This data protection declaration clarifies the type, scope and purpose of the processing of personal data (hereinafter referred to as "data") within our online offer and the websites, functions and contents connected with it as well as external online presences, such as our Social Media Profile (hereinafter referred to collectively as "online offer"). With regard to the terms used, such as "processing" or "responsible person", we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
HealthCare Commerce GmbH
1030 Vienna, Austria
Managing Director: Dominik Flener
Data protection officer: Dominik Flener (E-Mail)
Visitors and users of the online offer (in the following we will refer to the persons concerned collectively as "users").
"Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
"Processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is broad and covers virtually all processing of data.
"pseudonymisation" means the processing of personal data in such a way that the personal data cannot be related to a specific data subject without the inclusion of supplementary information, provided that this supplementary information is kept separate and is subject to technical and organisational measures ensuring that the personal data is not related to an identified or identifiable natural person
"profiling" means any automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular with a view to analysing or predicting aspects relating to the performance of work, the economic situation, health, personal preferences, interests, reliability, conduct, location or movement of that natural person
Responsible person" means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
"processor" means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not stated in the data protection declaration, the following applies: The legal basis for obtaining consent is Art. 6 Para. 1 lit. a and Art. 7 GDPR, the legal basis for processing for the purpose of fulfilling our services and implementing contractual measures and answering enquiries is Art. 6 Para. 1 lit. b GDPR, the legal basis for processing for the purpose of fulfilling our legal obligations is Art. 6 Para. 1 lit. c GDPR, and the legal basis for processing for the purpose of safeguarding our legitimate interests is Art. 6 Para. 1 lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the varying degrees of probability and severity of the risk to the rights and freedoms of natural persons.
These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access, input, disclosure, safeguarding of availability and separation of data relating to them. Furthermore, procedures have been put in place to ensure that data subjects' rights are exercised, that data are deleted, and that data is responded to threats to it. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by designing technology and by using data protection-friendly presettings (Art. 25 GDPR).
If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer it to them or otherwise grant them access to the data, this is only done on the basis of a legal authorisation (e.g. if the data must be transferred to third parties, such as payment service providers, in accordance with Art. 6 Para. 1 letter b GDPR for the fulfilment of the contract), if you have given your consent, if a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).
If we commission third parties to process data on the basis of a so-called "contract processing agreement", this is done on the basis of Art. 28 GDPR.
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of using the services of third parties or disclosure or transfer of data to third parties, this will only take place if it is done to fulfil our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we will only process or transfer the data in a third country if the special requirements of Art. 44 ff. GDPR. This means that the processing is carried out, for example, on the basis of special guarantees, such as the officially recognised establishment of a level of data protection equivalent to that in the EU (e.g. for the USA through the "Privacy Shield") or compliance with officially recognised special contractual obligations (so-called "standard contractual clauses").
You have the right to obtain confirmation as to whether or not data in question is being processed and to obtain information about this data and to receive further information and a copy of the data in accordance with Art. 15 GDPR.
You have accordingly. Art. 16 GDPR the right to request the completion of data concerning you or the correction of incorrect data concerning you.
In accordance with Art. 17 GDPR, you have the right to demand that data relating to you be deleted immediately or, alternatively, in accordance with Art. 18 GDPR, to demand that the processing of the data be restricted.
You have the right to demand that the data concerning you which you have made available to us be received in accordance with Art. 20 GDPR and to demand that it be passed on to other responsible parties.
You also have the right under Art. 77 GDPR to lodge a complaint with the competent supervisory authority.
You have the right to revoke consents granted in accordance with Art. 7 Para. 3 GDPR with effect for the future.
You can object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. In particular, you may object to processing for the purposes of direct advertising.
Cookies" are small files that are stored on the user's computer. Different information can be stored within the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after his visit to an online offer. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online offer and closes his browser. In such a cookie, for example, the contents of a shopping basket in an online shop or a login status can be stored. Cookies are described as "permanent" or "persistent" if they remain stored even after the browser is closed. For example, the login status can be saved if users visit the site after several days. Similarly, the interests of users can be stored in such a cookie, which are used for coverage measurement or marketing purposes. Third-party cookies" are cookies that are offered by providers other than the person responsible for the online offer (otherwise, if it is only their cookies, it is referred to as "first-party cookies").
We may use temporary and permanent cookies and provide information on this in our data protection declaration.
If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer.
