PRIVACY POLICY
I INTRODUCTION AND TERMS
1. GENERAL INFORMATION
In operating our websites at the URLs https://deutscher-jazzpreis.de and https://bewerbung.deutscher-jazzpreis.de/ (hereinafter referred to collectively as the “website”), we process personal data. We treat this data confidentially and process it in accordance with applicable laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz: BDSG).
With this Privacy Policy, we wish to inform you which personal data we collect from you, for what purposes and on what legal basis we use it and, where applicable, to whom we disclose it. In addition, we explain which rights you have in order to safeguard and enforce your data protection rights.
2. TERMS
Our Privacy Policy contains technical terms that are used in the GDPR and the BDSG. To help you understand these terms, we explain them in simple language below.
2.1 Personal data
“Personal data” means any information relating to an identified or identifiable person (Art. 4 No. 1 GDPR). Information relating to an identified person may include, for example, their name or email address. However, data may also be personal if the identity of the person is not immediately apparent but can be determined by combining one’s own or third-party information in such a way that the person can be identified. A person may, for example, be identifiable through their address or bank details, date of birth or username, IP addresses and/or location data. Relevant in this context is any information that may in any way allow conclusions to be drawn about a person.
2.2 Processing
According to Art. 4 No. 2 GDPR, “processing” means any operation performed in connection with personal data. This includes, in particular, the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other form of making available, alignment or combination, restriction, erasure or destruction of personal data.
II CONTROLLER AND DATA PROTECTION OFFICER
3. CONTROLLER
The controller responsible for data processing is:
Company: Initiative Musik gemeinnützige Projektgesellschaft mbH („we“)
Legal representative: Katja Lucker (Managing director)
Address: Friedrichstraße 122, 10117 Berlin, Germany
T: +49 (0)30 531 475 45 – 0
F: +49 (0)30 531 475 45 – 99
M: mail [at] initiative-musik.de
4. DATA PROTECTION OFFICER
We have appointed an external Data Protection Officer for our company:
Erik Stamer
Datargus Rechtsanwaltsgesellschaft mbH
Brachvogelstraße 1, 10961 Berlin
T: +49 (0)30 577 039 930
F: +49 (0)30 577 039 931
M: datenschutz [at] initiative-musik.de
III PROCESSING FRAMEWORK
5. PROCESSING FRAMEWORK: WEBSITE
Within the scope of the website, we process the personal data concerning you that is listed in detail in Section IV below. We only process data concerning you that you actively provide on the website, for example by completing forms, or that you automatically provide when using our services.
Your data is processed exclusively by us and is generally not sold, rented or passed on to third parties. Where we use the assistance of external service providers to process your personal data, this is done within the framework of what is known as commissioned processing, in which we, as the client, have the authority to issue instructions to our contractors.
For the operation of our website, we use external service providers for hosting, maintenance and support. We host our website with the external provider jweiland.net, Jochen Weiland, address: Echterdinger Straße 57, Gebäude 9, 70794 Filderstadt, Germany, at the data centre location in Filderstadt, Germany. If further external service providers are used for individual processing operations listed in Section IV, they will be named there.
As a rule, we do not transfer data to third countries and do not intend to do so. We will inform you of any exceptions to this principle in the processing operations described below. Any transfer of data to third countries will then take place on the basis of the so-called EU Standard Contractual Clauses.
IV PROCESSING OPERATIONS IN DETAIL
6. PROVISION OF THE WEBSITE AND SERVER LOG FILES
6.1 Description of processing
Each time the website is accessed, we automatically collect information that your browser transmits to our server. This includes the following data:
– IP address
– browser software used, including its version and language
– the subpages accessed on the website
– the date and time of access to the website
This data is also stored in what are known as log files in our system. Temporary storage of your IP address by the system is necessary in order to deliver our website to the user’s device. For this purpose, the user’s IP address must remain stored for the duration of the session. However, your IP address is not stored in the log files.
6.2 Purpose
The processing is carried out in order to enable access to the website and to ensure its stability and security. In addition, the processing serves the statistical analysis and improvement of our online services.
6.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 6.2.
6.4 Storage period
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected for the provision of the website, this is the case when the respective session has ended. Log files are deleted after seven days.
7. REGISTRATION AND PROFILE
16.1 Description of processing
As nominees and jury members for the German Jazz Prize, we ask you to provide us with information, data and content such as photos online at https://bewerbung.deutscher-jazzpreis.de.
