Thank you very much for your interest in our website and the information provided there. As we take the protection of the privacy of the users of our website and our customers very seriously and comply with the legal regulations on the protection of personal data, as contained in the Federal Data Protection Act (BDSG) and the Telemedia Act (TMG), we would like to inform you below about how we handle your data:

Data Collection and Data Processing Whenever our website is accessed, and the files stored there are retrieved, this is logged for statistical purposes and to improve our online offering. The data regarding access and retrieval does not allow us to infer your identity. We store the data in so-called server log files. The data logged and stored include: the name of the retrieved file, the date and time of the retrieval, the amount of data transferred, a notification about the success of the access or retrieval, and the IP address of the requesting device.

We only collect personal data when the website user voluntarily provides it, for example, in the form of inquiries (e.g., via email or by using a contact form on our website) or in the context of legal transactions with us.

Data Controller under the General Data Protection Regulation (GDPR) The data controller within the meaning of the GDPR is the operator of the website you are currently visiting. Our contact details can be found in the provider identification (imprint) of the website you are visiting.

Data Collection and Data Processing

  1. Creation of Log Files During Your Visit to Our Website

Whenever our website is accessed and files stored there are retrieved, data is automatically logged. We store this data in so-called server log files. Specifically, the logged and stored data includes:

  • Name of the retrieved file,
  • Date and time of the retrieval,
  • Amount of data transferred,
  • Notification about the success of the access or retrieval,
  • IP address of the requesting device,
  • Browser type,
  • The operating system used by the visitor.

These data are not combined with other personal data of the website visitor, meaning that the information cannot be used to identify you.

Purpose of Processing Storing your IP address is necessary because, without it, it would not be possible to transfer the content of our website to your computer. Your IP address must remain stored for the duration of the session—the ongoing connection between the internet browser (client-side application) you are using and the server we are using to operate the website. The purpose of storing your data in server log files is to ensure the functionality of our website and to optimize the web presence you are visiting. Additionally, this data helps us maintain the security of the information technology systems we use.

Legal Basis for Data Processing The legal basis for storing data and server log files, considering the described processing purposes, is § 15 I TMG (valid until May 24, 2018) and, starting from May 25, 2018, Article 6 I (f) GDPR (processing is necessary for the purposes of the legitimate interests of the controller or a third party).

Retention Period We delete the automatically stored access and retrieval data when they are no longer needed for the purpose of their collection. Regarding the provision of our website, this happens when the session—i.e., the ongoing connection between your browser and our server—is terminated. The stored IP address and the server log file are deleted no later than 7 days after storage to prevent any association of the remaining data (name of the retrieved file, date and time of retrieval, amount of data transferred, notification of the success of the access or retrieval, browser type, operating system) with the requesting device and its IP address.

Right to Object The data collected for providing our website and stored in server log files is essential for the operation of the website and cannot be waived. Therefore, you do not have the right to object in this regard.

  1. Processing of Personal Data for Inquiries about Our Services or Products

We only collect personal data when the website user voluntarily provides it, for example, in the form of inquiries regarding our services or products (e.g., via email). The personal data submitted with the inquiry will be stored. These data will not be shared with third parties and will only be used for processing the correspondence initiated by the inquiry.

Purpose of Processing The processing of the data submitted with inquiries about our services or products is done to process and respond to the inquiries.

Legal Basis for Data Processing The legal basis for storing the data submitted in the context of inquiries about our services or products, considering the processing purpose described above, is § 28 I 1 No. 2 BDSG (valid until May 24, 2018) and, starting from May 25, 2018, Article 6 I (f) GDPR (processing is necessary for the purposes of the legitimate interests of the controller or a third party). If the inquiry relates to the conclusion of a contract with us, the legal basis is § 28 I 1 No. 1 BDSG (valid until May 24, 2018) and, starting from May 25, 2018, Article 6 I (b) GDPR.

Retention Period We delete the data transmitted in the context of inquiries about our services or products when it is no longer necessary for the purpose of storage. This is the case when the inquiry has been responded to, and it is clear from the circumstances that no further correspondence is necessary.

