Privacy Policy (GDPR-compliant)
Privacy Policy
1. Information on the collection of personal data and contact details of the controller
2. Data collection when visiting our website
3. Contacting us
4. Cookies
5. Data processing for order fulfillment
6. Data processing when opening a customer account and for contract fulfillment
7. Use of your data for direct marketing
8. Tools and Miscellaneous
9. Rights of the data subject
10. Duration of storage of personal data
1. Information on the collection of personal data and contact details of the controller
1.1. Thank you for visiting our website. Below, we would like to inform you about the handling of your personal data when using our website. Personal data is generally all data with which you can be personally identified.
1.2. The controller for data processing on our website in the sense of the General Data Protection Regulation (GDPR) is:
XOXO HAMBURG UG
Hochallee 118
20149 Hamburg
Germany
Tel.: 040-39894395
Email: mail@xoxo-hamburg.de
1.3. To protect the security of your data during transmission, we use encryption methods (e.g., SSL or TSL) via HTTPS that comply with the current state of technology.
2. Data collection when visiting our website
Each time our website is accessed, our system automatically collects data and information that your browser transmits to our server (so-called "server log files"). The following data, which is technically necessary for us, is collected:
We reserve the right to check the server log files retrospectively if there are concrete indications of illegal use. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended.
In the case of data storage in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the IP addresses of the users are deleted or alienated so that it is no longer possible to assign the calling client. The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.
3. Contact
If you contact us via the contact form, the data entered in the input mask will be transmitted to us and stored. The collected data can be found in the respective input mask. When contacting us by e-mail, only the data entered by you there will be transmitted to us.
The data will be used exclusively for processing the conversation and your request. The legal basis for the processing of the data is, if the user has given his consent, Art. 6 (1) lit. a) GDPR. The legal basis for the processing of data transmitted during the course of sending an e-mail is Art. 6 (1) lit. f) GDPR. If the e-mail contact aims at the conclusion of a contract, then an additional legal basis for the processing is Art. 6 (1) lit. b) GDPR. The data will be deleted as soon as they are no longer required for the purpose of their collection and provided that no legal retention periods prevent this. For personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter concerned has been conclusively clarified. The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.
4. Cookies
Our website uses cookies.
Cookies are text files that are stored on the user's device. If a user calls up a website, a cookie can be stored on the user's operating system. Some functions of our website cannot be offered without the use of cookies. For this, it is necessary that the browser is recognized again after a page change. The user data collected by technically necessary cookies are not used to create user profiles. Our legitimate interest in the processing of personal data according to Art. 6 (1) lit. f) GDPR also lies in the aforementioned purposes.
In addition, our website may use cookies that enable an analysis of the user's surfing behavior (so-called third-party cookies). More detailed information on the scope, purpose, legal basis and objection options can be found in the respective sections of the respective chapter of this privacy policy.
As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate, restrict or delete the transmission of cookies. If you deactivate cookies for our website, not all functions of the website may be fully usable. You can prevent the transmission of Flash cookies by changing the settings of the Flash Player.
You can find help for the settings in the respective help menu of your browser under the following links:
Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Some of the cookies used here are deleted after closing your browser (so-called session cookies). Other cookies remain on your device and allow us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies). If cookies are set, they collect and process certain user information to an individual extent, such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.
5. Data processing for order fulfillment
5.1. If you wish to order from our webshop, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the processing of your order. We process the data provided by you for the processing of your order.
In some cases, we work with external service providers to process your order. For this, we must pass on the necessary personal data.
If we commission transport companies with the delivery of your goods, we pass on your data required for the delivery of the goods to the respective transport company. For the processing of payments, we pass on your data to the commissioned credit institution as far as necessary. If we use payment service providers, you will also be informed about this below.
The legal basis for the transfer of your data is Art. 6 (1) lit. b GDPR.
5.2. Use of payment service providers
- Amazon Pay
When paying via "Amazon Pay", payment processing is carried out by Amazon Payments Europe s.c.a., 5 Rue Plaetis, L-2338 Luxembourg (hereinafter: "Amazon Payments"). The seller passes on the information provided by the customer during the ordering process in accordance with Art. 6 (1) lit. b GDPR exclusively for the purpose of payment processing and only to the extent necessary to Amazon Payments. Further information on the data protection regulations of Amazon Payments can be found here: https://pay.amazon.com/de/help/201751600
- PayPal
If you choose the payment method PayPal, credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal, the payment processing is carried out by PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal").
We pass on your personal data in accordance with Art. 6 (1) lit. b GDPR to PayPal to the extent necessary. PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal.