16.2 Purpose
The processing is carried out for the purpose of implementing the German Jazz Prize, determining the winners and promoting and disseminating its content.
16.3 Legal basis
The processing of the first name and surname of the contact person, their e-mail address and telephone number is necessary for determining the winners and/or reviewing the nominations (Art. 6 para. 1 lit. b GDPR). If you provide photos of yourself, other content and press texts at our request, the basis for data processing is your consent (Art. 6 para. 1 lit. a GDPR).
16.4 Storage period
Due to commercial and tax law requirements, we are obliged to store your address and payment data for a period of ten years. However, after two years we restrict processing. This means that your data will then only be stored separately for the purpose of complying with statutory retention periods and will be deleted without undue delay after those periods expire.
8. COOKIES
8.1 Description of processing
Our website uses cookies. Cookies are small text files that are stored on the user’s device when visiting a website. Cookies contain information that enables a device to be recognized and, where applicable, certain functions of a website to be provided.
We distinguish between our own cookies and external cookies, known as third-party cookies. Our website uses so-called “session cookies” and “persistent cookies”. “Session cookies” are automatically deleted when you end your internet session and close your browser. Persistent cookies remain stored on your device for a longer period of time.
Where cookies are technically necessary for the operation of our website, your consent is not required. All other cookies that are not technically necessary are only set after you have actively consented to the use of cookies via our consent tool. The consent tool stores your selection itself in a cookie on your device. As a result, you do not need to make another cookie decision the next time you visit our website.
You can find out which cookies are used on our website for which purpose, how long they are stored on your device and which consents you may already have given in the settings of the consent tool.
8.2. Purpose
We use cookies to make our website more user-friendly and to provide the functions described in Section 8.1.
8.3 Legal basis
With regard to technically necessary cookies and the use of the consent tool, the processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 8.2.
For all other cookies, i.e. cookies that are not technically necessary, the legal basis for processing is consent (Art. 6 para. 1 lit. a GDPR). Such consent is voluntary.
8.4 Storage period and withdrawal of consent
Cookies are automatically deleted at the end of a session or upon expiry of the specified storage period. Since cookies are stored on your device, you as the user have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing the settings in your internet browser. Cookies that have already been stored can be deleted. This can also be done automatically.
If cookies are disabled, deleted or restricted for our website, individual functions of our website may not be available or may only be available to a limited extent. Any consent you have given for the use of cookies may be withdrawn at any time in the settings of the consent tool with effect for the future.
8.5 Recipients
When third-party cookies are used, data may be transmitted to the relevant providers of these third-party services. In some cases, data may also be transferred to third countries outside the European Union or the European Economic Area. We provide information about data recipients and transfers to third countries in the settings of the consent tool and/or in the relevant section on the third-party service in this Privacy Policy.
9. CONTACT BY EMAIL
9.1 Description of processing
You can contact us by writing to the email address provided on the website. In this case, we process the personal data transmitted with the email
9.2 Purpose
The data transmitted with and in your email is used exclusively for the purpose of processing and responding to your request.
9.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 9.2. If the email contact is aimed at the conclusion or performance of a contract, the data processing takes place for the performance of a contract (Art. 6 para. 1 lit. b GDPR).
9.4 Storage period
We delete the data as soon as it is no longer required to achieve the purpose for which it was collected. This is usually the case when the respective communication with you has ended. Communication is deemed to have ended when it can be inferred from the circumstances that your request has been conclusively clarified. If statutory retention periods prevent deletion, deletion will take place without undue delay after expiry of the statutory retention period.
10. NEWSLETTER
10.1 Description of processing
We send out a newsletter at irregular intervals. With the newsletter, we inform you about new developments around the German Jazz Prize. You will only receive our newsletter if you actively subscribe to our mailing list. You can subscribe by completing and submitting a newsletter registration form on our website.
Only your email address is required to subscribe to the newsletter. All further details, such as your first name and surname, are voluntary and serve solely to personalise the emails. We use the so-called double opt-in procedure to carry out and verify newsletter registrations.
Registration takes place in several steps. First, you subscribe to the newsletter on our website. You will then receive an email from us at the email address you provided. In this email, we ask you to confirm that you have actually subscribed to the newsletter and wish to receive it. Confirmation takes place by clicking a confirmation link contained in the email. Only after successful confirmation will we add you to our newsletter mailing list and send you emails in the future. As part of the double opt-in procedure, we store the date, time and your IP addresses both at registration and at confirmation.