Right to Object The inquirer has the right to object to the storage of their personal data. However, further responses to the inquiry will no longer be possible. If you wish to submit an objection, please do so in writing and send the objection to one of the contact methods listed in the imprint of our website (mail, email, fax). After receiving the objection, the personal data submitted in the context of the inquiry will be deleted immediately.

  1. Processing of Personal Data for Inquiries via the “dsa Secure” Contact Form

To receive and process your inquiries, we use a contact form provided by dsa Marketing AG (www.dsa-marketing.ag; Im Lipperfeld 22 a – 24, 46047 Oberhausen) integrated into our website via an “iFrame”. An “iFrame” is an HTML element that is embedded within a website in the form of a frame or window. The contact form provided by dsa Marketing AG is encrypted using the Secure-Sockets-Layer (SSL) network protocol.

When you submit an inquiry through this contact form, it is first forwarded to servers of dsa Marketing AG, temporarily stored there, and then automatically transferred to us. dsa Marketing AG does not process the personal data provided in your inquiry for its purposes or third-party purposes (with the exception of us). After the transfer, dsa Marketing AG deletes your personal data through an automated process. Employees overseeing this process at dsa Marketing AG have committed to adhering to data protection requirements and confidentiality.

Purpose of Processing The processing of data transmitted in the context of inquiries about our services or products is done to process and respond to the inquiries.

Legal Basis for Data Processing The legal basis for processing data using the “dsa Secure” contact form, for which we obtain the visitor’s voluntary consent, is, until May 24, 2018, § 4 I BDSG §§ 12, 13 TMG and, starting May 25, 2018, Article 6 I (a) GDPR (consent by the person concerned for the processing of their personal data for one or more specific purposes).

Obtaining Your Consent Before you submit the completed “dsa Secure” contact form, you will be made aware of this privacy policy, and we will ask for your consent regarding the data processing described here.

Right to Withdraw You have the right to withdraw your consent to the processing of your personal data. Should you wish to declare a withdrawal of consent, we kindly ask you to do so in writing and send your declaration to one of the contact methods listed in the imprint of our website (mail, email, fax). After receiving the withdrawal, the personal data will be deleted immediately unless there is another legal basis for processing the data. The lawfulness of data processing that took place before your withdrawal remains unaffected.

Retention Period If no withdrawal of your consent is submitted, we delete the data transmitted in the context of inquiries about our services or products when it is no longer necessary for the purpose of storage. This is the case when the inquiry has been responded to, and it is clear from the circumstances that no further correspondence is necessary.

  1. Processing of Personal Data for Contract Initiation, Fulfillment, and Amendment We process personal data that is necessary for the establishment, fulfillment, or modification of a contract between you and us. These data include:
  • Name and address of the contract partner,
  • Type and quantity of the booked service or product,
  • The selected payment method.

Depending on the nature of the service or product, additional data may be required.

If the payment method involves SEPA direct debit, the following additional data will be processed:

  • Bank account details of the contract partner.
  • Credit card details of the contract partner.

If the ordered services and/or goods are subject to legal restrictions (e.g., age restrictions), the necessary data required to fulfill the contract under the relevant legal restriction (e.g., age of the contract partner in the case of legal age restrictions) will also be processed.

If a payment via credit card is agreed upon with the contract partner, the following additional data will be processed:

Purpose of Processing The processing of the specified data serves to execute the contracts concluded with us, including the agreed-upon provision of services. Transfer of Data to Third Parties Data necessary for the fulfillment of the contract will be transmitted to third parties in the following cases:
a. Agreed payment method SEPA direct debit: Your bank account details will be forwarded to the bank handling the payment.
b. Agreed payment method credit card: Your credit card details will be forwarded to the bank handling the payment or to the payment service provider.
c. Shipment of goods or delivery: Your address and the data on the ordered goods will be forwarded to the shipping or transport company contracted by us for delivery purposes.
d. Fulfillment of tax obligations: If we have engaged a tax advisor, data will be shared with them to the extent necessary to fulfill our tax obligations.

