may object to the storage of their personal data at any time; in such a case the conversation cannot be continued.
Where the data is retained because of a legal obligation, there is no right to object.
Comment function
Description and scope of the data processing
We offer visitors to our website the opportunity to post comments. The data entered in the input mask is transmitted to us and stored.
In addition, the user’s IP address and the date and time of transmission are stored at the moment the message is sent.
The data is not passed on to third parties. It is used exclusively to process the enquiry.
Legal basis for the data processing
The legal basis for processing the data is Art. 6(1)(f) GDPR.
Purpose of the data processing
The personal data is processed in order to prevent misuse of the comment function (for example by bots) and to ensure the security of our information technology systems.
Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. This is the case at the latest when the comment or the corresponding page is deleted.
Right to object and to have data removed
Users may withdraw their consent to the processing of their personal data at any time by contacting the controller through the contact options provided on the website.
Newsletter
Users can subscribe to our newsletter on our website. When subscribing, the data requested in the input mask is transmitted to us.
In addition, the following data is collected on registration:
IP address of the subscriber’s computer
Date and time of registration
Consent is obtained during the registration procedure by means of a double opt-in process.
Where customers have purchased goods or services from us and provided their email address, that address may subsequently also be used to send a newsletter. In such a case the newsletter contains only direct advertising for our own similar goods or services.
Where the user has given consent, the legal basis for processing the data after the user subscribes to the newsletter is Art. 6(1)(a) GDPR.
The legal basis for sending the newsletter following the sale of goods or services is Section 7(3) of the German Act Against Unfair Competition (UWG).
The user’s email address is collected in order to deliver the newsletter.
Other personal data is collected during the registration procedure in order to prevent misuse of the services or of the email address used.
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. The user’s email address is therefore stored for as long as the newsletter subscription is active.
Users may cancel their newsletter subscription at any time. A corresponding link is provided in every newsletter for this purpose.
The newsletters we send contain tracking pixels. Tracking pixels are miniature graphics embedded in emails sent in HTML format that make log file recording and log file analysis possible. The personal data collected in this way is not passed on to third parties. Your consent for this is obtained during the registration procedure by means of a double opt-in process.
Where the user has given consent, the legal basis for processing the data after subscription to the newsletter is Art. 6(1)(a) GDPR.
Newsletter tracking serves to statistically evaluate the success or failure of online marketing campaigns. It allows us to see whether and when an email is opened and which links in the email are clicked. Newsletter tracking also serves to improve and optimise the newsletter.
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure.
Right to object and to have data removed
Users may withdraw their consent at any time by unsubscribing from the newsletter. A corresponding link is provided in every newsletter for this purpose, for example.
Transfer of data to service providers for the purpose of sending the newsletter
1. Mailchimp
Description and scope of the data processing
We use the newsletter service MailChimp to send our newsletter and for email marketing. The provider is The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE #5000, Atlanta GA 30308. USA.
The provider’s servers are located in the USA.
The following data, for example, is stored and processed by the provider.
IP address
Page views and click behaviour
Browser type and browser language
Hardware used by the user
The provider also sets cookies on users‘ devices.
Please note that MailChimp has undertaken to comply with EU data protection requirements. A data processing agreement (Data Processing Addendum: https://mailchimp.com/legal/data-processing-addendum/) has been concluded with MailChimp, in which MailChimp undertakes to protect the transmitted data. We also refer you to MailChimp’s current privacy policy (available at: https://mailchimp.com/legal/privacy/).
Legal basis for the data processing
Where the user has given consent, the legal basis for processing the data after the user subscribes to the newsletter is Art. 6(1)(a) GDPR.
Purpose of the data processing
The processing described above gives us information that allows us to analyse user behaviour. This enables us to optimise our newsletters and improve how they are displayed.
Storage period
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure. We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Rights to object and to have data removed
Users may withdraw their consent to the processing of their personal data at any time, either from the controller or from the provider, by using the communication channels made available. The controller can also arrange for the data held by the provider to be erased.
