This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to briefly as “data”) in the context of providing our services and within our online offering and the associated websites, functions and content, as well as external online presences, such as our social media profiles on (hereinafter collectively referred to as the “online offering”). With regard to the terminology used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
QUIO GmbH
Marisa-Mell-Gasse 3/2/7
1230 Vienna
Austria
Phone: +43 670 3513322
E-mail: info@quio-agency.at
Shareholder: Pavlo Lopushanskyi
Visitors and users of the online offering (hereinafter, we also refer to the data subjects collectively as “users”).
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data.
“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. For users within the scope of the General Data Protection Regulation (GDPR), i.e. the EU and the EEC, the following applies where the legal basis is not stated in the privacy policy: The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; The legal basis for processing in order to perform our services and carry out contractual measures as well as to respond to enquiries is Art. 6(1)(b) GDPR; The legal basis for processing in order to comply with our legal obligations is Art. 6(1)(c) GDPR; Where the vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis. The legal basis for processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Art. 6(1)(e) GDPR. The legal basis for processing in order to safeguard our legitimate interests is Art. 6(1)(f) GDPR. The processing of data for purposes other than those for which it was collected is governed by the provisions of Art. 6(4) GDPR. The processing of special categories of data (pursuant to Art. 9(1) GDPR) is governed by the provisions of Art. 9(2) GDPR.
In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access to it, input, disclosure, ensuring availability and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to threats to the data. In addition, we take the protection of personal data into account already during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.
Where, in the course of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transfer data to them or otherwise grant them access to the data, this takes place only on the basis of a statutory permission (e.g., where a transfer of the data to third parties, such as payment service providers, is necessary for the performance of a contract), where users have given their consent, where a legal obligation provides for it, or on the basis of our legitimate interests (e.g., when using agents, web hosts, etc.).
Where we disclose or transfer data to other companies within our group of companies or otherwise grant them access, this takes place in particular for administrative purposes as a legitimate interest and, beyond that, on a basis that complies with the statutory requirements.
Where we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA) or the Swiss Confederation), or where this occurs in the context of using third-party services or disclosing or transferring data to other persons or companies, this takes place only if it is necessary for the performance of our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we process the data or have the data processed in a third country only where the statutory requirements are met. That is, the processing takes place, for example, on the basis of special guarantees, such as the officially recognised determination of a level of data protection equivalent to that of the EU (e.g., for the USA through the “Privacy Shield”) or compliance with officially recognised special contractual obligations.
You have the right to request confirmation as to whether the data in question are being processed, as well as to access to these data and to further information and a copy of the data, in accordance with the statutory requirements.
In accordance with the statutory requirements, you have the right to request the completion of the data concerning you or the rectification of inaccurate data concerning you.
In accordance with the statutory requirements, you have the right to request that the data in question be deleted without undue delay or, alternatively, to request a restriction of the processing of the data in accordance with the statutory requirements.
You have the right to receive the data concerning you which you have provided to us in accordance with the statutory requirements and to request their transmission to other controllers.
In accordance with the statutory requirements, you also have the right to lodge a complaint with the competent supervisory authority.
You have the right to withdraw consent given, with effect for the future.
You may object to the future processing of the data concerning you at any time in accordance with the statutory requirements. The objection may be made in particular against processing for direct marketing purposes.
“Cookies” are small files that are stored on users’ computers. Various information can be stored within cookies. A cookie serves primarily to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, also known as “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes their browser. In such a cookie, for example, the contents of a shopping cart in an online shop or a login status can be stored. “Permanent” or “persistent” cookies are cookies that remain stored even after the browser is closed. In this way, for example, the login status can be stored if users return after several days. Likewise, the interests of users that are used for reach measurement or marketing purposes can be stored in such a cookie. “Third-party cookies” are cookies that are offered by providers other than the controller who operates the online offering (otherwise, if they are only the controller’s own cookies, they are referred to as “first-party cookies”).
We may use temporary and permanent cookies and provide information about this in our privacy policy.