For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 (1) lit. f GDPR due to PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check regarding the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method.
The credit check can contain probability values (so-called score values). Insofar as score values are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, but not exclusively, are included in the calculation of the score values.
What other data is collected by PayPal results from PayPal's respective privacy policy. This can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.
- Shopify Payments
We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered by the payment service provider Shopify Payments, payment processing is carried out by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on your information communicated during the ordering process, together with information about your order (name, address, account number, bank code, possibly credit card number, invoice amount, currency and transaction number) in accordance with Art. 6 (1) lit. b GDPR. The transfer of your data is exclusively for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent necessary for this. Further information on data protection from Shopify Payments can be found at the following internet address: https://www.shopify.com/legal/privacy
Data protection information on Stripe Payments Europe Ltd. can be found here: https://stripe.com/de/privacy
6. Data processing for opening a customer account and for contract fulfillment
If you open a customer account with us, personal data will be collected and processed in accordance with Art. 6 (1) lit. b DGSVO. The scope of the data can be seen from the input form. The data entered by you will be stored and used by us for contract fulfillment.
You can delete your customer account at any time. This can be done by sending a message to the address of the controller or, if offered, directly in the customer account. In this case, we will also block your data with regard to tax and commercial law retention periods and delete it after these periods have expired. This can only be opposed by your consent to permanent storage or by further data use permitted by law on our part.
7. Use of your data for direct marketing
Newsletter
On our website, there is the possibility to subscribe to a free newsletter. When subscribing to the newsletter, the data from the input mask are transmitted to us. Only your email address is mandatory. If you make further voluntary entries, these will only be used for personal addressing.
The legal basis for the processing of your data after subscribing to the newsletter is, if the user has given his consent, Art. 6 (1) lit. a GDPR. We obtain this by sending you a confirmation email after subscribing to the newsletter, which contains a confirmation link. If you click on this link, you also give your consent to receive the newsletter.
When sending the newsletter subscription, we store your IP address as well as the date and time of registration. This storage serves to enable us to trace any misuse of your e-mail address.
We use the data collected by us when subscribing to the newsletter exclusively for the purpose of sending the newsletter.
You can cancel your newsletter subscription at any time. For this purpose, a corresponding link is provided in every newsletter. This also enables the revocation of consent to the storage of personal data collected during the registration process.
8. Tools and Miscellaneous
8.1. Google reCAPTCHA
We use the reCAPTCHA function of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") in accordance with Art. 6 (1) lit. f GDPR due to our legitimate interest in preventing misuse and spam.
reCAPTCHA is a function that is intended to ensure that an entry is made by a natural person.
The service sends your IP address and, if applicable, other data required by Google for the reCAPTCHA service to Google.
When using Google reCAPTCHA, your personal data may also be transferred to the servers of Google LLC. in the USA.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/. as well as in Google's privacy policy: https://www.google.com/policies/privacy/
8.2. CloudFlare
We use the provider Cloudflare (CloudFlare, Inc. 665 3rd St. #200, San Francisco, CA 94107, USA). CloudFlare offers a globally distributed Content Delivery Network with DNS.
With the help of a CDN, large files, graphics and scripts can be delivered faster and better by regional servers connected via the Internet. The processing of user data is carried out only for the aforementioned purposes and to maintain the security and functionality of the CDN. For this, the browser you are using must connect to the CDN servers. This transmits your IP address to the server. Under certain circumstances, Cloudflare also stores cookies on your computer with your permission in accordance with Art. 6 lit. a GDPR.
We have concluded a corresponding agreement for order processing with Cloudflare on the basis of the GDPR and the EU standard contractual clauses.
Cloudflare may collect statistical data about visits to this website.
The following is collected:
Name of the accessed website, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Cloudflare uses the log data for statistical evaluations for the purpose of operation, security and optimization of the offer. You can find more information on data protection at Cloudflare under the following link:
https://www.cloudflare.com/de-de/privacypolicy/
The data transfer is protected by standard contractual clauses:
https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf
9. Rights of the data subject
9.1. The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:
- Right of access according to Art. 15 GDPR:
You can request confirmation from the controller as to whether personal data concerning you are being processed by the controller. In addition, you have a right to information about the purpose, the categories of personal data, the recipients, the planned duration of storage and about the existence of further rights such as the rectification of data or the existence of a right to lodge a complaint with a supervisory authority, the origin of your data if they were not collected by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved and the significance and the envisaged consequences of such processing for you, as well as your right to be informed about the guarantees according to Art. 46 GDPR when your data is transferred to third countries;
- Right to rectification according to Art. 16 GDPR:
You have a right to immediate rectification of inaccurate data concerning you and/or the completion of your incomplete data stored by us; the rectification or completion must be carried out without delay.