Users also have full control over the use of cookies. By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all of its functions to their full extent.
Transfer of data for the purpose of usage analysis
This website uses the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses analysis cookies. The information generated by the cookies about your use of this website is generally transmitted to a Google server in the USA and stored there. We extend the Google Analytics code with the code „gat._anonymizeIp();“. This code causes the IP address logged by Google to be truncated before transmission within the member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services relating to website and internet use. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Further information is available at https://www.google.com/analytics/terms/de.html or at https://policies.google.com/?hl=de.
The legal basis for processing users‘ personal data is Art. 6(1)(a) GDPR.
Processing users‘ personal data allows us to analyse our users‘ browsing behaviour. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us improve our website and its usability. Anonymising the IP address takes sufficient account of users‘ interest in the protection of their personal data.
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure.
We have also specified that Google automatically deletes the data after 14/26/38/50 months.
Cookies are stored on the user’s computer and transmitted from it, so users have full control over their use. By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all of its functions to their full extent.
You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser add-on available at https://tools.google.com/dlpage/gaoptout?hl=de.
To opt out when using mobile devices, the following link Disable Google Analytics must be clicked from each mobile device.
Google reCAPTCHA
Description and scope of the data processing
This website uses the reCAPTCHA service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When the reCAPTCHA service is clicked, data is forwarded to Google’s servers. These servers may also be located in the USA.
This transmits, for example, how many mouse clicks the user has made on the website, which Google cookies are stored on the user’s device, as well as the language settings, the date of access and the IP address. Information about the storage period is available at https://www.google.com/intl/de/policies/privacy/ or at https://policies.google.com/?hl=de.
Legal basis for the data processing
The legal basis for processing users‘ personal data is Art. 6(1)(a) GDPR.
Purpose of the data processing
The service is used to prevent misuse of the input options on our website through automated or machine-generated entries, by distinguishing such entries from those of a natural person (spam and bot protection).
Storage period
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure. We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Right to object and to have data removed
Cookies are stored on the user’s computer and transmitted from it, so users have full control over their use. By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all of its functions to their full extent.
Transfer of data for advertising purposes
This website uses the web advertising service Google AdSense. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analysis cookies are used for this purpose. Google AdSense also uses so-called “web beacons” (small invisible graphics) to collect information. Web beacons make it possible to record and collect simple actions such as visitor traffic on the website. The information generated by the cookies and/or web beacons about your use of this website (including the IP address) is transmitted to a Google server in the USA and stored there. Google will use this information to evaluate your use of the website with regard to the advertisements, to compile reports on website activity and advertisements for website operators and to provide further services relating to website and internet use. Google may also transfer this information to third parties where required by law or where third parties process this data on Google’s behalf. Google will under no circumstances associate your IP address with other Google data.
The legal basis for processing users‘ personal data is Art. 6(1)(a) GDPR.
Processing users‘ personal data allows us to analyse our users‘ browsing behaviour with regard to the integration and display of advertisements on our website. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website, including the advertisements displayed on it. This helps us continuously improve our website and its usability. Anonymising the IP address takes sufficient account of users‘ interest in the protection of their personal data.
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure. We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Cookies are stored on the user’s computer and transmitted from it, so users have full control over their use. By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all of its functions to their full extent.
You can also disable the display of personalised advertising at the following linkhttps://support.google.com/ads/answer/2662922?hl=de.
This website uses the Google Remarketing service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This service allows us to display user-related and interest-based advertising to our visitors. Cookies are used for this purpose, which make it possible to recognise a visitor to our website when they subsequently visit websites that are also members of the Google advertising network. Google thereby receives personal data about the visitor, such as their IP address or browsing behaviour. Google uses the data obtained in this way to display advertising.
The legal basis is Art. 6(1)(a) GDPR.
Analysis cookies are used to optimise the advertising displayed to the user.
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure. We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Right to object and to have data removed
Cookies are stored on the user’s computer and transmitted from it, so users have full control over their use. By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all of its functions to their full extent.