If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Excluding cookies may lead to functional restrictions of this online offering.
A general objection to the use of cookies deployed for online marketing purposes can be declared for a large number of the services, above all in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ Furthermore, the storage of cookies can be prevented by disabling them in the browser settings. Please note that in this case it may not be possible to use all functions of this online offering.
The data processed by us will be deleted or its processing restricted in accordance with the statutory requirements. Unless expressly stated within this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing its deletion.
If the data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted. That is, the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
We ask you to inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or other individual notification.
In addition, we process
of our customers, prospects and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.
We process the data of our customers in the course of the ordering processes in our online shop in order to enable them to select and order the chosen products and services, as well as to pay for and have them delivered or performed.
The data processed includes inventory data, communication data, contract data and payment data, and the data subjects include our customers, prospects and other business partners. The processing takes place for the purpose of providing contractual services in the context of operating an online shop, billing, delivery and customer service. In this context, we use session cookies to store the contents of the shopping cart and permanent cookies to store the login status.
The processing takes place in order to perform our services and carry out contractual measures (e.g., carrying out ordering processes) and insofar as it is required by law (e.g., legally required archiving of business transactions for commercial and tax purposes). In this context, the information marked as required is necessary for establishing and fulfilling the contract. We disclose the data to third parties only in the context of delivery, payment or within the framework of statutory permissions and obligations, as well as where this is done on the basis of our legitimate interests, about which we inform you within this privacy policy (e.g., to legal and tax advisors, financial institutions, freight companies and authorities).
Users can optionally create a user account, in which they can in particular view their orders. During registration, the required mandatory information is communicated to the users. User accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data relating to the user account will be deleted, subject to its retention being necessary for commercial or tax law reasons. Information in the customer account remains until its deletion, followed by archiving in the event of a legal obligation or our legitimate interests (e.g., in the event of legal disputes). It is the responsibility of the users to back up their data upon termination before the end of the contract.
In the course of registration and renewed logins as well as use of our online services, we store the IP address and the time of the respective user action. The storage takes place on the basis of our legitimate interests, as well as those of the users, in protection against misuse and other unauthorised use. This data is generally not passed on to third parties, unless it is necessary to pursue our legal claims as a legitimate interest or there is a legal obligation to do so.
Deletion takes place after the expiry of statutory warranty and other contractual rights or obligations (e.g., payment claims or performance obligations under contracts with customers), whereby the necessity of retaining the data is reviewed every three years; in the case of retention due to statutory archiving obligations, deletion takes place after their expiry.
We process the data of our customers in the context of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design development/consulting or maintenance, implementation of campaigns and processes/handling, server administration, data analysis/consulting services and training services.
In doing so, we process inventory data (e.g., customer master data, such as names or addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), contract data (e.g., subject matter of the contract, term), payment data (e.g., bank details, payment history), usage and meta data (e.g., in the context of the evaluation and success measurement of marketing measures). We generally do not process special categories of personal data, unless these are components of commissioned processing. The data subjects include our customers, prospects and their customers, users, website visitors or employees as well as third parties. The purpose of the processing is the provision of contractual services, billing and our customer service. The legal bases for the processing arise from Art. 6(1)(b) GDPR (contractual services), Art. 6(1)(f) GDPR (analysis, statistics, optimisation, security measures). We process data that is necessary for establishing and fulfilling the contractual services and point out the necessity of providing it. Disclosure to external parties only takes place if it is necessary within the framework of an order. When processing data entrusted to us in the context of an order, we act in accordance with the instructions of the clients and the statutory requirements as a processor pursuant to Art. 28 GDPR and process the data for no purposes other than those specified in the order.
We delete the data after the expiry of statutory warranty and comparable obligations. The necessity of retaining the data is reviewed every three years; in the case of statutory archiving obligations, deletion takes place after their expiry (6 years, pursuant to Section 257(1) HGB, 10 years, pursuant to Section 147(1) AO). In the case of data disclosed to us by the client in the context of an order, we delete the data in accordance with the specifications of the order, generally after the end of the order.
