Angaben gemäß § 5 TMG:
Max Kissler Photodesign
Max Kißler
Gasteiner Str. 33
10717 Berlin
Contact / Kontakt:
+4915736564686
info@maxkissler.com
VAT-No / Umsatzsteuer-ID:
DE283467190
We are very delighted that youhave shown interest in our enterprise. Data protection is of a particularlyhigh priority for the management of Max Kissler Photodesign. The use of theInternet pages of Max Kissler Photodesign is possible without anyindication of personal data; however, if a data subject wants to use specialenterprise services via our website, processing of personal data could becomenecessary. If the processing of personal data is necessary and there is nostatutory basis for such processing, we generally obtain consent from the datasubject.
The processing of personaldata, such as the name, address, e-mail address, or telephone number of a datasubject shall always be in line with the General Data Protection Regulation(GDPR), and in accordance with the country-specific data protection regulationsapplicable to Max Kissler Photodesign. By means of this data protectiondeclaration, our enterprise would like to inform the general public of thenature, scope, and purpose of the personal data we collect, use and process.Furthermore, data subjects are informed, by means of this data protection declaration,of the rights to which they are entitled.
As the controller, Max Kissler Photodesign has implemented numerous technical and organizationalmeasures to ensure the most complete protection of personal data processedthrough this website. However, Internet-based data transmissions may inprinciple have security gaps, so absolute protection may not be guaranteed. Forthis reason, every data subject is free to transfer personal data to us viaalternative means, e.g. by telephone.
The data protectiondeclaration of Max Kissler Photodesign is based on the terms used by theEuropean legislator for the adoption of the General Data Protection Regulation(GDPR). Our data protection declaration should be legible and understandablefor the general public, as well as our customers and business partners. Toensure this, we would like to first explain the terminology used.
In this data protectiondeclaration, we use, inter alia, the following terms:
Personaldata means any information relating to an identified or identifiable naturalperson (“data subject”). An identifiable natural person is one who can beidentified, directly or indirectly, in particular by reference to an identifiersuch as a name, an identification number, location data, an online identifieror to one or more factors specific to the physical, physiological, genetic,mental, economic, cultural or social identity of that natural person.
Data subjectis any identified or identifiable natural person, whose personal data isprocessed by the controller responsible for the processing.
Processingis any operation or set of operations which is performed on personal data or onsets of personal data, whether or not by automated means, such as collection,recording, organisation, structuring, storage, adaptation or alteration,retrieval, consultation, use, disclosure by transmission, dissemination orotherwise making available, alignment or combination, restriction, erasure ordestruction.
Restriction of processing is the marking of stored personal data with the aim of limitingtheir processing in the future.
Profilingmeans any form of automated processing of personal data consisting of the useof personal data to evaluate certain personal aspects relating to a naturalperson, in particular to analyse or predict aspects concerning that naturalperson's performance at work, economic situation, health, personal preferences,interests, reliability, behaviour, location or movements.
Pseudonymisationis the processing of personal data in such a manner that the personal data canno longer be attributed to a specific data subject without the use ofadditional information, provided that such additional information is keptseparately and is subject to technical and organisational measures to ensurethat the personal data are not attributed to an identified or identifiable naturalperson.
Controlleror controller responsible for the processing is the natural or legal person,public authority, agency or other body which, alone or jointly with others,determines the purposes and means of the processing of personal data; where thepurposes and means of such processing are determined by Union or Member Statelaw, the controller or the specific criteria for its nomination may be providedfor by Union or Member State law.
Processor isa natural or legal person, public authority, agency or other body whichprocesses personal data on behalf of the controller.
Recipient isa natural or legal person, public authority, agency or another body, to whichthe personal data are disclosed, whether a third party or not. However, publicauthorities which may receive personal data in the framework of a particularinquiry in accordance with Union or Member State law shall not be regarded asrecipients; the processing of those data by those public authorities shall bein compliance with the applicable data protection rules according to thepurposes of the processing.
Third partyis a natural or legal person, public authority, agency or body other than thedata subject, controller, processor and persons who, under the direct authorityof the controller or processor, are authorised to process personal data.
Consent ofthe data subject is any freely given, specific, informed and unambiguousindication of the data subject's wishes by which he or she, by a statement orby a clear affirmative action, signifies agreement to the processing ofpersonal data relating to him or her.