The data processed by us will be deleted or limited in their processing in accordance with articles 17 and 18 GDPR. Unless expressly stated in this data protection declaration, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and the deletion does not conflict with any statutory storage obligations. If the data are not deleted because they are required for other and legally permissible purposes, their processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
In accordance with legal requirements in Germany, data is stored in particular for 10 years in accordance with §§ 147 (1) AO, 257 (1) nos. 1 and 4, (4) HGB (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and 6 years in accordance with § 257 (1) nos. 2 and 3, (4) HGB (commercial letters).
According to legal requirements in Austria, the storage is carried out in particular for 7 J in accordance with § 132 (1) BAO (accounting documents, vouchers / invoices, accounts, receipts, commercial documents, statement of income and expenditure, etc.), for 22 years in connection with real estate and for 10 years in the case of documents in connection with electronically provided services, telecommunications, radio and television services provided to non-entrepreneurs in EU Member States and for which the Mini-One-Stop-Shop (MOSS) is used.
Additionally we process
We process the data of our customers within the scope of the order processes in our online shop in order to enable them to select and order the selected products and services, as well as their payment and delivery or execution.
The processed data includes inventory data, communication data, contract data, payment data and the persons affected by the processing include our customers, interested parties and other business partners. The processing is carried out for the purpose of providing contractual services in the context of operating an online shop, invoicing, delivery and customer services. For this purpose, we use session cookies to store the contents of the shopping cart and permanent cookies to store the login status.
The processing is based on Art. 6 para. 1 lit. b (execution of order processes) and c (legally required archiving) GDPR. The information marked as required is required to justify and fulfil the contract. We disclose the data to third parties only within the scope of delivery, payment or within the scope of the legal permits and obligations to legal advisors and authorities. The data is only processed in third countries if this is necessary for the fulfilment of the contract (e.g. at the customer's request for delivery or payment).
Users can optionally create a user account, in particular by viewing their orders. Within the scope of the registration, the required mandatory data is communicated to the users. The user accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data relating to the user account will be deleted, subject to their safekeeping being necessary for reasons of commercial or tax law in accordance with Art. 6 para. 1 lit. c GDPR. Data in the customer account shall remain in the customer account until its deletion with subsequent archiving in the event of a legal obligation. It is the responsibility of the users to back up their data in the event of termination before the end of the contract.
Within the scope of registration and renewed logins and use of our online services, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests, as well as the user's need for protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 Para. 1 lit. c GDPR.
Deletion shall take place after the expiry of statutory warranty and comparable obligations, the necessity of storing the data shall be reviewed every three years; in the case of statutory archiving obligations, deletion shall take place after their expiry (end of commercial law (6 years) and tax law (10 years) storage obligation).
We process the data of our patients and interested parties and other clients or contractual partners (uniformly referred to as "patients") in accordance with Art. 6 Para. 1 letter b) GDPRin order to provide them with our contractual or pre-contractual services. The data processed in this context, the nature, scope and purpose of such processing and the necessity of processing it, shall be determined by the underlying contractual relationship. The processed data basically includes inventory and master data of the patients (e.g. name, address, etc.), as well as contact data (e.g. e-mail address, telephone number, etc.), contractual data (e.g. services used, products purchased, costs, names of contact persons) and payment data (e.g. bank details, payment history, etc.).
Within the scope of our services, we may also process special categories of data in accordance with Art. 9 Para. 1 GDPR, in particular data relating to the health of patients, possibly with reference to their sex life or sexual orientation. For this purpose, we obtain, if necessary, in accordance with Art. 6 Paragraph 1 lit. a., Art. 7, Art. 9 Paragraph 2 lit. a. GDPR, and otherwise process the special categories of data for the purposes of health care on the basis of Art. 9 Paragraph 2 lit. h. GDPR, Art. 22 (1) No. 1 b. BDSG.
If necessary for the fulfilment of the contract or required by law, we disclose or transmit the patients' data in the course of communication with medical professionals, third parties involved in the fulfilment of the contract as necessary or typically, such as laboratories, billing offices or comparable service providers, if this is necessary for the provision of our services in accordance with Art. 6 para. 1 lit. b. GDPR, legally according to Art. 6 Para. 1 lit. c. GDPR, our interests or those of patients in efficient and cost-effective health care as a legitimate interest in accordance with Art. 6 Para. 1 lit. f. GDPR or is necessary according to Art. 6 para. 1 lit. d. GDPR to protect the vital interests of patients or another natural person or is necessary within the framework of a consent according to Art. 6 para. 1 lit. a., Art. 7 GDPR.