We process the data of our clients and prospects and other principals or contractual partners (collectively referred to as “clients”) in accordance with Art. 6(1)(b) GDPR in order to provide our contractual or pre-contractual services to them. The data processed in this context, the nature, scope and purpose and the necessity of their processing are determined by the underlying contractual relationship. The data processed generally includes the clients’ inventory and master data (e.g., name, address, etc.), as well as contact data (e.g., e-mail address, telephone, etc.), contract data (e.g., services used, fees, names of contact persons, etc.) and payment data (e.g., bank details, payment history, etc.).
In the context of our services, we may also process special categories of data pursuant to Art. 9(1) GDPR, in particular information on the clients’ health, where applicable relating to their sex life or sexual orientation, ethnic origin or religious or philosophical beliefs. For this purpose, where required, we obtain the express consent of the clients pursuant to Art. 6(1)(a), Art. 7, Art. 9(2)(a) GDPR and otherwise process the special categories of data for the purposes of health care on the basis of Art. 9(2)(h) GDPR, Section 22(1) No. 1 b BDSG.
Where necessary for the performance of the contract or required by law, we disclose or transfer the clients’ data in the context of communication with other professionals, to third parties necessarily or typically involved in the performance of the contract, such as billing offices or comparable service providers, insofar as this serves the provision of our services pursuant to Art. 6(1)(b) GDPR, is required by law pursuant to Art. 6(1)(c) GDPR, serves our interests or those of the clients in efficient and cost-effective health care as a legitimate interest pursuant to Art. 6(1)(f) GDPR, or is necessary pursuant to Art. 6(1)(d) GDPR to protect vital interests of the clients or of another natural person, or takes place within the framework of consent pursuant to Art. 6(1)(a), Art. 7 GDPR.
The data is deleted when it is no longer required for the performance of contractual or statutory duties of care or for dealing with any warranty and comparable obligations, whereby the necessity of retaining the data is reviewed every three years; otherwise, the statutory retention obligations apply.
We process the data of our contractual partners and prospects as well as other principals, customers, clients or contractual partners (collectively referred to as “contractual partners”) in accordance with Art. 6(1)(b) GDPR in order to provide our contractual or pre-contractual services to them. The data processed in this context, the nature, scope and purpose and the necessity of their processing are determined by the underlying contractual relationship.
The data processed includes the master data of our contractual partners (e.g., names and addresses), contact data (e.g., e-mail addresses and telephone numbers) as well as contract data (e.g., services used, contract contents, contractual communication, names of contact persons) and payment data (e.g., bank details, payment history).
We generally do not process special categories of personal data, unless these are components of commissioned or contractual processing.
We process data that is necessary for establishing and fulfilling the contractual services and, where this is not evident to the contractual partners, point out the necessity of providing it. Disclosure to external persons or companies only takes place if it is necessary within the framework of a contract. When processing data entrusted to us in the context of an order, we act in accordance with the instructions of the clients and the statutory requirements.
In the context of the use of our online services, we may store the IP address and the time of the respective user action. The storage takes place on the basis of our legitimate interests, as well as the interests of the users, in protection against misuse and other unauthorised use. This data is generally not passed on to third parties, unless it is necessary to pursue our claims pursuant to Art. 6(1)(f) GDPR or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR.
The data is deleted when it is no longer required for the performance of contractual or statutory duties of care or for dealing with any warranty and comparable obligations, whereby the necessity of retaining the data is reviewed every three years; otherwise, the statutory retention obligations apply.
We use external payment service providers through whose platforms users and we can carry out payment transactions (e.g., in each case with a link to the privacy policy, PayPal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full), Klarna (https://www.klarna.com/de/datenschutz/), Skrill (https://www.skrill.com/de/fusszeile/datenschutzrichtlinie/), Giropay (https://www.giropay.de/rechtliches/datenschutz-agb/), Visa (https://www.visa.de/datenschutz), Mastercard (https://www.mastercard.de/de-de/datenschutz.html), American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html)
In the context of fulfilling contracts, we use the payment service providers on the basis of Art. 6(1)(b) GDPR. Otherwise, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR in order to offer our users an effective and secure means of payment.