If you purchase goods or services on our website and provide your email address in the process, this email address may subsequently be used by us to send what is known as an existing-customer newsletter. In such a case, the newsletter will exclusively contain specific information about our funding projects.
10.2 Purpose
The processing is carried out in order to offer the newsletter function and to send newsletter emails to subscribers and existing customers. The collection and storage of the date, time and IP addresses during newsletter registration serves to document consents given and to protect against the misuse of email addresses.
10.3 Legal basis
For our subscriber newsletter, processing is carried out on the basis of consent pursuant to Art. 6 para. 1 lit. a GDPR. You can access the declaration of consent on our website at any time at https://seu1.cleverreach.com/f/58863-228513/. Your consent is voluntary.
The collection and storage of the date, time and IP addresses during newsletter registration is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 10.2.
For our existing-customer newsletter, processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR for the purposes of the controller’s overriding legitimate interests. Our legitimate interest lies in direct advertising to existing customers. This is permissible within the framework of Section 7 para. 3 of the German Unfair Competition Act (UWG), which we observe.
10.4 Storage period and withdrawal of consent
If you do not confirm your subscription to our newsletter within 24 hours of receiving the corresponding registration email, your data will be automatically deleted. Otherwise, we process your personal data for the duration of your newsletter subscription.
You may end your receipt of our newsletter at any time by withdrawing your consent.
10.5 Recipients and transfer to third countries
We use the services of the newsletter provider Rapidmail to manage our newsletter mailing list and send emails. This is done within the framework of commissioned processing. Rapidmail is a service provided by rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau, Germany. Further information on data protection at Rapidmail can be found at www.rapidmail.de/dsgvo-konformes-email-marketing.
11. SOCIAL NETWORKS
11.1 Description of processing
Our website does not use so-called social media plugins. The logos of Facebook, Twitter, Instagram and YouTube displayed on our website are merely linked to the corresponding profiles of our company on the social networks. No data is transmitted to the social networks through the integration of the logos. If you click on one of the logos, you will merely be redirected to the external website of the respective social network.
However, our profiles within the social networks themselves constitute data processing. If you are logged in to the respective social network when visiting such a profile, this information is assigned to your user account there. If you interact with our profile, for example by commenting on, sharing, liking or retweeting a post, this information will also be stored in your user account. As a rule, your interactions with our profile can also be viewed by us.
On the social network Facebook, we have the option of receiving statistical data about the use of our Facebook page via the so-called “Insights” function. These statistics are provided by Facebook. The “Insights” function cannot be disabled. We cannot decide whether to activate or deactivate this function. It is available to all Facebook fan page operators, regardless of whether they use the Facebook Insights function or not.
Through Facebook Insights, we are provided with the following data for a selectable period with regard to fans, subscribers, people reached and people interacting with the page: total number of page views, likes including origin, page activities, post interactions, reach, post reach, divided into organic, viral and paid interactions, comments, shared content, replies and demographic analyses, including country of origin, gender and age. With Insights statistics, it is not possible for us to identify subscribers and fans of our page or view their profiles.
On the social networks Facebook and Instagram, we have the option of receiving statistical data about the use of our Facebook page and our Instagram profile via the so-called “Insights” function. These statistics are provided by Facebook and Instagram. The “Insights” function cannot be disabled. We cannot decide whether to activate or deactivate this function. It is available to all Facebook fan page operators and all operators of an Instagram business account, regardless of whether they use the Insights function.
Through Facebook Insights, we are provided, in anonymised form and for a selectable period, with data relating to fans, subscribers, people reached and people interacting with the page, including the following: total number of page views, likes including origin, page activities, post interactions, reach, post reach, divided into organic, viral and paid interactions, comments, shared content, replies and demographic analyses, including country of origin, gender and age. With Insights statistics, it is not possible for us to identify subscribers and fans of our page or view their profiles.
In addition, Instagram Insights provides us, in anonymised form, with data on the development and reach of our Instagram profile and of the posts, stories and videos we publish there. We also receive statistical information via Instagram Insights on the place of origin, gender and age of the subscribers to our Instagram profile.