Controller for the purposes ofthe General Data Protection Regulation (GDPR), other data protection lawsapplicable in Member states of the European Union and other provisions relatedto data protection is:
Max Kissler Photodesign
Gasteiner Str. 33
10717 Berlin, Germany
Phone: +4915736564686
Email: info@maxkissler.com
Website: www.maxkissler.com
The website of Max KisslerPhotodesign collects a series of general data and information when a datasubject or automated system calls up the website. This general data andinformation are stored in the server log files. Collected may be (1) thebrowser types and versions used, (2) the operating system used by the accessingsystem, (3) the website from which an accessing system reaches our website(so-called referrers), (4) the sub-websites, (5) the date and time of access tothe Internet site, (6) an Internet protocol address (IP address), (7) theInternet service provider of the accessing system, and (8) any other similardata and information that may be used in the event of attacks on ourinformation technology systems.
When using these general dataand information, Max Kissler Photodesign does not draw any conclusions aboutthe data subject. Rather, this information is needed to (1) deliver the contentof our website correctly, (2) optimize the content of our website as well asits advertisement, (3) ensure the long-term viability of our informationtechnology systems and website technology, and (4) provide law enforcement authoritieswith the information necessary for criminal prosecution in case of acyber-attack. Therefore, Max Kissler Photodesign analyzes anonymously collecteddata and information statistically, with the aim of increasing the dataprotection and data security of our enterprise, and to ensure an optimal levelof protection for the personal data we process. The anonymous data of theserver log files are stored separately from all personal data provided by adata subject.
The website of Max KisslerPhotodesign contains information that enables a quick electronic contact to ourenterprise, as well as direct communication with us, which also includes ageneral address of the so-called electronic mail (e-mail address). If a datasubject contacts the controller by e-mail or via a contact form, the personaldata transmitted by the data subject are automatically stored. Such personaldata transmitted on a voluntary basis by a data subject to the data controllerare stored for the purpose of processing or contacting the data subject. Thereis no transfer of this personal data to third parties.
The data controller shallprocess and store the personal data of the data subject only for the periodnecessary to achieve the purpose of storage, or as far as this is granted bythe European legislator or other legislators in laws or regulations to whichthe controller is subject to.If the storage purpose is notapplicable, or if a storage period prescribed by the European legislator oranother competent legislator expires, the personal data are routinely blockedor erased in accordance with legal requirements.
Each datasubject shall have the right granted by the European legislator to obtain fromthe controller the confirmation as to whether or not personal data concerninghim or her are being processed. If a data subject wishes to avail himself ofthis right of confirmation, he or she may, at any time, contact any employee ofthe controller.
Each datasubject shall have the right granted by the European legislator to obtain fromthe controller free information about his or her personal data stored at anytime and a copy of this information. Furthermore, the European directives andregulations grant the data subject access to the following information:
-the purposes of the processing;
-the categories of personal data concerned;
-the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
-the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing;
-the existence of the right to lodge a complaint with a supervisory authority;
-where the personal data are not collected from the data subject, any available information as to their source;
-the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
Furthermore, the data subject shall have a right to obtain information as to whetherpersonal data are transferred to a third country or to an internationalorganisation. Where this is the case, the data subject shall have the right tobe informed of the appropriate safeguards relating to the transfer.
If a datasubject wishes to avail himself of this right of access, he or she may, at anytime, contact any employee of the controller.
Each datasubject shall have the right granted by the European legislator to obtain fromthe controller without undue delay the rectification of inaccurate personaldata concerning him or her. Taking into account the purposes of the processing,the data subject shall have the right to have incomplete personal datacompleted, including by means of providing a supplementary statement.If a datasubject wishes to exercise this right to rectification, he or she may, at anytime, contact any employee of the controller.
Each datasubject shall have the right granted by the European legislator to obtain fromthe controller the erasure of personal data concerning him or her without unduedelay, and the controller shall have the obligation to erase personal datawithout undue delay where one of the following grounds applies, as long as theprocessing is not necessary:
The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
The data subject withdraws consent to which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing.
The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.
The personal data have been unlawfully processed. The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.
If one ofthe aforementioned reasons applies, and a data subject wishes to request theerasure of personal data stored by Max Kissler Photodesign, he or she may, atany time, contact any employee of the controller. An employee of Max KisslerPhotodesign shall promptly ensure that the erasure request is complied withimmediately.