- Right to restriction of processing according to Art. 18 GDPR:
You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data disputed by you is being verified, if you refuse a deletion of your data due to unlawful data processing and instead request the restriction of the processing of your data, if you need your data for the assertion, exercise or defense of legal claims after we no longer need this data after the purpose has been achieved or if you have objected for reasons arising from your particular situation, as long as it has not yet been determined whether our legitimate reasons outweigh yours;
If the processing of personal data concerning you has been restricted, these data – apart from their storage – may only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or a Member State. If the restriction of processing has been restricted, you will be informed by the controller before the restriction is lifted.
- Right to erasure according to Art. 17 GDPR:
You have the right to the immediate erasure of your personal data if the requirements of Art. 17 (1) GDPR are met.However, this right to erasure does not exist, in particular – but not exclusively – if the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
- Right to information according to Art. 19 GDPR:
If you have exercised your right to rectification, erasure or restriction of processing, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You also have the right to be informed about these recipients.
- Right to data portability according to Art. 20 GDPR:
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, or to request transmission to another controller, where technically feasible;
- Right to object according to Art. 7 (3) GDPR:
You have the right to object at any time to the processing of personal data concerning you which is based on Art. 6 (1) lit. e) or f) GDPR; this also applies to profiling based on these provisions.
You also have the right to withdraw your data protection consent declaration at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint according to Art. 77 GDPR:
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
9.2. Right to object
You have the right to object to the processing of your data at any time with effect for the future if we process your data based on our overriding legitimate interest after a balancing of interests.
If you exercise this right to object, we will cease processing your data unless there are demonstrably overriding legitimate grounds for the processing that outweigh your interests, or the continued processing serves the establishment, exercise, or defense of legal claims.
10. Duration of storage of personal data
The duration of the storage of personal data depends on statutory retention periods. After their expiry, we routinely delete the data if they are no longer required for contract fulfillment or initiation and/or if we no longer have a legitimate interest in further storage.
1. Information on the collection of personal data and contact details of the controller
2. Data collection when visiting our website
3. Contacting us
4. Cookies
5. Data processing for order fulfillment
6. Data processing when opening a customer account and for contract fulfillment
7. Use of your data for direct marketing
8. Tools and Miscellaneous
9. Rights of the data subject
10. Duration of storage of personal data
1. Information on the collection of personal data and contact details of the controller
1.1. Thank you for visiting our website. Below, we would like to inform you about the handling of your personal data when using our website. Personal data is generally all data with which you can be personally identified.
1.2. The controller for data processing on our website in the sense of the General Data Protection Regulation (GDPR) is:
XOXO HAMBURG UG
Hochallee 118
20149 Hamburg
Germany
Tel.: 040-39894395
Email: mail@xoxo-hamburg.de
1.3. To protect the security of your data during transmission, we use encryption methods (e.g., SSL or TSL) via HTTPS that comply with the current state of technology.
2. Data collection when visiting our website
Each time our website is accessed, our system automatically collects data and information that your browser transmits to our server (so-called "server log files"). The following data, which is technically necessary for us, is collected:
- Our visited website
- Date and time of access
- Amount of data sent in bytes
- Source/referrer from which you reached the page
- Operating system used
- Browser used
- IP address used (if applicable: in anonymized form)
We reserve the right to check the server log files retrospectively if there are concrete indications of illegal use. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended.
In the case of data storage in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the IP addresses of the users are deleted or alienated so that it is no longer possible to assign the calling client. The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.
3. Contact
If you contact us via the contact form, the data entered in the input mask will be transmitted to us and stored. The collected data can be found in the respective input mask. When contacting us by e-mail, only the data entered by you there will be transmitted to us.
The data will be used exclusively for processing the conversation and your request. The legal basis for the processing of the data is, if the user has given his consent, Art. 6 (1) lit. a) GDPR. The legal basis for the processing of data transmitted during the course of sending an e-mail is Art. 6 (1) lit. f) GDPR. If the e-mail contact aims at the conclusion of a contract, then an additional legal basis for the processing is Art. 6 (1) lit. b) GDPR. The data will be deleted as soon as they are no longer required for the purpose of their collection and provided that no legal retention periods prevent this. For personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter concerned has been conclusively clarified. The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.
4. Cookies
Our website uses cookies.