Data subjects may also object to interest-based advertising by Google. To do so, the data subject must open the link www.google.de/settings/ads from each internet browser they use and make the desired settings there.
Further information and Google’s applicable privacy policy are available at https://www.google.de/intl/de/policies/privacy/.
We have integrated Google Ads into our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads allows our website to be promoted through interest-based advertising on third-party websites and in the search results of the Google search engine, and allows third-party advertising to be displayed on our website. If a user clicks on a Google Ads advertisement, a conversion cookie is placed on the user’s computer. Conversion cookies do not serve to identify users. Conversion cookies are used to track which sub-pages of our website were accessed and whether a sale was completed or abandoned. The personal data is stored by Google in the USA. Google may pass it on to third parties.
The legal basis for processing personal data using cookies for analysis purposes is Art. 6(1)(a) GDPR.
Google Ads makes it possible to display internet advertising in Google’s search results and in the Google advertising network. For this purpose we define keywords in advance, by means of which an advertisement is displayed in Google’s search results only when the user retrieves a keyword-relevant search result. Within the Google advertising network, the advertisements are distributed to topic-relevant websites by an automatic algorithm and in accordance with the previously defined keywords. The data obtained helps us optimise our advertisements.
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure. We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Right to object and to have data removed
Cookies are stored on the user’s computer and transmitted from it, so users have full control over their use. By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all of its functions to their full extent.
Data subjects may also object to interest-based advertising by Google. To do so, the data subject must open the link www.google.de/settings/ads from each internet browser they use and make the desired settings there.
Data subjects may also object to interest-based advertising by Google. To do so, the data subject must open the link www.google.de/settings/ads from each internet browser they use and make the desired settings there.
Further information and Google’s applicable privacy policy are available at https://www.google.de/intl/de/policies/privacy/.
Facebook Analytics
Description and scope of the data processing
Our app uses the web analytics service Facebook Analytics. The provider is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider uses technologies that make it possible to collect user data providing information about how mobile websites and apps are used, and to serve individualised advertising. Depending on the operating system used, either a cookie (Android) is set or the advertising identifier (iOS) is used.
Further information is available at https://www.facebook.com/about/privacy/.
Legal basis for the data processing
The legal basis for processing users‘ personal data is Art. 6(1)(a) GDPR.
Purpose of the data processing
Processing users‘ personal data makes it possible to analyse our users‘ browsing behaviour and to display personalised advertising.
Storage period
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure.
We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Right to object and to have data removed
Users have the option of opting out of data collection. In addition, device settings can be chosen so that no interest-based advertising is displayed.
Google AdMob
Description and scope of the data processing
This website uses the web advertising service Google AdMob. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The provider uses technologies that make it possible to collect user data. Depending on the operating system used, either a cookie for advertising preferences is set in the mobile browser (Android) or the advertising identifier (iOS) is used for this purpose. These technologies provide information about how mobile websites and apps are used and make individualised advertising possible.
Further information is available at https://policies.google.com/privacy.
Legal basis for the data processing
The legal basis for processing users‘ personal data is Art. 6(1)(a) GDPR.
Purpose of the data processing
Processing users‘ personal data allows us to analyse our users‘ browsing behaviour with regard to the integration and display of advertisements in our app. By evaluating the data obtained, we are able to compile information about the use of the individual components of our app, including the advertisements displayed in it.
Storage period
Your data is erased when it is no longer required for our business processes and no statutory retention obligations prevent erasure. We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Right to object and to have data removed
Users have the option of opting out of data collection. In addition, device settings can be chosen so that no interest-based advertising is displayed.
Transfer of data to social media services
The website does not embed social media plugins directly. Profiling by third parties is therefore ruled out.
In order to allow our content to be shared via Pinterest, Instagram, Facebook, Twitter, XING or Google+, we use the two-click solution.
Data is only transmitted to the operator of the respective social media service once you decide to share a post via the corresponding button and click on it.