The data processed by the payment service providers includes inventory data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, total amount and recipient-related information. This information is required to carry out the transactions. However, the data entered is processed and stored only by the payment service providers. That is, we do not receive any account- or credit card-related information, but merely information confirming or denying the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit reporting agencies. The purpose of this transmission is identity and credit checks. In this regard, we refer to the general terms and conditions and data protection notices of the payment service providers.
The terms and conditions and data protection notices of the respective payment service providers apply to the payment transactions; these can be accessed within the respective websites or transaction applications. We also refer to these for further information and for the exercise of rights of withdrawal, access and other data subject rights.
We process data in the context of administrative tasks and the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. In this context, we process the same data that we process in the course of providing our contractual services. The legal bases for the processing are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. The processing affects customers, prospects, business partners and website visitors. The purpose of and our interest in the processing lies in administration, financial accounting, office organisation and the archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. The deletion of data with regard to contractual services and contractual communication corresponds to the information given for these processing activities.
In this context, we disclose or transmit data to the tax authorities, advisers, such as tax advisers or auditors, as well as other fee offices and payment service providers.
Furthermore, on the basis of our business interests, we store information on suppliers, event organisers and other business partners, e.g., for the purpose of later contact. This data, which is predominantly company-related, is generally stored permanently.
In order to be able to run our business economically and to identify market trends and the wishes of contractual partners and users, we analyse the data available to us on business transactions, contracts, enquiries, etc. In doing so, we process inventory data, communication data, contract data, payment data, usage data and meta data on the basis of Art. 6(1)(f) GDPR, whereby the data subjects include contractual partners, prospects, customers, visitors and users of our online offering.
The analyses are carried out for the purpose of business evaluations, marketing and market research. In doing so, we may take into account the profiles of registered users with information, e.g., on the services they have used. The analyses serve us to increase user-friendliness, to optimise our offering and for business efficiency. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with aggregated values.
Where these analyses or profiles are personal, they will be deleted or anonymised upon termination by the users, otherwise after two years from the conclusion of the contract. Otherwise, the overall business analyses and general trend determinations are created anonymously wherever possible.
We process applicant data only for the purpose and within the scope of the application process in accordance with the statutory requirements. The processing of applicant data takes place to fulfil our (pre-)contractual obligations in the context of the application process within the meaning of Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR where the data processing becomes necessary for us, e.g., in the context of legal proceedings (in Germany, Section 26 BDSG additionally applies).
The application process requires applicants to provide us with their applicant data. The necessary applicant data are marked where we offer an online form, and otherwise arise from the job descriptions and generally include personal details, postal and contact addresses and the documents belonging to the application, such as cover letter, curriculum vitae and certificates. In addition, applicants may voluntarily provide us with additional information.
By submitting their application to us, applicants agree to the processing of their data for the purposes of the application process in the manner and to the extent set out in this privacy policy.
Insofar as special categories of personal data within the meaning of Art. 9(1) GDPR are voluntarily provided in the course of the application process, their processing additionally takes place pursuant to Art. 9(2)(b) GDPR (e.g., health data, such as severe disability status or ethnic origin). Insofar as special categories of personal data within the meaning of Art. 9(1) GDPR are requested from applicants in the course of the application process, their processing additionally takes place pursuant to Art. 9(2)(a) GDPR (e.g., health data, if these are required for the exercise of the profession).
Where provided, applicants can submit their applications to us by means of an online form on our website. The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also submit their applications to us by e-mail. In this regard, however, please note that e-mails are generally not sent in encrypted form and applicants must arrange for encryption themselves. We can therefore not assume any responsibility for the transmission path of the application between the sender and its receipt on our server, and therefore recommend using an online form or postal dispatch. Instead of applying via the online form or e-mail, applicants still have the option of sending us their application by post.