Cookies are text files that are stored on the user's device. If a user calls up a website, a cookie can be stored on the user's operating system. Some functions of our website cannot be offered without the use of cookies. For this, it is necessary that the browser is recognized again after a page change. The user data collected by technically necessary cookies are not used to create user profiles. Our legitimate interest in the processing of personal data according to Art. 6 (1) lit. f) GDPR also lies in the aforementioned purposes.
In addition, our website may use cookies that enable an analysis of the user's surfing behavior (so-called third-party cookies). More detailed information on the scope, purpose, legal basis and objection options can be found in the respective sections of the respective chapter of this privacy policy.
As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate, restrict or delete the transmission of cookies. If you deactivate cookies for our website, not all functions of the website may be fully usable. You can prevent the transmission of Flash cookies by changing the settings of the Flash Player.
You can find help for the settings in the respective help menu of your browser under the following links:
Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Some of the cookies used here are deleted after closing your browser (so-called session cookies). Other cookies remain on your device and allow us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies). If cookies are set, they collect and process certain user information to an individual extent, such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.
5. Data processing for order fulfillment
5.1. If you wish to order from our webshop, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the processing of your order. We process the data provided by you for the processing of your order.
In some cases, we work with external service providers to process your order. For this, we must pass on the necessary personal data.
If we commission transport companies with the delivery of your goods, we pass on your data required for the delivery of the goods to the respective transport company. For the processing of payments, we pass on your data to the commissioned credit institution as far as necessary. If we use payment service providers, you will also be informed about this below.
The legal basis for the transfer of your data is Art. 6 (1) lit. b GDPR.
5.2. Use of payment service providers
- Amazon Pay
When paying via "Amazon Pay", payment processing is carried out by Amazon Payments Europe s.c.a., 5 Rue Plaetis, L-2338 Luxembourg (hereinafter: "Amazon Payments"). The seller passes on the information provided by the customer during the ordering process in accordance with Art. 6 (1) lit. b GDPR exclusively for the purpose of payment processing and only to the extent necessary to Amazon Payments. Further information on the data protection regulations of Amazon Payments can be found here: https://pay.amazon.com/de/help/201751600
- PayPal
If you choose the payment method PayPal, credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal, the payment processing is carried out by PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal").
We pass on your personal data in accordance with Art. 6 (1) lit. b GDPR to PayPal to the extent necessary. PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal.
For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 (1) lit. f GDPR due to PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check regarding the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method.
The credit check can contain probability values (so-called score values). Insofar as score values are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, but not exclusively, are included in the calculation of the score values.
What other data is collected by PayPal results from PayPal's respective privacy policy. This can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.
- Shopify Payments
We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered by the payment service provider Shopify Payments, payment processing is carried out by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on your information communicated during the ordering process, together with information about your order (name, address, account number, bank code, possibly credit card number, invoice amount, currency and transaction number) in accordance with Art. 6 (1) lit. b GDPR. The transfer of your data is exclusively for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent necessary for this. Further information on data protection from Shopify Payments can be found at the following internet address: https://www.shopify.com/legal/privacy
Data protection information on Stripe Payments Europe Ltd. can be found here: https://stripe.com/de/privacy
6. Data processing for opening a customer account and for contract fulfillment
If you open a customer account with us, personal data will be collected and processed in accordance with Art. 6 (1) lit. b DGSVO. The scope of the data can be seen from the input form. The data entered by you will be stored and used by us for contract fulfillment.
You can delete your customer account at any time. This can be done by sending a message to the address of the controller or, if offered, directly in the customer account. In this case, we will also block your data with regard to tax and commercial law retention periods and delete it after these periods have expired. This can only be opposed by your consent to permanent storage or by further data use permitted by law on our part.
7. Use of your data for direct marketing
Newsletter
On our website, there is the possibility to subscribe to a free newsletter. When subscribing to the newsletter, the data from the input mask are transmitted to us. Only your email address is mandatory. If you make further voluntary entries, these will only be used for personal addressing.
The legal basis for the processing of your data after subscribing to the newsletter is, if the user has given his consent, Art. 6 (1) lit. a GDPR. We obtain this by sending you a confirmation email after subscribing to the newsletter, which contains a confirmation link. If you click on this link, you also give your consent to receive the newsletter.
When sending the newsletter subscription, we store your IP address as well as the date and time of registration. This storage serves to enable us to trace any misuse of your e-mail address.
We use the data collected by us when subscribing to the newsletter exclusively for the purpose of sending the newsletter.