The data is deleted when the data is no longer necessary for the fulfilment of contractual or statutory duties of care and for dealing with any warranty and comparable obligations, whereby the necessity of keeping the data is reviewed every three years; otherwise the statutory retention obligations apply.
Within the framework of the performance of contracts, we appoint payment service providers on the basis of Art. 6 (1) lit. b. GDPR. Otherwise, we use external payment service providers on the basis of our legitimate interests in accordance with Art. 6 para. 1 lit. f. GDPR in order to offer our users effective and secure payment options.
The data processed by the payment service providers includes inventory data, such as name and address, bank data, such as account or credit card numbers, passwords, TANs and checksums, as well as contract, sum and recipient related data. These details are required to carry out the transactions. However, the data entered is only processed by the payment service providers and stored by them. This means that we do not receive any account or credit card-related information, but only information with confirmation or negative information about the payment. Under certain circumstances, the payment service providers may transfer the data to credit agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard, we refer to the general terms and conditions and data protection notices of the payment service providers.
For payment transactions, the terms and conditions and data protection information of the respective payment service providers apply, which can be accessed within the respective websites or transaction applications. We also refer to these for further information and the assertion of rights of revocation, information and other rights of affected persons.
Users can create a user account. As part of the registration process, the required mandatory data is provided to the users and processed on the basis of Art. 6 para. 1 letter b GDPR for the purposes of providing the user account. The processed data includes in particular the login information (name, password and an e-mail address). The data entered during registration is used for the purposes of using the user account and its purpose.
Users can be informed by e-mail about information relevant to their user account, such as technical changes. If users have cancelled their user account, their data with regard to the user account will be deleted, subject to a legal obligation to retain data. It is the responsibility of the users to save their data before the end of the contract if they have terminated their user account. We are entitled to irretrievably delete all user data stored during the term of the contract.
When using our registration and login functions and the user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests, as well as the user's need for protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 Para. 1 lit. c. GDPR. The IP addresses are anonymised or deleted after 7 days at the latest.
If users leave comments or other contributions, their IP addresses may be changed on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR for 7 days. This is done for our security if someone leaves unlawful content in comments and contributions (insults, prohibited political propaganda, etc.). In this case we can be prosecuted ourselves for the comment or contribution and are therefore interested in the identity of the author.
Furthermore, we reserve the right, on the basis of our legitimate interests in accordance with Art. 6 Par. 1 lit. f. GDPR, we reserve the right to process user data for the purpose of spam detection.
The data provided in the context of the comments and contributions will be stored permanently by us until the users object.
Users can subscribe to the follow-up comments with their consent in accordance with Art. 6 para. 1 letter a GDPR. Users receive a confirmation e-mail to check whether they are the owner of the e-mail address entered. Users can unsubscribe from ongoing commentary subscriptions at any time. The confirmation e-mail will contain information on the cancellation options. For the purpose of proving users' consent, we store the time of registration together with the users' IP address and delete this information when users unsubscribe from the subscription.
You can cancel the receipt of our subscription at any time, i.e. revoke your consent. We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of a consent is confirmed at the same time.
Our online offer uses the "Akismet" service, which is provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. The use is made on the basis of our legitimate interests in the sense of Art. 6 Paragraph 1 lit. f) GDPR. With the help of this service, comments from real people are distinguished from spam comments. For this purpose, all comment data is sent to a server in the USA, where it is analysed and stored for four days for comparison purposes. If a comment has been classified as spam, the data will be stored beyond this period. This information includes the name entered, email address, IP address, comment content, referrer, browser and computer system used and the time of entry.
More detailed information on the collection and use of data by Akismet can be found in Automattic's data protection notice: https://automattic.com/privacy/](https://automattic.com/privacy/).
Users are welcome to use pseudonyms, or choose not to enter their name or email address. You can completely prevent the transmission of data by not using our comment system. That would be a pity, but unfortunately we do not see any other alternatives that work just as effectively.
When contacting us (e.g. by contact form, e-mail, telephone or via social media), the user's details will be used to process the contact request and its handling in accordance with Art. 6 Para. 1 lit. b. (within the framework of contractual/pre-contractual relations), Art. 6 para. 1 lit. f. (other requests) GDPR are processed. User data may be stored in a customer relationship management system ("CRM system") or comparable enquiry organisation.
We delete the enquiries if they are no longer required. We review the necessity every two years; furthermore, the statutory archiving obligations apply.
With the following notes we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your right of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.