The social networks with which you communicate store your data using pseudonyms as usage profiles and use this data for advertising and market research purposes. For example, advertisements may be displayed to you within the social network and on other third-party websites that correspond to your presumed interests. Cookies are generally used for this purpose and are placed on your device by the social network. You have the right to object to the creation of these usage profiles. To exercise this right, you must contact the social networks directly.
11.2 Purpose
We maintain profiles on the aforementioned social networks for the purpose of public relations and corporate communication with customers and interested parties. We use the Facebook and Instagram “Insights” function to evaluate the reach of our posts on the social network and to make them more appealing to our visitors in the future.
11.3 Legal basis
The legal basis for data processing in connection with our profiles on social networks is the protection of our overriding legitimate interests (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 8.2. If the respective operator of a social network asks you for consent, the legal basis is Art. 6 para. 1 lit. a GDPR. In addition, data processing with regard to our Facebook page and our Instagram page is carried out on the basis of joint controllership pursuant to Art. 26 GDPR.
11.4 Recipients and transfer to third countries
The respective social networks are operated by the companies listed below. Further information on data protection with regard to our profiles on the social networks can be found in the linked privacy policies.
Facebook:
Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA.
Privacy policy:
http://www.facebook.com/policy.php
http://www.facebook.com/help/186325668085084
http://www.facebook.com/about/privacy/your-info-on-other#application
http://www.facebook.com/about/privacy/your-info#everyoneinfo
11.1 Description of processing
Our website does not use so-called social media plugins. The logos of Facebook, Twitter, Instagram and YouTube displayed on our website are merely linked to the corresponding profiles of our company on the social networks. No data is transmitted to the social networks through the integration of the logos. If you click on one of the logos, you will merely be redirected to the external website of the respective social network.
However, our profiles within the social networks themselves constitute data processing. If you are logged in to the respective social network when visiting such a profile, this information is assigned to your user account there. If you interact with our profile, for example by commenting on, sharing, liking or retweeting a post, this information will also be stored in your user account. As a rule, your interactions with our profile can also be viewed by us.
On the social network Facebook, we have the option of receiving statistical data about the use of our Facebook page via the so-called “Insights” function. These statistics are provided by Facebook. The “Insights” function cannot be disabled. We cannot decide whether to activate or deactivate this function. It is available to all Facebook fan page operators, regardless of whether they use the Facebook Insights function or not.
Through Facebook Insights, we are provided with the following data for a selectable period with regard to fans, subscribers, people reached and people interacting with the page: total number of page views, likes including origin, page activities, post interactions, reach, post reach, divided into organic, viral and paid interactions, comments, shared content, replies and demographic analyses, including country of origin, gender and age. With Insights statistics, it is not possible for us to identify subscribers and fans of our page or view their profiles.
On the social networks Facebook and Instagram, we have the option of receiving statistical data about the use of our Facebook page and our Instagram profile via the so-called “Insights” function. These statistics are provided by Facebook and Instagram. The “Insights” function cannot be disabled. We cannot decide whether to activate or deactivate this function. It is available to all Facebook fan page operators and all operators of an Instagram business account, regardless of whether they use the Insights function.
Through Facebook Insights, we are provided, in anonymised form and for a selectable period, with data relating to fans, subscribers, people reached and people interacting with the page, including the following: total number of page views, likes including origin, page activities, post interactions, reach, post reach, divided into organic, viral and paid interactions, comments, shared content, replies and demographic analyses, including country of origin, gender and age. With Insights statistics, it is not possible for us to identify subscribers and fans of our page or view their profiles.
In addition, Instagram Insights provides us, in anonymised form, with data on the development and reach of our Instagram profile and of the posts, stories and videos we publish there. We also receive statistical information via Instagram Insights on the place of origin, gender and age of the subscribers to our Instagram profile.
The social networks with which you communicate store your data using pseudonyms as usage profiles and use this data for advertising and market research purposes. For example, advertisements may be displayed to you within the social network and on other third-party websites that correspond to your presumed interests. Cookies are generally used for this purpose and are placed on your device by the social network. You have the right to object to the creation of these usage profiles. To exercise this right, you must contact the social networks directly.
11.2 Purpose
We maintain profiles on the aforementioned social networks for the purpose of public relations and corporate communication with customers and interested parties. We use the Facebook and Instagram “Insights” function to evaluate the reach of our posts on the social network and to make them more appealing to our visitors in the future.