We recommend that you first read the privacy policy of the social media service you wish to use, so that you are informed about the purpose and scope of the data collection, the further processing and use of the data, and your related rights and settings options for protecting your privacy.
You can find them here:
Facebook: https://www.facebook.com/about/privacy/
Google+: https://www.google.com/intl/de/policies/
Instagram: https://www.instagram.com/about/legal/privacy/
When you access these providers‘ external content, you consent in accordance with Art. 49(1)(1)(a) GDPR to your data being processed in the USA, whose level of data protection the European Court of Justice considers inadequate. In particular, there is a risk that your data may be processed by US authorities for monitoring and surveillance purposes without any legal remedy being available.
Following consent, the legal basis is Art. 6(1)(a) GDPR.
We have integrated YouTube components into our website. YouTube is an internet video portal that allows video publishers to upload video clips free of charge and other users to view, rate and comment on them, likewise free of charge. YouTube permits the publication of all types of video, which is why complete films and television programmes, as well as music videos, trailers and videos made by users themselves, can be accessed via the portal.
The YouTube service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The website does not embed YouTube videos directly. Profiling by third parties is therefore ruled out.
To watch our videos, users must first click on the preview image. The video can only be viewed after consent has been given or after logging in. Data is only transmitted at that moment.
Further information is available at http://www.youtube.com/t/privacy_guidelines and in the privacy policy published by YouTube, available at https://www.google.de/intl/de/policies/privacy/. These explain the collection, processing and use of personal data by Google.
When you access these providers‘ external content, you consent in accordance with Art. 49(1)(1)(a) GDPR to your data being processed in the USA, whose level of data protection the European Court of Justice considers inadequate. In particular, there is a risk that your data may be processed by US authorities for monitoring and surveillance purposes without any legal remedy being available.
Following consent, the legal basis is Art. 6(1)(a) GDPR.
Transfer of data to improve website functionality
Google Fonts
Description and scope of the data processing
This website uses external fonts, known as Google Fonts. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When the website is accessed, the font files are loaded from Google Inc.’s server. These servers may also be located in the USA. This transmits, for example, which pages the user has accessed and the IP address of the user’s device.
Further information is available at https://developers.google.com/fonts/faq?hl=de-DE&csw= or at https://policies.google.com/?hl=de.
Legal basis for the data processing
The legal basis for processing users‘ personal data is Art. 6(1)(a) GDPR.
Purpose of the data processing
We receive no information or analyses from Google Inc. about the data it collects and have no control over it.
Using Google Fonts improves and optimises the presentation and display of the website.
Storage period
We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Right to object and to have data removed
We are not aware of any way to object or to have the data removed.
Description and scope of the data processing
We have integrated map material from Google Maps into our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Using Google Maps may transmit information about the use of the website (click behaviour, including your IP address) to the provider. The data may be transmitted to one of the provider’s servers in the USA and stored there.
Further information is available at https://policies.google.com/privacy?hl=de.
Legal basis for the data processing
The legal basis for processing the data is Art. 6(1)(a) GDPR.
Purpose of the data processing
We embed the provider’s map data to display our location and to make it easier to find.
Storage period
We have no influence over the storage of the data by the provider. You can reach the provider using the contact details given above.
Right to object and to have data removed
Users can prevent the transmission of data to the provider by disabling JavaScript.
Any person affected by the processing of personal data may request confirmation from the controller as to whether personal data concerning them is being processed.
Where such processing takes place, you may request the following information from the controller:
the purposes of the processing
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data concerned has been or will be disclosed
the envisaged period for which the personal data concerning you will be stored or, if specific details are not possible, the criteria used to determine that period
the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing
the existence of a right to lodge a complaint with a supervisory authority
any available information about the origin of the data where the personal data is not collected from the data subject
the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
Data subjects also have the right to request information as to whether the personal data concerning them is transferred to a third country or to an international organisation. In this context you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
Where data is processed for scientific, historical or statistical research purposes:
This right of access may be restricted in so far as it is likely to render impossible or seriously impair the achievement of the research or statistical purposes, and the restriction is necessary for the fulfilment of those purposes.