Legal Basis for Data Processing
The legal basis for processing the data, considering the purpose described above, is Article 6 I (b) GDPR (processing is necessary for the performance of a contract to which the data subject is a party) and includes processing for pre-contractual measures.

Retention Period
We store the data necessary for the fulfillment and modification of a contract with us until the expiration of the legal retention periods, particularly tax-related retention periods. For example, the retention period for contracts and long-term order documents that do not serve as the basis for bookings, as well as shipping documents, is currently 6 years (in the case of long-term order documents, this period begins after the contract expires), cf. § 147 III 1 Abgabenordnung (AO). Invoices must be retained for ten years under § 147 II in connection with § 147 I Nos. 1, 4, and 4a Abgabenordnung (AO).
After the legal retention periods expire, we delete or block the data unless it is still necessary for concluding or fulfilling a contract.

If no contract is concluded between you and us, we delete the data collected or transmitted for pre-contractual measures if it becomes clear from the circumstances that no further correspondence regarding the relevant service or product is necessary.

Right to Object
If the processing of your personal data was related to pre-contractual measures and no contract was concluded between you and us, you have the right to object to the data storage. If you wish to object, we kindly ask you to do so in writing and send your objection to one of the contact methods listed in the imprint of our website (mail, email, fax).
After receiving the objection, the personal data collected or transmitted during pre-contractual measures will be deleted immediately.

Regarding the data necessary for contract fulfillment or contract modification, no objection is possible due to their necessity for the purposes mentioned.

Other Processing
If the collection and use of personal data are not based on actual circumstances and do not fall under any of the above scenarios, data processing will generally only take place with the consent of the data subject.

Purpose of Processing
The collection and use of personal data generally occur only to enable the functional operation of our website and to improve it.

Legal Basis for Data Processing
The legal basis for data processing, where consent from the data subject is obtained, is Article 6 I (a) GDPR (consent by the data subject to the processing of their personal data for one or more specific purposes).

Right to Withdraw
You have the right to withdraw your consent to the processing of your personal data. Should you wish to declare a withdrawal of consent, we kindly ask you to do so in writing and send your declaration to one of the contact methods listed in the imprint of our website (mail, email, fax). After receiving the withdrawal, the personal data will be deleted immediately unless there is another legal basis for processing the data. The lawfulness of data processing that took place before your withdrawal remains unaffected.

Your personal data will not be shared with third parties or otherwise marketed, but will only be used for order processing. Upon request, we will inform you in writing in accordance with applicable law whether and which personal data concerning you has been stored. You may also revoke your consent to the use of your personal data at any time.

Use of “Google Analytics”
“Google Analytics” is used on our website. This is a web analytics service provided by Google Ireland Limited (www.google.de; address: Gordon House, Barrow Street, Dublin 4, Ireland) within the European Economic Area and Switzerland, which uses so-called “cookies”.

Cookies are text files that are sent to the respective website user by the website operator when their web presence is accessed and stored in or by the internet browser of the accessing device.

A distinction is made between two types of “cookies”: temporary and permanent.

Temporary “cookies” are automatically removed from your device when you close your internet browser.

Permanent “cookies” remain stored on your device even after the internet browser is closed and can be recognized by the website operator during your next visit, as these “cookies” usually contain a characteristic string of characters, called a “cookie ID”. Websites and internet servers assign this string to the web browser where the permanent “cookie” was stored. Therefore, your browser can be uniquely identified using the “cookie ID”.

The information generated by a “Google Analytics” cookie about your use of our website is transferred to and stored on a server of Google Ireland Limited.

Google Ireland Limited will use this information to evaluate your use of our website, compile reports on website activities, and provide further services related to website use and internet use to the website operator.

“Google Analytics” collects, for example:

  • Date and time of your visit to our website,
  • The website you visited previously,
  • Information about the internet browser you are using,
  • The IP address of the requesting device.