Where thecontroller has made personal data public and is obliged pursuant to Article17(1) to erase the personal data, the controller, taking account of availabletechnology and the cost of implementation, shall take reasonable steps,including technical measures, to inform other controllers processing thepersonal data that the data subject has requested erasure by such controllersof any links to, or copy or replication of, those personal data, as far asprocessing is not required. An employees of Max Kissler Photodesign willarrange the necessary measures in individual cases.
Each datasubject shall have the right granted by the European legislator to obtain fromthe controller restriction of processing where one of the following applies:
The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use instead.
The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
The data subject has objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
If one ofthe aforementioned conditions is met, and a data subject wishes to request therestriction of the processing of personal data stored by Max KisslerPhotodesign, he or she may at any time contact any employee of the controller.The employee of the Max Kissler Photodesign will arrange the restriction of theprocessing.
Each datasubject shall have the right granted by the European legislator, to receive thepersonal data concerning him or her, which was provided to a controller, in astructured, commonly used and machine-readable format. He or she shall have theright to transmit those data to another controller without hindrance from thecontroller to which the personal data have been provided, as long as theprocessing is based on consent pursuant to point (a) of Article 6(1) of theGDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant topoint (b) of Article 6(1) of the GDPR, and the processing is carried out byautomated means, as long as the processing is not necessary for the performanceof a task carried out in the public interest or in the exercise of officialauthority vested in the controller.
Furthermore,in exercising his or her right to data portability pursuant to Article 20(1) ofthe GDPR, the data subject shall have the right to have personal datatransmitted directly from one controller to another, where technically feasibleand when doing so does not adversely affect the rights and freedoms of others.In order toassert the right to data portability, the data subject may at any time contactany employee of Max Kissler Photodesign.
Each datasubject shall have the right granted by the European legislator to object, ongrounds relating to his or her particular situation, at any time, to processingof personal data concerning him or her, which is based on point (e) or (f) ofArticle 6(1) of the GDPR. This also applies to profiling based on these provisions.
Max Kissler Photodesign shall no longer process the personal data in the event ofthe objection, unless we can demonstrate compelling legitimate grounds for theprocessing which override the interests, rights and freedoms of the datasubject, or for the establishment, exercise or defence of legal claims.
If Max Kissler Photodesign processes personaldata for direct marketing purposes, the data subject shall have the right toobject at any time to processing of personal data concerning him or her forsuch marketing. This applies to profiling to the extent that it is related tosuch direct marketing. If the data subject objects to the Max KisslerPhotodesign to the processing for direct marketing purposes, the Max KisslerPhotodesign will no longer process the personal data for these purposes.
AIn addition, the data subject has the right, on grounds relating to his or her particularsituation, to object to processing of personal data concerning him or her by Max Kissler Photodesign for scientific or historical research purposes, orfor statistical purposes pursuant to Article 89(1) of the GDPR, unless theprocessing is necessary for the performance of a task carried out for reasonsof public interest.
In order toexercise the right to object, the data subject may contact any employee of theMax Kissler Photodesign. In addition, the data subject is free in the contextof the use of information society services, and notwithstanding Directive2002/58/EC, to use his or her right to object by automated means usingtechnical specifications.
Each datasubject shall have the right granted by the European legislator not to besubject to a decision based solely on automated processing, includingprofiling, which produces legal effects concerning him or her, or similarlysignificantly affects him or her, as long as the decision (1) is not isnecessary for entering into, or the performance of, a contract between the datasubject and a data controller, or (2) is not authorised by Union or Member Statelaw to which the controller is subject and which also lays down suitablemeasures to safeguard the data subject's rights and freedoms and legitimateinterests, or (3) is not based on the data subject's explicit consent.
If thedecision (1) is necessary for entering into, or the performance of, a contractbetween the data subject and a data controller, or (2) it is based on the datasubject's explicit consent, Max Kissler Photodesign shall implementsuitable measures to safeguard the data subject's rights and freedoms andlegitimate interests, at least the right to obtain human intervention on thepart of the controller, to express his or her point of view and contest thedecision.
If the datasubject wishes to exercise the rights concerning automated individualdecision-making, he or she may, at any time, contact any employee of Max Kissler Photodesign.
Each datasubject shall have the right granted by the European legislator to withdraw hisor her consent to processing of his or her personal data at any time.
If the datasubject wishes to exercise the right to withdraw the consent, he or she may, atany time, contact any employee of the Max Kissler Photodesign.
