Data protection statement pursuant to the GDPR
This statement aims to explain data collection and processing procedures when visiting our website as well as during our telephone interviews and online surveys. Personal data means all data that refers to you as an individual, e.g. name, address, email addresses, user behaviour or IP address.
I. General information about data processing
1. Scope of processing personal data
We generally collect and use personal data from our users only as required to provide a functioning website and to deliver our content and services. We collect and use personal data on a regular basis only with the user’s consent. There is an exception where prior consent cannot be obtained for factual reasons, and there are legal provisions that permit the processing of data.
During the course of our telephone interviews and online surveys we collect and process personal data for which we either have received written consent from former respondents or that has been transferred to us by our client within an order processing contract for the duration of the market research study. Additionally, we receive personal data from third-party suppliers, who have in advance confirmed in writing the legal and lawful processing and forwarding of personal data. Lastly we use numbers that are systematically generated. During this procedure the last two digits of an existing telephone number are removed and randomly replaced by two new digits in our system.
During the course of every market research study all your answers are either anonymised or pseudonymised, guaranteeing that no conclusions by which you could be identified can be drawn.
2. Legal basis for processing personal data
Insofar as we have obtained an individual’s consent for the processing of their data, art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
When processing personal data required for the fulfilment of a contract where the signatory to the contract is the individual concerned, art. 6(1)(b) of the GDPR serves as the legal basis therefor. This also applies to the processing of data which is required for the implementation of pre-contractual measures. Where the processing of personal data is required to comply with a legal obligation to which our company is subject, art. 6(1)(c) of the GDPR serves as the legal basis therefor.
Where the processing of personal data is required to protect the vital interests of the individual concerned or of another natural person, art. 6(1)(d) of the GDPR serves as the legal basis therefor.
If the processing of data is required to safeguard a legitimate interest of our company or that of a third party, and this interest is not overridden by the individual’s interests or fundamental rights and freedoms, art. 6(1(f) of the GDPR serves as the legal basis for the processing.
3. Deletion of data and retention period
An individual’s personal data is deleted or blocked as soon as the purpose for saving it expires. Data may also be saved when this is prescribed by European or national legislators in Union law decrees, laws, or other regulations to which the responsible party is subject. Data will also be blocked or deleted when the retention period prescribed in the standards specified has expired, unless there is a requirement to further save the data for the conclusion or fulfilment of a contract.
4. Use of third-party website services
We sometimes use external service providers to process your data. We are careful when selecting and appointing these service providers. They are required to follow our instructions and are subject to regular inspection. Data will not be transferred to countries outside the EU or the EEA (so-called third-party States).
IV. Rights of the data subject
Each data subject has the right of Access pursuant to article 15 of the GDPR, the right to rectification pursuant to article 16 of the GDPR, the right to erasure pursuant to article 17 of the GDPR, the right to restriction of processing pursuant to article 18 of the GDPR, the right to object pursuant to article 21 of the GDPR and the right to data portability pursuant to article 20 of the GDPR. The right of access and right to erasure are subject to the restrictions pursuant to Sections 34 and 35 of the German Federal Data Protection Act (BDSG), if applicable. The individual also has the right to make a complaint to a data protection supervisory authority – article 77 of the GDPR (in conjunction with Section 19 of the BDSG).
You may withdraw your consent to the processing of your personal data with us at any time. This also applies to the withdrawal of statements of consent provided to us prior to the EU General Data Protection Regulation coming into effect, i.e. prior to 25 May 2018. Please note that withdrawal is only effective for the future. Any data processed prior to withdrawal of consent will not be affected. Withdrawal has no form requirement and should, where possible, be addressed to the responsible body (see Point I).
Provision of the website and the creation of log files
1. Description and scope of data processing
Each time our website is accessed, our system automatically records data and information from the accessing computer’s system. If the website is used for information purposes only, we only collect the personal data that your browser transfers to our server.
This data is also saved in our system’s log files. This does not concern the user’s IP addresses, or other data which would allow this information to be assigned to an individual user. This data is not saved with the user’s other personal data.
2. Legal basis for data processing
The legal basis for temporarily saving data is art. 6(1)(f) of the GDPR.
3. Purpose of data processing
The system needs to temporarily save the IP address in order to provide the website to the user’s computer. This means that the user’s IP address must be saved for the duration of the session.
These purposes also cover our legitimate interest in data processing pursuant to art. 6(1)(f) of the GDPR.
4. Retention period
Data is deleted as soon as it is no longer required for the purpose for which it was captured. Where data is collected to allow us to provide the website, it is deleted at the end of each session.
5. Option of objection and elimination
Collecting data in order to provide the website, and saving this data in log files, is crucial for the operation of the Internet site. Consequently, the user has no option of objection.
VI. Contact form and email contact
1. Description and scope of data processing
There is a contact form on our website which can be used to make contact electronically. If a visitor uses this option, the data entered in the input screen will be transmitted to us and saved.
So that we can process this data, your consent will be obtained as part of the submission process, and you will be referred to this data protection statement.
Alternatively, we can be contacted via the email address provided. In this event, the user’s personal details contained in the email will be saved.
This data will not be forwarded to third parties. This data will only be used to process the conversation.
2. Legal basis for data processing
The legal basis for processing data where the user has granted consent is art. 6(1)(a) of the GDPR.
The legal basis for processing data transmitted in the course of sending an email is art. 6(1)(f) of the GDPR. If the aim of the email contact is the execution of a contract, a further legal basis for processing the data is art. 6( 1)(b) of the GDPR.
3. Purpose of data processing
We will process personal data from the input screen only to respond to the enquiry. If we are contacted by email, we also have a necessary legitimate interest in processing the data.