11.3 Legal basis
The legal basis for data processing in connection with our profiles on social networks is the protection of our overriding legitimate interests (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 8.2. If the respective operator of a social network asks you for consent, the legal basis is Art. 6 para. 1 lit. a GDPR. In addition, data processing with regard to our Facebook page and our Instagram page is carried out on the basis of joint controllership pursuant to Art. 26 GDPR.
11.4 Recipients and transfer to third countries
The respective social networks are operated by the companies listed below. Further information on data protection with regard to our profiles on the social networks can be found in the linked privacy policies.
Facebook:
Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA
Privacy policy:
http://www.facebook.com/policy.php
http://www.facebook.com/help/186325668085084
http://www.facebook.com/about/privacy/your-info-on-other#applications
http://www.facebook.com/about/privacy/your-info#everyoneinfo
Instagram:
Instagram LLC, 1601 Willow Rd, Menlo Park, California 94025, USA
Privacy policy:
https://help.instagram.com/155833707900388/
YouTube:
YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA
YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
YouTube/Google privacy policy:
https://www.google.com/policies/privacy/?hl=en
The social networks also process your personal data in the USA.
12. FONT REPLACEMENT
When our website is displayed, the standard fonts on your device are replaced with other fonts. This is done in order to present the text on our customer portal to you in a more readable and aesthetically pleasing manner. For font replacement, we have chosen a data protection-friendly solution. We do not integrate external services such as Google Fonts or Adobe Fonts. Instead, we store the replacement fonts locally on our server.
This has the advantage that, when our website is accessed, your browser does not make a request to external font replacement services, meaning that no data, in particular your IP address in connection with the address of our website, is transmitted to third parties.
13. YOUTUBE
13.1 Description of processing
Our website uses services provided by “YouTube”, a video platform operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA, hereinafter referred to as “YouTube”. YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
We use YouTube by embedding individual videos from the platform on our website as so-called iFrames, so that they can be played directly on our website. The videos are embedded using the “enhanced privacy mode” offered by YouTube. This means that no personal data concerning you is transmitted to Google as long as you do not play the videos. Data is only transmitted to Google when a video is played, and we have no influence over this transmission.
If you play an embedded video on a subpage of our website, Google is informed which subpage you visited and which video you watched. Where applicable, your IP address is also transmitted to Google. If you are logged in as a YouTube or Google user at the time, Google assigns this information to your user account.
Google stores your data as usage profiles and uses it for advertising purposes, market research and/or the needs-based design of Google websites. You have the right to object to the creation of such usage profiles. To exercise this right, you must contact Google directly. Further information on data protection at Google can be found at www.google.com/intl/en/policies/privacy/.
13.2 Purpose
The processing is carried out in order to display videos on our website.
13.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 14.2.
13.4 Recipients and transfer to third countries
Through the integration of YouTube, personal data may be transmitted to YouTube LLC or Google. Google also processes your personal data in the USA.
14. VIMEO
14.1 Description of processing
Our website uses services provided by “Vimeo”, a video platform operated by Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA, hereinafter referred to as “Vimeo”. We use Vimeo by embedding individual videos from the platform on our website as so-called iFrames, so that they can be played directly on our website.
When you visit a subpage of our website on which a video is embedded, a connection is established to the Vimeo servers and the video is displayed within the website. This informs Vimeo which website you have visited. Where applicable, your IP address is also transmitted to Vimeo. If you play an embedded video, this information is also passed on to Vimeo. If you are logged in as a Vimeo user at the time, Vimeo assigns this data to your user account. Further information on data protection at Vimeo can be found at http://vimeo.com/privacy.
14.2 Purpose
The processing is carried out in order to display videos on our website.
14.3 Legal basis
The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated above.
14.4 Recipients and transfer to third countries
Through the integration of Vimeo videos, personal data may be transmitted to Vimeo LLC. Vimeo also processes data in the USA.
15. FACEBOOK PIXEL
15.1 Description of processing
Our website uses the remarketing service “Facebook Pixel”, operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA, “Facebook”. Through the “Facebook Pixel”, we are able to place advertisements on the social network that are targeted specifically at those Facebook users who have shown interest in our services, for example by previously visiting our website.
With the help of the “Facebook Pixel”, we can also track and analyse the effectiveness and reach of our advertising on Facebook by recording whether Facebook users interact with our advertisements on the social network and are redirected to our website by clicking on the advertisements.