We only use the “Google Analytics” tracking tool with IP anonymization enabled.

IP anonymization shortens the IP addresses of visitors to our website within member states of the European Union or in other contracting states of the European Economic Area Agreement.

Further information about Google’s privacy policy is available at: https://policies.google.com/privacy?hl=de&gl=de

The terms of use for the “Google Analytics” web analytics service are available at: https://www.google.com/analytics/terms/de.html

Data Processing Agreement
We have concluded a data processing agreement with the provider of the “Google Analytics” web analytics service.

Purpose of Processing
We use the “Google Analytics” web analytics service to improve the quality of our website, including the content and services provided there. This service helps us understand how our online presence is used, providing a basis for continuous improvement.

Legal Basis for Data Processing
The legal basis for processing the data, considering the fact that a transfer of your full IP address to Google Ireland Limited’s servers cannot be excluded in exceptional cases, is Article 6 I (a) GDPR (consent by the data subject to the processing of their personal data for one or more specific purposes).

Obtaining Your Consent
When you access our website, you will be informed about the use of “Google Analytics”, and we will ask for your consent regarding the data processing associated with it. We will also make you aware of this privacy policy.

Right to Withdraw
You have the right to withdraw your consent to the processing of your personal data. Should you wish to declare a withdrawal of consent, we kindly ask you to do so in writing and send your declaration to one of the contact methods listed in the imprint of our website (mail, email, fax). After receiving the withdrawal, the personal data will be deleted immediately unless there is another legal basis for processing the data. The lawfulness of data processing that took place before your withdrawal remains unaffected.

Preventing Data Transfer to Google Ireland Limited
You can adjust the settings of your internet browser to ensure that you are notified when cookies are about to be stored on your device.

It is also possible to configure your internet browser to prevent the acceptance of individual or all cookies. However, please note that rejecting cookies generated by “Google Analytics” may affect the functionality of our website.

Additionally, you can prevent the collection of data generated by the “Google Analytics cookie” about your use of our website (including your IP address) and the processing of this data by Google Ireland Limited by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Alternatively, you can prevent the collection by “Google Analytics” on our website for the future by clicking the following link. When you click this link, an “opt-out cookie” will be placed on your device.

If you delete all cookies from your device, you will need to click the link again to install the “opt-out cookie”.

Use of “Google Maps API”
Our website uses the “Google Maps API” service. This service is provided within the European Economic Area and Switzerland by Google Ireland Limited (www.google.de; address: Gordon House, Barrow Street, Dublin 4, Ireland) to display geographic data on an interactive virtual map.

Using “Google Maps API” means that when you visit our website, your internet browser connects to the web servers used by Google Ireland Limited. During the connection between your browser and Google Ireland Limited’s servers, data about the website visitor is automatically collected and forwarded to Google Ireland Limited.

We cannot exclude that the information collected includes the full IP address of the requesting device.

We also cannot exclude the possibility that Google Ireland Limited stores the information mentioned above, which is considered personal data.

Further information about Google’s privacy policy is available at: https://policies.google.com/privacy?hl=de&gl=de.

Purpose of Processing
We use the “Google Maps API” service to display the locations mentioned on our website in an easily accessible and visually appealing manner.

Legal Basis for Data Processing
The legal basis for processing the data, considering the fact that a transfer of your full IP address to Google Ireland Limited’s servers cannot be excluded, is Article 6 I (a) GDPR (consent by the data subject to the processing of their personal data for one or more specific purposes).

Obtaining Your Consent
When you access our website, you will be informed about the use of “Google Maps API”, and we will ask for your consent regarding the data processing associated with it. We will also make you aware of this privacy policy.

Right to Withdraw
You have the right to withdraw your consent to the processing of your personal data. Should you wish to declare a withdrawal of consent, we kindly ask you to do so in writing and send your declaration to one of the contact methods listed in the imprint of our website (mail, email, fax). After receiving the withdrawal, the personal data will be deleted immediately unless there is another legal basis for processing the data. The lawfulness of data processing that took place before your withdrawal remains unaffected.