Data subjects have the right to obtain rectification and/or completion from the controller where the personal data processed concerning them is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
Where data is processed for scientific, historical or statistical research purposes:
Your right to rectification may be restricted in so far as it is likely to render impossible or seriously impair the achievement of the research or statistical purposes, and the restriction is necessary for the fulfilment of those purposes.
Data subjects may request the restriction of the processing of personal data concerning them under the following conditions:
where the accuracy of the personal data concerned is contested, for a period enabling the controller to verify the accuracy of the personal data
the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use
the controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims, or
where the data subject has objected to the processing pursuant to Art. 21(1) GDPR and it is not yet clear whether the controller’s legitimate grounds override those of the data subject.
Where the processing of the personal data concerned has been restricted, such data may – apart from being stored – only be processed with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
Where processing has been restricted under the above conditions, the data subject will be informed by the controller before the restriction is lifted.
Where data is processed for scientific, historical or statistical research purposes:
The data subject’s right to restriction of processing may be restricted in so far as it is likely to render impossible or seriously impair the achievement of the research or statistical purposes, and the restriction is necessary for the fulfilment of those purposes.
Data subjects may request that the controller erase the personal data concerning them without undue delay, and the controller is obliged to erase that data without undue delay where one of the following grounds applies:
the personal data concerned is no longer necessary for the purposes for which it was collected or otherwise processed;
the data subject has withdrawn the consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing;
the data subject objects to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR;
the personal data has been unlawfully processed;
the erasure of the personal data concerned is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject;
the personal data concerned was collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.
Where the controller has made the personal data concerned public and is obliged to erase it pursuant to Art. 17(1) GDPR, it shall take reasonable steps, including of a technical nature, taking account of available technology and the cost of implementation, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to, or copies or replications of, that personal data.
The right to erasure does not apply in so far as the processing is necessary
for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, in so far as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
for the establishment, exercise or defence of legal claims.
Where the data subject has exercised the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate that rectification, erasure or restriction to all recipients to whom the personal data concerned has been disclosed, unless this proves impossible or involves disproportionate effort. The data subject has the right to be informed by the controller about those recipients.
Data subjects have the right to receive the personal data concerning them which they have provided to the controller in a structured, commonly used and machine-readable format. Data subjects also have the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where
the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract pursuant to Art. 6(1)(b) GDPR, and
the processing is carried out by automated means.
In exercising this right, data subjects also have the right to have the personal data concerning them transmitted directly from one controller to another, where technically feasible. This must not adversely affect the freedoms and rights of others.
The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Data subjects have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.
The controller will no longer process the personal data concerned unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or where the processing serves the establishment, exercise or defence of legal claims.
Where the personal data concerned is processed for direct marketing purposes, data subjects have the right to object at any time to the processing of personal data concerning them for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
Where data subjects object to processing for direct marketing purposes, the personal data concerning them will no longer be processed for those purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, data subjects may exercise their right to object by automated means using technical specifications.
Where data is processed for scientific, historical or statistical research purposes:
Data subjects also have the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them carried out for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR.
The right to object may be restricted in so far as it is likely to render impossible or seriously impair the achievement of the research or statistical purposes, and the restriction is necessary for the fulfilment of those purposes.
Data subjects have the right to withdraw their consent under data protection law at any time. Withdrawing consent does not affect the lawfulness of the processing carried out on the basis of that consent up to the point of withdrawal.
Data subjects have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning them or similarly significantly affects them. This does not apply where the decision
is necessary for entering into, or performance of, a contract between the data subject and the controller
is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or
is based on the data subject’s explicit consent
However, such decisions must not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to safeguard rights and freedoms and your legitimate interests are in place.
In the cases referred to in points 1 and 3, the controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of personal data concerning them infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.