The data provided by applicants may, in the event of a successful application, be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a job offer is not successful, the applicants’ data will be deleted. The applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time.
Subject to a legitimate withdrawal by the applicants, deletion takes place after a period of six months has elapsed, so that we can answer any follow-up questions regarding the application and meet our obligations to provide evidence under the Equal Treatment Act. Invoices for any travel expense reimbursement are archived in accordance with tax law requirements.
Users can create a user account. During registration, the required mandatory information is communicated to the users and processed on the basis of Art. 6(1)(b) GDPR for the purposes of providing the user account. The data processed includes in particular the login information (name, password and an e-mail address). The data entered during registration is used for the purposes of using the user account and its purpose.
Users may be informed by e-mail about information relevant to their user account, such as technical changes. If users have terminated their user account, their data relating to the user account will be deleted, subject to a statutory retention obligation. It is the responsibility of the users to back up their data upon termination before the end of the contract. We are entitled to irretrievably delete all data of the user stored during the term of the contract.
In the context of the use of our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. The storage takes place on the basis of our legitimate interests, as well as those of the users, in protection against misuse and other unauthorised use. This data is generally not passed on to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR. IP addresses are anonymised or deleted after 7 days at the latest.
When contacting us (e.g., via contact form, e-mail, telephone or via social media), the user’s details are processed for the handling of the contact request and its processing pursuant to Art. 6(1)(b) (in the context of contractual/pre-contractual relationships), Art. 6(1)(f) (other enquiries) GDPR. The users’ details may be stored in a customer relationship management system (“CRM system”) or comparable enquiry organisation.
We delete the enquiries once they are no longer required. We review the necessity every two years; furthermore, the statutory archiving obligations apply.
With the following notes, we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedures and your rights to object. By subscribing to our newsletter, you declare that you agree to its receipt and to the procedures described.
Content of the newsletter: We send newsletters, e-mails and other electronic notifications containing promotional information (hereinafter “newsletter”) only with the consent of the recipients or a statutory permission. Where the contents of the newsletter are specifically described upon registration, they are decisive for the users’ consent. Otherwise, our newsletters contain information about our services and about us.
Double opt-in and logging: Registration for our newsletter takes place in a so-called double opt-in procedure. That is, after registering you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that nobody can register with other people’s e-mail addresses. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Likewise, changes to your data stored with the dispatch service provider are logged.
Registration data: To register for the newsletter, it is sufficient to provide your e-mail address. Optionally, we ask you to provide a name for the purpose of addressing you personally in the newsletter.
The dispatch of the newsletter and the associated success measurement take place on the basis of the recipients’ consent pursuant to Art. 6(1)(a), Art. 7 GDPR in conjunction with Section 7(2) No. 3 UWG or, if consent is not required, on the basis of our legitimate interests in direct marketing pursuant to Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG.
The logging of the registration procedure takes place on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Our interest is directed at the use of a user-friendly and secure newsletter system that serves both our business interests and the expectations of the users, and also allows us to prove consent.
Cancellation/withdrawal - You can cancel the receipt of our newsletter at any time, i.e. withdraw your consent. You will find a link to cancel the newsletter at the end of every newsletter. We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove consent given in the past. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time.
The newsletters are sent using the dispatch service provider [NAME, ADDRESS, COUNTRY]. You can view the dispatch service provider’s privacy policy here: [LINK TO THE PRIVACY POLICY]. The dispatch service provider is used on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR and a data processing agreement pursuant to Art. 28(3) sentence 1 GDPR.
The dispatch service provider may use the recipients’ data in pseudonymised form, i.e. without assignment to a user, to optimise or improve its own services, e.g., for the technical optimisation of the dispatch and presentation of the newsletters or for statistical purposes. However, the dispatch service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.
The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file which, when the newsletter is opened, is retrieved from our server or, where we use a dispatch service provider, from its server. In the course of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected.