On this website, thecontroller has integrated Google AdSense. Google AdSense is an online servicewhich allows the placement of advertising on third-party sites. Google AdSense isbased on an algorithm that selects advertisements displayed on third-partysites to match with the content of the respective third-party site. GoogleAdSense allows an interest-based targeting of the Internet user, which isimplemented by means of generating individual user profiles.
The operating company of Google's AdSense component is Google Ireland Limited, Gordon House, BarrowStreet, Dublin, D04 E5W5, Ireland.
The purpose of Google'sAdSense component is the integration of advertisements on our website. GoogleAdSense places a cookie on the information technology system of the datasubject. The definition of cookies is explained above. With the setting of thecookie, Alphabet Inc. is enabled to analyze the use of our website. With eachcall-up to one of the individual pages of this Internet site, which is operatedby the controller and into which a Google AdSense component is integrated, theInternet browser on the information technology system of the data subject willautomatically submit data through the Google AdSense component for the purposeof online advertising and the settlement of commissions to Alphabet Inc. Duringthe course of this technical procedure, the enterprise Alphabet Inc. gainsknowledge of personal data, such as the IP address of the data subject, whichserves Alphabet Inc., inter alia, to understand the origin of visitors andclicks and subsequently create commission settlements.
The data subject may, asstated above, prevent the setting of cookies through our website at any time bymeans of a corresponding adjustment of the web browser used and thuspermanently deny the setting of cookies. Such an adjustment to the Internetbrowser used would also prevent Alphabet Inc. from setting a cookie on theinformation technology system of the data subject. Additionally, cookiesalready in use by Alphabet Inc. may be deleted at any time via a web browser orother software programs.
Furthermore, Google AdSensealso uses so-called tracking pixels. A tracking pixel is a miniature graphicthat is embedded in web pages to enable a log file recording and a log fileanalysis through which a statistical analysis may be performed. Based on theembedded tracking pixels, Alphabet Inc. is able to determine if and when awebsite was opened by a data subject, and which links were clicked on by thedata subject. Tracking pixels serve, inter alia, to analyze the flow ofvisitors on a website.
Through Google AdSense,personal data and information—which also includes the IP address, and isnecessary for the collection and accounting of the displayed advertisements—istransmitted to Alphabet Inc. in the United States of America. These personaldata will be stored and processed in the United States of America. The AlphabetInc. may disclose the collected personal data through this technical procedureto third parties.
Google AdSense is furtherexplained under the following linkhttps://www.google.com/intl/en/adsense/start/.
On this website, thecontroller has integrated the component of Google Analytics (with theanonymizer function). Google Analytics is a web analytics service. Webanalytics is the collection, gathering, and analysis of data about the behaviorof visitors to websites. A web analysis service collects, inter alia, dataabout the website from which a person has come (the so-called referrer), whichsub-pages were visited, or how often and for what duration a sub-page wasviewed. Web analytics are mainly used for the optimization of a website and inorder to carry out a cost-benefit analysis of Internet advertising.
The operator of the GoogleAnalytics component is Google Ireland Limited, Gordon House, Barrow Street,Dublin, D04 E5W5, Ireland.
For the web analytics throughGoogle Analytics the controller uses the application "_gat._anonymizeIp". By means of this application the IP address of the Internetconnection of the data subject is abridged by Google and anonymised when accessingour websites from a Member State of the European Union or another ContractingState to the Agreement on the European Economic Area.The purpose of the GoogleAnalytics component is to analyze the traffic on our website. Google uses thecollected data and information, inter alia, to evaluate the use of our websiteand to provide online reports, which show the activities on our websites, andto provide other services concerning the use of our Internet site for us.
Google Analytics places acookie on the information technology system of the data subject. The definitionof cookies is explained above. With the setting of the cookie, Google isenabled to analyze the use of our website. With each call-up to one of theindividual pages of this Internet site, which is operated by the controller andinto which a Google Analytics component was integrated, the Internet browser onthe information technology system of the data subject will automatically submitdata through the Google Analytics component for the purpose of online advertisingand the settlement of commissions to Google. During the course of thistechnical procedure, the enterprise Google gains knowledge of personalinformation, such as the IP address of the data subject, which serves Google,inter alia, to understand the origin of visitors and clicks, and subsequentlycreate commission settlements.
The cookie is used to storepersonal information, such as the access time, the location from which theaccess was made, and the frequency of visits of our website by the datasubject. With each visit to our Internet site, such personal data, includingthe IP address of the Internet access used by the data subject, will betransmitted to Google in the United States of America. These personal data arestored by Google in the United States of America. Google may pass thesepersonal data collected through the technical procedure to third parties.