When you visit our website, a connection is therefore established to the Facebook servers and the “Facebook Pixel” is embedded in our website. In addition, Facebook may store a cookie on your device; see Section 8. If you are logged in to Facebook or log in to Facebook later, your visit to our website is assigned to your user account.
The data collected about you by means of the “Facebook Pixel” is anonymous for us. It does not allow us to draw any conclusions about you personally. However, Facebook may be able to link the data to your user profile. Data processing by Facebook is carried out in accordance with the company’s Data Policy, which can be accessed at www.facebook.com/policy.php.
15.2 Purpose
The processing is carried out in order to conduct targeted online advertising for our own services and to analyse its effectiveness and reach.
15.3 Legal basis
The processing is carried out on the basis of consent pursuant to Art. 6 para. 1 lit. a GDPR. This consent is obtained by us via the consent tool; see Section 8.1. Such consent is voluntary.
15.4 Storage period, right to object and withdrawal of consent
The storage period and your control and setting options for cookies and tracking pixels are explained in Section 8. You may withdraw your consent with regard to data collection by the “Facebook Pixel” and the use of your data to display Facebook advertisements at any time in the settings of the consent tool with effect for the future.
You may also object to data collection by the “Facebook Pixel” and the use of your data to display Facebook advertisements directly vis-à-vis Facebook at any time. Within the settings of your Facebook account at facebook.com/settings?tab=ads, you can decide which types of advertisements are displayed to you on Facebook. This setting is applied across devices.
15.5 Recipients and transfer to third countries
Through the integration of the “Facebook Pixel”, personal data may be transmitted to Facebook. Facebook also processes your personal data in the USA.
V SECURITY MEASURES
16. SECURITY MEASURES
To protect your personal data against unauthorised access, we have equipped our website with an SSL or TLS certificate. SSL stands for “Secure Sockets Layer” and TLS stands for “Transport Layer Security”; both encrypt data communication between a website and the user’s device. You can recognise active SSL or TLS encryption by the small padlock icon displayed on the far left of the browser’s address bar.
VI YOUR RIGHTS
17. Rights of data subjects
With regard to the data processing by our company described above, you have the following rights as a data subject:
17.1 Right of access (Art. 15 GDPR)
You have the right to obtain from us confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right, under the conditions set out in Art. 15 GDPR, to access this personal data and the information listed in detail in Art. 15 GDPR.
17.2 Right to rectification (Art. 16 GDPR)
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete personal data.
17.3 Right to erasure (Art. 17 GDPR)
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds listed in detail in Art. 17 GDPR applies, for example if your data is no longer required for the purposes pursued by us.
17.4 Right to restriction of processing (Art. 18 GDPR)
You have the right to obtain from us restriction of processing where one of the conditions listed in Art. 18 GDPR applies, for example if you contest the accuracy of your personal data. In that case, processing will be restricted for a period enabling us to verify the accuracy of your data.
17.5 Right to data portability (Art. 20 GDPR)
Under the conditions set out in Art. 20 GDPR, you have the right to receive the data concerning you in a structured, commonly used and machine-readable format.
17.6 Withdrawal of consent (Art. 7 para. 3 GDPR)
Where processing is based on consent, you have the right to withdraw your consent at any time. The withdrawal applies from the time it is asserted. In other words, it has effect for the future. The withdrawal of consent therefore does not render the processing unlawful retroactively.
17.7 Right to lodge a complaint (Art. 77 GDPR)
If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. You may exercise this right with a supervisory authority in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement.
17.8 Prohibition of automated decision-making/profiling (Art. 22 GDPR)
Decisions that produce legal effects concerning you or significantly affect you must not be based solely on automated processing of personal data, including profiling. We inform you that we do not use automated decision-making, including profiling, with regard to your personal data.
17.9 Right to object (Art. 21 GDPR)
If we process personal data concerning you on the basis of Art. 6 para. 1 lit. f GDPR, namely for the purposes of overriding legitimate interests, you have the right to object to this processing under the conditions set out in Art. 21 GDPR. However, this only applies insofar as there are grounds relating to your particular situation.
Following an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms. We are also not required to stop processing if it serves the establishment, exercise or defence of legal claims.
In any case, including irrespective of a particular situation, you have the right at any time to object to the processing of your personal data for direct marketing purposes.
Last updated: July 2026