This information is used for the technical improvement of the services on the basis of the technical data, or of the target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our intention nor, where one is used, that of the dispatch service provider to observe individual users. Rather, the evaluations serve us to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.
A separate withdrawal of the success measurement is unfortunately not possible; in this case, the entire newsletter subscription must be cancelled.
The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services, which we use for the purpose of operating this online offering.
In doing so, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, prospects and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).
We, or our hosting provider, collect data on every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. The access data includes the name of the web page accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the page previously visited), IP address and the requesting provider.
Log file information is stored for security reasons (e.g., to investigate abuse or fraud) for a maximum of 7 days and then deleted. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the respective incident has been definitively clarified.
On the basis of our legitimate interests (i.e., interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the users’ use of the online offering is generally transmitted to a Google server in the USA and stored there.
Google is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use this information on our behalf to evaluate the users’ use of our online offering, to compile reports on the activities within this online offering and to provide us with further services relating to the use of this online offering and internet use. In this process, pseudonymous user profiles of the users may be created from the data processed.
We use Google Analytics only with IP anonymisation activated. This means that the users’ IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.
The IP address transmitted by the user’s browser is not merged with other data from Google. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent the collection of the data generated by the cookie and relating to their use of the online offering to Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
You can find further information on data use by Google, setting and objection options in Google’s privacy policy (https://policies.google.com/privacy) as well as in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).
The personal data of the users will be deleted or anonymised after 14 months.
On the basis of our legitimate interests (i.e., interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”).
Google is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
We use the AdSense service, with the help of which advertisements are displayed on our website and we receive remuneration for their display or other use. For these purposes, usage data, such as clicks on an advertisement and the users’ IP address, are processed, whereby the last two digits of the IP address are truncated. The users’ data is therefore processed in pseudonymised form.
We use AdSense with personalised advertisements. In this process, Google draws conclusions about users’ interests on the basis of the websites visited or apps used by users and the user profiles created in this way. Advertisers use this information to align their campaigns with these interests, which is equally beneficial for users and advertisers. For Google, advertisements are personalised when collected or known data determine or influence the selection of advertisements. This includes, among other things, previous search queries, activities, website visits, the use of apps, and demographic and location information. In detail, this includes: demographic targeting, targeting by interest categories, remarketing, as well as targeting on customer match lists and audience lists uploaded to DoubleClick Bid Manager or Campaign Manager.
You can find further information on data use by Google, setting and objection options in Google’s privacy policy (https://policies.google.com/technologies/ads) as well as in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).
Within our online offering, on the basis of our legitimate interests in the analysis, optimisation and economic operation of our online offering and for these purposes, the so-called “Facebook pixel” of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are resident in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), is used.
Facebook is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
With the help of the Facebook pixel, Facebook is able, on the one hand, to determine the visitors to our online offering as a target group for the display of advertisements (so-called “Facebook Ads”). Accordingly, we use the Facebook pixel to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our online offering or who exhibit certain characteristics (e.g., interests in certain topics or products, determined on the basis of the websites visited) which we transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook Ads correspond to the potential interest of the users and are not perceived as a nuisance. With the help of the Facebook pixel, we can also track the effectiveness of Facebook advertisements for statistical and market research purposes, by seeing whether users were redirected to our website after clicking on a Facebook advertisement (so-called “conversion”).
The processing of data by Facebook takes place within the framework of Facebook’s Data Policy. Accordingly, general information on the display of Facebook Ads can be found in Facebook’s Data Policy: https://www.facebook.com/policy. Specific information and details about the Facebook pixel and how it works can be found in Facebook’s help section: https://www.facebook.com/business/help/651294705016616.
You can object to the collection by the Facebook pixel and the use of your data for the display of Facebook Ads. To set which types of advertisements are displayed to you within Facebook, you can visit the page set up by Facebook and follow the instructions there on the settings for usage-based advertising: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
You can also object to the use of cookies that serve reach measurement and advertising purposes via the opt-out page of the Network Advertising Initiative (http://optout.networkadvertising.org/) and additionally via the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).