The data subject may, asstated above, prevent the setting of cookies through our website at any time bymeans of a corresponding adjustment of the web browser used and thuspermanently deny the setting of cookies. Such an adjustment to the Internetbrowser used would also prevent Google Analytics from setting a cookie on theinformation technology system of the data subject. In addition, cookies alreadyin use by Google Analytics may be deleted at any time via a web browser orother software programs.
In addition, the data subjecthas the possibility of objecting to a collection of data that are generated byGoogle Analytics, which is related to the use of this website, as well as theprocessing of this data by Google and the chance to preclude any such. For thispurpose, the data subject must download a browser add-on under the linkhttps://tools.google.com/dlpage/gaoptout and install it. This browser add-ontells Google Analytics through a JavaScript, that any data and informationabout the visits of Internet pages may not be transmitted to Google Analytics.The installation of the browser add-ons is considered an objection by Google. Ifthe information technology system of the data subject is later deleted,formatted, or newly installed, then the data subject must reinstall the browseradd-ons to disable Google Analytics. If the browser add-on was uninstalled bythe data subject or any other person who is attributable to their sphere ofcompetence, or is disabled, it is possible to execute the reinstallation orreactivation of the browser add-ons.
Further information and theapplicable data protection provisions of Google may be retrieved underhttps://www.google.com/intl/en/policies/privacy/ and underhttp://www.google.com/analytics/terms/us.html. Google Analytics is furtherexplained under the following Link https://www.google.com/analytics/
On this website, thecontroller has integrated Google AdWords. Google AdWords is a service forInternet advertising that allows the advertiser to place ads in Google searchengine results and the Google advertising network. Google AdWords allows anadvertiser to pre-define specific keywords with the help of which an ad onGoogle's search results only then displayed, when the user utilizes the searchengine to retrieve a keyword-relevant search result. In the Google AdvertisingNetwork, the ads are distributed on relevant web pages using an automaticalgorithm, taking into account the previously defined keywords.
The operating company ofGoogle AdWords is Google Ireland Limited, Gordon House, Barrow Street, Dublin,D04 E5W5, Ireland.The purpose of Google AdWordsis the promotion of our website by the inclusion of relevant advertising on thewebsites of third parties and in the search engine results of the search engineGoogle and an insertion of third-party advertising on our website.
If a data subject reaches ourwebsite via a Google ad, a conversion cookie is filed on the informationtechnology system of the data subject through Google. The definition of cookiesis explained above. A conversion cookie loses its validity after 30 days and isnot used to identify the data subject. If the cookie has not expired, theconversion cookie is used to check whether certain sub-pages, e.g, the shoppingcart from an online shop system, were called up on our website. Through theconversion cookie, both Google and the controller can understand whether aperson who reached an AdWords ad on our website generated sales, that is,executed or canceled a sale of goods.
The data and informationcollected through the use of the conversion cookie is used by Google to createvisit statistics for our website. These visit statistics are used in order todetermine the total number of users who have been served through AdWords ads toascertain the success or failure of each AdWords ad and to optimize our AdWordsads in the future. Neither our company nor other Google AdWords advertisersreceive information from Google that could identify the data subject.
The conversion cookie storespersonal information, e.g. the Internet pages visited by the data subject. Eachtime we visit our Internet pages, personal data, including the IP address ofthe Internet access used by the data subject, is transmitted to Google in theUnited States of America. These personal data are stored by Google in theUnited States of America. Google may pass these personal data collected throughthe technical procedure to third parties.
The data subject may, at anytime, prevent the setting of cookies by our website, as stated above, by meansof a corresponding setting of the Internet browser used and thus permanentlydeny the setting of cookies. Such a setting of the Internet browser used wouldalso prevent Google from placing a conversion cookie on the informationtechnology system of the data subject. In addition, a cookie set by Google AdWordsmay be deleted at any time via the Internet browser or other software programs.
The data subject has apossibility of objecting to the interest-based advertisement of Google.Therefore, the data subject must access from each of the browsers in use thelink www.google.de/settings/ads and set the desired settings.Further information and theapplicable data protection provisions of Google may be retrieved underhttps://www.google.com/intl/en/policies/privacy/.
On this website, thecontroller has integrated components of the service Instagram. Instagram is aservice that may be qualified as an audiovisual platform, which allows users toshare photos and videos, as well as disseminate such data in other socialnetworks.