Content of the newsletter: We send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter referred to as "newsletter") only with the consent of the recipients or a legal permission. Insofar as the contents of the newsletter are specifically described in the context of a registration for the newsletter, they are decisive for the consent of the users. Our newsletters also contain information about our products and accompanying information (e.g. safety instructions), offers, promotions and our company.
Double-Opt-In and logging: The registration for our newsletter takes place in a so-called Double-Opt-In procedure. This means that after registration you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that nobody can register with foreign e-mail addresses. The newsletter registrations are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Changes to your data stored by the dispatch service provider are also logged.
Registration data: To subscribe to the newsletter, it is sufficient to enter your e-mail address. Optionally, we ask you to enter a name for personal contact in the newsletter.
The dispatch of the newsletter and the measurement of success associated with it are based on the consent of the recipients in accordance with Art. 6 Para. 1 letter a, Art. 7 GDPR in conjunction with § 107 Para. 2 TKG or, if consent is not required, on our legitimate interests in direct marketing in accordance with Art. 6 Para. 1 lt. GDPR in conjunction with § 107 (2) and (3) TKG.
The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. We are interested in the use of a user-friendly and secure newsletter system which serves our business interests and meets the expectations of the users and also allows us to prove that we have given our consent.
Cancellation and revocation: You can cancel the receipt of our newsletter at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of a consent is confirmed at the same time.
The mail-order service provider may use the recipient's data in pseudonymous form, i.e. without assigning it to a user, to optimise or improve its own services, e.g. for technical optimisation of the dispatch and presentation of newsletters or for statistical purposes. However, the dispatch service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.
The newsletters contain a so-called "web-beacon", i.e. a pixel-sized file which is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from their server. Within the framework of this retrieval, technical information such as information on the browser and your system, as well as your IP address and the time of the retrieval are initially collected.
This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behaviour based on their retrieval locations (which can be determined by means of the IP address) or the access times. Statistical surveys also include determining whether newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be allocated to the individual newsletter recipients. However, it is neither our intention nor, if used, that of the dispatch service provider to observe individual users. The evaluations serve us much more to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.
Unfortunately, it is not possible to cancel the performance measurement separately, in which case the entire newsletter subscription must be cancelled.
The hosting services we use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services which we use for the purpose of operating this online service.
For this purpose, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online service on the basis of our legitimate interests in the efficient and secure provision of this online service in accordance with Art. 6 Para. 1 letter f GDPR in conjunction with Art. 6 Para. 1 letter f GDPR. Art. 28 GDPR (conclusion of contract processing agreement).
We or our hosting provider, on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR collects data on every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the website previously visited), IP address and the requesting provider.
For security reasons (e.g. to clarify acts of abuse or fraud), log file information is stored for a maximum period of 7 days and then deleted. Data whose further storage is required for evidence purposes is excluded from deletion until the respective incident has been finally clarified.
We use a so-called "Content Delivery Network" (CDN), offered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare is certified under the Privacy Shield Agreement and thus offers a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnZKAA0&status=Active).
A CDN is a service which helps to deliver content of our online offer, especially large media files such as graphics or scripts, faster with the help of regionally distributed servers connected via the internet. User data is processed solely for the aforementioned purposes and to maintain the security and functionality of the CDN.
The use is based on our legitimate interests, i.e. interest in a secure and efficient provision, analysis and optimisation of our online service in accordance with Art. 6 Para. 1 lit. f. GDPR.
Further information can be found in the Cloudflare data protection declaration: https://www.cloudflare.com/security-policy.
Google Tag Manager is a solution that allows us to manage so-called website tags via an interface (and thus integrate e.g. Google Analytics and other Google marketing services into our online offering). The Tag Manager itself (which implements the tags) does not process any personal user data. With regard to the processing of users' personal data, we refer to the following information on Google services. Usage guidelines: https://www.google.com/intl/de/tagmanager/use-policy.html.
Google is certified under the Privacy Shield Agreement and thus offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use this information on our behalf in order to evaluate the use of our website by users, to compile reports on the activities within this website and to provide us with further services associated with the use of this website and the internet. In doing so, pseudonymous user profiles of the users can be created from the processed data.
We only use Google Analytics with activated IP anonymisation. This means that the IP address of the user is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
The IP address transmitted by the user's browser is not combined with other data from Google. Users can prevent the storage of cookies by adjusting their browser software settings accordingly; users can also prevent the collection of data generated by the cookie and relating to their use of the online offer to Google and the processing of this data by Google by downloading and installing the browser plugin available under the following link http://tools.google.com/dlpage/gaoptout?hl=de.