You can cancel your newsletter subscription at any time. For this purpose, a corresponding link is provided in every newsletter. This also enables the revocation of consent to the storage of personal data collected during the registration process.
8. Tools and Miscellaneous
8.1. Google reCAPTCHA
We use the reCAPTCHA function of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") in accordance with Art. 6 (1) lit. f GDPR due to our legitimate interest in preventing misuse and spam.
reCAPTCHA is a function that is intended to ensure that an entry is made by a natural person.
The service sends your IP address and, if applicable, other data required by Google for the reCAPTCHA service to Google.
When using Google reCAPTCHA, your personal data may also be transferred to the servers of Google LLC. in the USA.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/. as well as in Google's privacy policy: https://www.google.com/policies/privacy/
8.2. CloudFlare
We use the provider Cloudflare (CloudFlare, Inc. 665 3rd St. #200, San Francisco, CA 94107, USA). CloudFlare offers a globally distributed Content Delivery Network with DNS.
With the help of a CDN, large files, graphics and scripts can be delivered faster and better by regional servers connected via the Internet. The processing of user data is carried out only for the aforementioned purposes and to maintain the security and functionality of the CDN. For this, the browser you are using must connect to the CDN servers. This transmits your IP address to the server. Under certain circumstances, Cloudflare also stores cookies on your computer with your permission in accordance with Art. 6 lit. a GDPR.
We have concluded a corresponding agreement for order processing with Cloudflare on the basis of the GDPR and the EU standard contractual clauses.
Cloudflare may collect statistical data about visits to this website.
The following is collected:
Name of the accessed website, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Cloudflare uses the log data for statistical evaluations for the purpose of operation, security and optimization of the offer. You can find more information on data protection at Cloudflare under the following link:
https://www.cloudflare.com/de-de/privacypolicy/
The data transfer is protected by standard contractual clauses:
https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf
9. Rights of the data subject
9.1. The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:
- Right of access according to Art. 15 GDPR:
You can request confirmation from the controller as to whether personal data concerning you are being processed by the controller. In addition, you have a right to information about the purpose, the categories of personal data, the recipients, the planned duration of storage and about the existence of further rights such as the rectification of data or the existence of a right to lodge a complaint with a supervisory authority, the origin of your data if they were not collected by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved and the significance and the envisaged consequences of such processing for you, as well as your right to be informed about the guarantees according to Art. 46 GDPR when your data is transferred to third countries;
- Right to rectification according to Art. 16 GDPR:
You have a right to immediate rectification of inaccurate data concerning you and/or the completion of your incomplete data stored by us; the rectification or completion must be carried out without delay.
- Right to restriction of processing according to Art. 18 GDPR:
You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data disputed by you is being verified, if you refuse a deletion of your data due to unlawful data processing and instead request the restriction of the processing of your data, if you need your data for the assertion, exercise or defense of legal claims after we no longer need this data after the purpose has been achieved or if you have objected for reasons arising from your particular situation, as long as it has not yet been determined whether our legitimate reasons outweigh yours;
If the processing of personal data concerning you has been restricted, these data – apart from their storage – may only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or a Member State. If the restriction of processing has been restricted, you will be informed by the controller before the restriction is lifted.
- Right to erasure according to Art. 17 GDPR:
You have the right to the immediate erasure of your personal data if the requirements of Art. 17 (1) GDPR are met.However, this right to erasure does not exist, in particular – but not exclusively – if the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
- Right to information according to Art. 19 GDPR:
If you have exercised your right to rectification, erasure or restriction of processing, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You also have the right to be informed about these recipients.
- Right to data portability according to Art. 20 GDPR:
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, or to request transmission to another controller, where technically feasible;
- Right to object according to Art. 7 (3) GDPR:
You have the right to object at any time to the processing of personal data concerning you which is based on Art. 6 (1) lit. e) or f) GDPR; this also applies to profiling based on these provisions.
You also have the right to withdraw your data protection consent declaration at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint according to Art. 77 GDPR:
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
9.2. Right to object
You have the right to object to the processing of your data at any time with effect for the future if we process your data based on our overriding legitimate interest after a balancing of interests.
If you exercise this right to object, we will cease processing your data unless there are demonstrably overriding legitimate grounds for the processing that outweigh your interests, or the continued processing serves the establishment, exercise, or defense of legal claims.
10. Duration of storage of personal data
The duration of the storage of personal data depends on statutory retention periods. After their expiry, we routinely delete the data if they are no longer required for contract fulfillment or initiation and/or if we no longer have a legitimate interest in further storage.