Preventing Data Transfer to Google Ireland Limited
You can prevent the collection of your data by Google Ireland Limited while using “Google Maps API” by changing the settings of your internet browser for the future.

For example, it is possible to disable the “JavaScript” program, which interacts with your internet browser and allows rapid loading of functions on a static website. However, this will prevent you from using the map function of the “Google Maps API” service for the duration of the deactivation.

Your Rights as a Data Subject
If we process data related to your person, the following rights are available to you as a data subject under the GDPR:

  1. Right of Access You have the right to request information about whether we process personal data related to you. If this is the case, you can request free information about:
  • The purposes of the processing,
  • The categories of data being processed,
  • The recipients or categories of recipients to whom we have disclosed or will disclose your data,
  • The planned storage period for the data, or, if specific information about the storage period is not possible, the criteria we use to determine the storage period,
  • The existence of the right to correct or delete personal data,
  • The existence of the right to restrict the processing of personal data by the controller under the GDPR,
  • The existence of the right to object to the processing of personal data,
  • The right to file a complaint with a supervisory authority,
  • All available information about the source of the data if the data was not collected directly from you as the data subject,
  • The existence of automated decision-making, including profiling under Article 22 I, IV GDPR and, if applicable, relevant information about the logic involved and the scope and intended effects of such processing for you as a data subject under the GDPR,
  • Whether we or a third party we engage transfer your personal data to a third country or international organization. In the case of such a transfer, you can request that we provide information about the appropriate safeguards under Article.

If you wish to request such information, please submit your request in writing to one of the contact methods listed in the imprint of our website.

Under Article 12 I 2 GDPR, this information can also be provided orally if the identity of the person making the request can be proven in another way.

  1. Right to Rectification and Completion of Data You can request the correction of any inaccurate data stored about you at any time, under Article 16 S.1 GDPR.

Similarly, you can request the completion of incomplete personal data under Article 16 S.2 GDPR.

If you wish to request the rectification or completion of your personal data, please submit your request in writing to one of the contact methods listed in the imprint of our website.

  1. Right to Erasure of Personal Data As a data subject under the GDPR, you can request the immediate deletion of personal data about you if one of the following conditions from Article 17 I GDPR is met:
  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
  • The data subject withdraws their consent on which the processing was based under Article 6 I (a) GDPR or Article 9 II (a) GDPR, and there is no other legal basis for processing,
  • The data subject objects to processing under Article 21 I GDPR, and there are no overriding legitimate grounds for processing, or the data subject objects to processing under Article 21 II GDPR,
  • The personal data has been unlawfully processed,
  • The deletion of personal data is required to fulfill a legal obligation under European Union law or the law of the Member States to which the controller is subject,
  • The personal data was collected in relation to information society services offered under Article 8 I GDPR.

If we have made your personal data public and are required under Article 17 I GDPR to delete it, we will, taking into account available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers that process the personal data that you as the data subject have requested the deletion of all links to, or copies or replications of, your personal data.

Exceptions to the Right to Erasure
Under Article 17 III GDPR, the rights of data subjects under Article 17 I and II GDPR do not apply if the data processing:

  • Is necessary for exercising the right to freedom of expression and information,
  • Is required to fulfill a legal obligation under European Union law or the law of the Member States to which the controller is subject,
  • Is necessary for performing a task carried out in the public interest or in the exercise of official authority vested in the controller,
  • Is necessary for reasons of public interest in the area of public health under Article 9 II (h) and (i) GDPR and Article 9 III GDPR,
  • Is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes under Article 89 I GDPR, provided that the right referred to in paragraph 1 would likely render impossible or seriously impair the achievement of the objectives of such processing,
  • Is necessary for the establishment, exercise, or defense of legal claims.
  1. Right to Restriction of Processing of Personal Data
    As a data subject under the GDPR, you can request the restriction of processing of your personal data if one of the following conditions from Article 18 I GDPR is met:
  • The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data,
  • The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead,
  • The controller no longer needs the personal data for the purposes of processing, but it is required by the data subject for the establishment, exercise, or defense of legal claims,
  • The data subject has objected to processing under Article 21 I GDPR pending verification of whether the legitimate grounds of the controller override those of the data subject.