The operating company of theservices offered by Instagram is Facebook Ireland Ltd., 4 Grand Canal Square,Grand Canal Harbour, Dublin 2 Ireland.
With each call-up to one of theindividual pages of this Internet site, which is operated by the controller andon which an Instagram component (Insta button) was integrated, the Internetbrowser on the information technology system of the data subject isautomatically prompted to the download of a display of the correspondingInstagram component of Instagram. During the course of this technicalprocedure, Instagram becomes aware of what specific sub-page of our website wasvisited by the data subject.
If the data subject is loggedin at the same time on Instagram, Instagram detects with every call-up to ourwebsite by the data subject—and for the entire duration of their stay on ourInternet site—which specific sub-page of our Internet page was visited by thedata subject. This information is collected through the Instagram component andis associated with the respective Instagram account of the data subject. If thedata subject clicks on one of the Instagram buttons integrated on our website,then Instagram matches this information with the personal Instagram useraccount of the data subject and stores the personal data.
Instagram receives informationvia the Instagram component that the data subject has visited our websiteprovided that the data subject is logged in at Instagram at the time of thecall to our website. This occurs regardless of whether the person clicks on theInstagram button or not. If such a transmission of information to Instagram isnot desirable for the data subject, then he or she can prevent this by loggingoff from their Instagram account before a call-up to our website is made.
Further information and theapplicable data protection provisions of Instagram may be retrieved underhttps://help.instagram.com/155833707900388 andhttps://www.instagram.com/about/legal/privacy/
Art. 6(1) lit. a GDPR servesas the legal basis for processing operations for which we obtain consent for aspecific processing purpose. If the processing of personal data is necessaryfor the performance of a contract to which the data subject is party, as is thecase, for example, when processing operations are necessary for the supply ofgoods or to provide any other service, the processing is based on Article 6(1)lit. b GDPR. The same applies to such processing operations which are necessaryfor carrying out pre-contractual measures, for example in the case of inquiriesconcerning our products or services. Is our company subject to a legalobligation by which processing of personal data is required, such as for thefulfillment of tax obligations, the processing is based on Art. 6(1) lit. cGDPR. In rare cases, the processing of personal data may be necessary toprotect the vital interests of the data subject or of another natural person.This would be the case, for example, if a visitor were injured in our companyand his name, age, health insurance data or other vital information would haveto be passed on to a doctor, hospital or other third party. Then the processingwould be based on Art. 6(1) lit. d GDPR. Finally, processing operations couldbe based on Article 6(1) lit. f GDPR. This legal basis is used for processingoperations which are not covered by any of the abovementioned legal grounds, ifprocessing is necessary for the purposes of the legitimate interests pursued byour company or by a third party, except where such interests are overridden bythe interests or fundamental rights and freedoms of the data subject whichrequire protection of personal data. Such processing operations areparticularly permissible because they have been specifically mentioned by theEuropean legislator. He considered that a legitimate interest could be assumedif the data subject is a client of the controller (Recital 47 Sentence 2 GDPR).
Where the processing ofpersonal data is based on Article 6(1) lit. f GDPR our legitimate interest isto carry out our business in favor of the well-being of all our employees andthe shareholders.
The criteria used to determinethe period of storage of personal data is the respective statutory retentionperiod. After expiration of that period, the corresponding data is routinelydeleted, as long as it is no longer necessary for the fulfillment of thecontract or the initiation of a contract.
We clarify that the provisionof personal data is partly required by law (e.g. tax regulations) or can alsoresult from contractual provisions (e.g. information on the contractualpartner). Sometimes it may be necessary to conclude a contract that the datasubject provides us with personal data, which must subsequently be processed byus. The data subject is, for example, obliged to provide us with personal datawhen our company signs a contract with him or her. The non-provision of thepersonal data would have the consequence that the contract with the datasubject could not be concluded. Before personal data is provided by the datasubject, the data subject must contact any employee. The employee clarifies tothe data subject whether the provision of the personal data is required by lawor contract or is necessary for the conclusion of the contract, whether thereis an obligation to provide the personal data and the consequences ofnon-provision of the personal data.
As a responsible company, wedo not use automatic decision-making or profiling. This Privacy Policy has beengenerated by the Privacy Policy Generator of the German Association for Data Protection that was developed in cooperation with Privacy Lawyers from WILDE BEUGER SOLMECKE, Cologne.