Other personal data processed during the submission process serves to prevent misuse of the contact form and ensure the security of our technical information systems.
4. Retention period
Data is deleted as soon as it is no longer required for the purpose for which it was recorded. For personal data from the contact form input screen and data submitted via email, this occurs when the particular conversation with the user has ended. The conversation ends when circumstances indicate that the specific issue has been definitively dealt with.
Other personal data recorded during the submission process will be deleted at the latest after a period of seven days.
5. Option of objection and elimination
The user has the option to withdraw their consent to their personal data being processed at any time. If the user contacts us via email, they may object at any time to their personal data being processed. In this event, the conversation cannot be progressed. Withdrawal has no form requirement and should be addressed to the responsible party.
All personal data saved in the course of contact with us will then be deleted.
VII. Use of Google Analytics
1. Description and scope of data processing
This website uses Google Analytics, a web analysis service provided by Google Inc. (‘Google’). Google Analytics uses so-called ‘cookies’, text files that are stored on your computer and that enable us to analyse your use of our website. As a rule, the information generated by the cookie concerning your use of this website will be transmitted to a Google server in the USA and stored there. If IP anonymisation is activated on this website, however, your IP address will be truncated beforehand by Google within the Member States of the European Union and in other countries which are contracting parties to the Agreement on the European Economic Area. The full IP address will be transmitted to a Google server in the USA and only truncated there in exceptional circumstances. On the instructions of the operator of this website, Google will use this information to analyse your use of the website, compile reports about website activities and provide other services related to the use of the website and of the Internet to the website operator.
The IP address transmitted from your browser within Google Analytics will not be linked to other Google data.
This website uses Google Analytics with the extension ‘_anonymizeIp()’. This means that IP addresses are truncated prior to further processing and cannot therefore be linked to a particular individual. Where the data collected has a personal connection to you, it will thus be excluded, and the personal data therefore deleted immediately.
2. Legal basis for data processing
The legal basis for processing data using cookies for analysis purposes where the user has granted specific consent is art. 6(1)(a) of the GDPR.
3. Purpose of data processing
We use Google Analytics so that we can analyse the use of our website and make regular improvements. The statistics we obtain enable us to improve our offer and make it more interesting for you as a user. In the exceptional circumstance where personal data is transferred to the USA, Google complies with the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is art. 6(1)(f) s. 1(f) of the GDPR.
4. Retention period, option of objection and elimination
You can prevent cookies from being stored by configuring your browser software accordingly; we would like to make you aware, however, that in this case you may not be able to use all the functions of this website to their full extent. In addition, you can prevent the compilation of the data created by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available at this link: tools.google.com/dlpage/gaoptout.
5. Third-party supplier details
Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of Service: www.google.com/analytics/terms/us.html, Data protection summary: www.google.com/intl/de/analytics/learn/privacy.html, and the Privacy Policy: www.google.de/intl/de/policies/privacy.
[(7) This website also uses Google Analytics for the cross-device analysis of visit flows via a single user-ID. You can deactivate the cross-device analysis of your usage in your customer account under ‘My data’, ‘personal data’.]
VIII. Google Analytics Remarketing
1. Description, purpose and scope of data processing
Our websites use the functions of Google Analytics Remarketing in connection with the cross-device functions of Google AdWords and Google DoubleClick. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
This function allows the target audiences for advertising which were created with Google Analytics Remarketing to be linked with the cross-device functions of Google AdWords and Google DoubleClick. This allows Interest-based, personalised advertising tailored to you on the basis of your previous usage and surfing behaviour on one device (e.g. mobile phone) to also be displayed on another device (e.g. tablet or PC).
2. Retention period, option of objection and elimination
If you have granted relevant consent, Google will link your Web and App browser history with your Google account for this purpose. This means that the same personalised advertising can appear on every device you log onto with a Google account.
To support this function, Google Analytics records Google-authenticated user-IDs, which are temporarily linked to our Google Analytics data, to define and create target audiences for cross-device promotional advertising.
You can permanently refuse cross-device Remarketing/Targeting by deactivating personalised advertising in your Google account; follow the link below: www.google.com/settings/ads/onweb.
3. Legal basis for data processing
Data recorded will only be merged with your Google account with your consent, which you may grant or withdraw (art. 6(1)(a) of the GDPR). Where data capture processes are not merged with your Google account (e.g. because you do not have a Google account or have deactivated merging), data is captured on the basis of art. 6(1)(f) of the GDPR. The legitimate interest arises from the fact that the website operator has an interest in the anonymous analysis of visitors to the website for advertising purposes.
4. Third-party supplier details
More detailed information and the data protections provisions can be found in Google’s Privacy Policy at www.google.com/policies/technologies/ads/
IX. Integration of Google Maps
We use the services of Google Maps on this website. This enables us to show you interactive maps directly on the website, and makes it easy for you to use the maps function.
When you visit the website, Google receives the information that you have accessed the corresponding sub-page of our website. The data specified under point IV of this statement is also transferred. This takes place regardless of whether Google provides a user account via which you have logged in, or there is no user account. If you are logged into Google, your data will be assigned directly to your account. If you do not want your data to be assigned to your profile in Google, you will need to log out before enabling the button. Google saves your data as usage profiles for the purposes of advertising, market research, and/or where necessary for the design of its website. Such evaluation is performed in particular (even for users who are not logged in) to provide needs-based advertising and to inform other social network users about your activities on our website. You have the right to object to this user profile being created by contacting Google to exercise this right.
Further information concerning the purpose and scope of data capture and its processing by the plug-in provider can be found in the provider’s privacy statements. This site also provides further information about your rights in this respect and the optional settings to protect your private domain: www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA, and complies with the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.