If the processing of your personal data has been restricted, it may only be processed, apart from storage, with your consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State under Article 18 II GDPR.

Under Article 18 III GDPR, we are obliged to notify you, as a data subject under the GDPR, of any restriction of processing carried out under the conditions of Article 18 I GDPR; this must be done before the restriction is lifted.

  1. Right to Notification of Correction or Deletion of Personal Data or Restriction of Processing
    If you have exercised your right to rectification or deletion of your personal data or restriction of processing under the GDPR, we are obliged to notify all recipients to whom the relevant data has been disclosed of the rectification, deletion, or restriction of processing under Article 19 S.1 GDPR.

You have the right to be informed about the recipients of your personal data under Article 19 S.2 GDPR.

Exceptions to the Notification Obligation
The notification obligation under Article 19 S.1 GDPR does not apply if the notification is impossible or involves a disproportionate effort.

  1. Right to Data Portability
    Under Article 20 I GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, as the controller to whom the personal data was provided, if:
  • The processing is based on consent under Article 6 I (a) GDPR or Article 9 II (a) GDPR, or on a contract under Article 6 I (b) GDPR,
  • The processing is carried out by automated means.

The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller under Article 20 III 1 GDPR.

In exercising the right to data portability, you also have the right to have your personal data transmitted directly from one controller to another where technically feasible, provided that this does not adversely affect the rights and freedoms of others.

  1. Right to Object to Data Processing
    As a data subject under the GDPR, you have the right to object, at any time, to the processing of your personal data based on Article 6 I (e) or (f), including profiling based on those provisions, under Article 21 I GDPR, for reasons related to your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims.

Where personal data is processed for direct marketing purposes, you as the data subject have the right, under Article 21 II GDPR, to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent related to such direct marketing.

If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes. You may exercise your right to object using automated means, including technical specifications, in connection with the use of information society services, notwithstanding Directive 2002/58/EC (Directive on Privacy and Electronic Communications, also known as the “ePrivacy Directive”).

  1. Right to Withdraw Your Consent
    If you have given us consent to process your personal data, you have the right to withdraw your consent at any time.
    The lawfulness of the processing of your personal data before the withdrawal will not be affected by your withdrawal.
  2. Your Rights in the Case of Automated Individual Decisions, Including Profiling
    As a data subject under the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you under Article 22 I GDPR.

Exceptions to this Right under Article 22 I GDPR
This right does not apply if the decision:

  • Is necessary for entering into, or the performance of, a contract between the data subject and the controller,
  • Is authorized by European Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or
  • Is based on the data subject’s explicit consent.

Automated decisions under Article 22 II GDPR must not be based on special categories of personal data under Article 9 I GDPR unless Article 9 II (a) or (g) applies and suitable measures are in place to safeguard the data subject’s rights and freedoms and legitimate interests.

In cases covered by Article 22 II GDPR, we will take appropriate measures to safeguard your rights, freedoms, and legitimate interests, including at least the right:

  • To obtain human intervention on the part of the controller,
  • To express your point of view,
  • To contest the decision.
  1. Right to Lodge a Complaint with a Supervisory Authority
    Under Article 78 I GDPR, if you are a data subject under the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data violates the GDPR.

Under Article 22 II GDPR, the supervisory authority to which the complaint has been submitted shall inform the complainant of the progress and outcome of the complaint, including the possibility of judicial remedy under Article 78.

Right to Amend the Privacy Policy
We reserve the right to amend or update this privacy policy as necessary to comply with the applicable legal requirements in your interest and ours. For this reason, we recommend that you regularly review the privacy policy available on our website.

Other Information
We strive to protect personal data from third-party access as far as technically and organizationally possible. However, complete data security cannot be guaranteed when communicating via electronic mail (email), and we therefore recommend that you send confidential information by postal mail.