Further information on the use of data by Google, setting and objection options, can be found in Google's data protection declaration (https://policies.google.com/technologies/ads) and in the settings for the display of advertising by Google (https://adssettings.google.com/authenticated).
The personal data of users will be deleted or anonymised after 14 months.
On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. GDPR) the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ("Google").
Google is certified under the Privacy Shield Agreement and thus offers a guarantee that it complies with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
We use the Google "Ads online marketing process to place ads on the Google advertising network (e.g., in search results, in videos, on web pages, etc.) so that they are displayed to users who have a presumed interest in the ads. This allows us to better target ads for and within our online services in order to show users only ads that potentially match their interests. For example, if a user is shown ads for products that he or she has been interested in on other websites, this is referred to as "remarketing". For these purposes, when you visit our website and other websites on which the Google advertising network is active, a code is executed directly by Google and so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") are incorporated into the website. With their help, an individual cookie, i.e. a small file, is stored on the user's device (instead of cookies, comparable technologies can also be used). This file records which websites the user has visited, what content he is interested in and which offers the user has clicked on, as well as technical information on the browser and operating system, referring websites, visiting time and other information on the use of the online offer.
Furthermore we receive an individual "conversion cookie". The information obtained with the help of the cookie is used by Google to compile conversion statistics for us. However, we only learn the anonymous total number of users who clicked on our ad and were redirected to a page with a conversion tracking tag. However, we do not receive any information that personally identifies users.
User data is processed pseudonymously within the Google advertising network. This means, for example, that Google does not store and process the name or e-mail address of the user, but processes the relevant data on a cookie-related basis within pseudonymous user profiles. This means that from Google's point of view, the ads are not managed and displayed for a specifically identified person, but for the cookie holder, regardless of who that cookie holder is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymisation. The information collected about users is transmitted to Google and stored on Google's servers in the USA.
Further information on the use of data by Google, setting and objection options, can be found in Google's data protection declaration (https://policies.google.com/technologies/ads) and in the settings for the display of advertising by Google (https://adssettings.google.com/authenticated).
We maintain online presences within social networks and platforms in order to be able to communicate with the customers, interested parties and users active there and to inform them about our services.
We point out that user data may be processed outside the European Union. This can result in risks for users, as it could make it more difficult, for example, to enforce users' rights. With regard to US providers certified under the Privacy Shield, we would like to point out that they thereby undertake to comply with EU data protection standards.
In addition, users' data are generally processed for market research and advertising purposes. For example, user profiles can be created from the user behaviour and the resulting interests of the users. The user profiles can in turn be used, for example, to place advertisements inside and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behaviour and interests of the users are stored. Furthermore, data may also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).
The processing of users' personal data is based on our legitimate interests in effective information of users and communication with users in accordance with Art. 6, Paragraph 1, Letter f. GDPR. If users are asked by the respective providers to give their consent to data processing (i.e. to give their consent, e.g. by ticking a check box or confirming a button), the legal basis for processing is Art. 6 Paragraph 1 letter a., Art. 7 GDPR.
For a detailed presentation of the respective processing and the possibilities of objection (opt-out), we refer to the following linked information from the providers.
Also in the case of requests for information and the assertion of user rights, we would like to point out that these can most effectively be asserted with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. Should you nevertheless require assistance, you can contact us.
Facebook pixel: With the help of the Facebook pixel, Facebook is on the one hand able to determine the visitors of our online offer as a target group for the presentation of ads (so-called "Facebook ads"). Accordingly, we use the Facebook pixel in order to display the Facebook Ads placed by us only to those users on Facebook and within the services of the partners cooperating with Facebook (so-called "Audience Network" https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offering or who exhibit certain characteristics (e.g. interest in certain topics or products that can be seen from the websites visited) that we transmit to Facebook (so-called "Custom Audiences"). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of the users and do not appear annoying. The Facebook pixel also enables us to track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users have been redirected to our website after clicking on a Facebook ad (so-called "conversion measurement").
Within our online offer, we set the following priorities on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. GDPR), we use content or service offers from third parties in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content").
This always presupposes that the third-party providers of these contents are aware of the IP address of the users, as without the IP address they would not be able to send the contents to their browsers. The IP address is therefore necessary for the display of these contents. We make every effort to use only such content whose respective providers use the IP address solely for the purpose of delivering the content. Third party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information on the browser and operating system, referring web pages, visiting time and other details on the use of our online offer, as well as being linked to such information from other sources.
Last updated: September 2020