RENT AND TRAVEL Privacy Policy

We take data protection seriously

Protecting your privacy when processing personal data is an important concern for us. When you visit our website, our web servers store your Internet service provider IP, the website from which you visit us, the pages you visit on our site and the date and duration of your visit as standard procedure. This information is essential for the technical transmission of our web pages and for secure server operation. This data is not subjected to personalised analysis.

When you send us your data using the contact form, the data is saved to our servers as part of data backup. We use your data only to process your request. Your data is treated with strict confidentiality. It is not passed on to third parties.

1. Who is responsible for data processing and whom can you contact?

Controller:

Knaus Tabbert AG
Helmut‐Knaus‐Straße 1
94118 Jandelsbrunn
Telephone: +49 (0)8583 / 21–1
E‐mail: info@knaustabbert.de

The company's Data Protection Officer is

Mr. Christian Volkmer
Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg
Tel.: +49 (0) 941-2986930
E‐mail: anfragen@projekt29.de

2. Personal data

Personal data is data regarding your personal identity. It includes your name, address and e-mail address. You do not have to disclose any personal data in order to visit our website. In some cases, we need your name and address and other information in order to offer you our services.

The same applies if we provide you with informational material by request or when we answer your enquiries. In these cases, we will always point this out to you. Otherwise, we only store the data that you have transmitted to us automatically or voluntarily.

When you use one of our services, we generally only collect the data that is necessary to provide you with our service. We may ask you for additional information, but this will be voluntary. Whenever we process personal data, we do so in order to offer you our services or to pursue our commercial objectives.

3. Visiting the website

3.1. General use

When you visit our website, our web servers store your Internet service Providers IP, the website from which you visit us, the pages you visit on our site and the date and duration of your visit as standard procedure. The processing of this information is essential for the technical transmission of our web pages, for the convenient use of our services and for secure server operation. Our legitimate interest is based on Art. 6 (1) (f) GDPR. It is not possible to draw any direct conclusions about your identity from this information, nor will we do so. The information is saved and automatically erased once the aforementioned purposes have been achieved. The standard data retention and erasure periods are based on the criterion of necessity.

3.2. Automatically saved data

Server log files

The provider of the web pages automatically collects and stores information in server log files, which your browser transmits to us automatically. The following information is included:

– Date and time of request
– Name of requested file
– Web page from which file was requested
– Access status (file transferred, file not found, etc.)
– Web browser and operating system used
– Complete IP address of requesting computer
– Amount of data transferred

This data is not merged with other data sources. Processing is carried out pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in improving the stability and functionality of our website. For reasons of technical security, particularly in order to defend against attempted attacks on our web server, this data is stored by us for a short time. It is not possible for us to identify specific persons based on this data. After no more than seven days, the data is anonymised by shortening the IP address at the domain level so that it can no longer be related back to the individual user. The data is also processed in anonymised form for statistical purposes; no comparison is made with other databases or disclosure to third parties, even in excerpted form.

3.3. Contacting us

When contacting us (e.g., via contact form, e-mail, telephone or social media), the data of the enquiring persons will be processed only to the extent necessary to reply to the contact enquiries and carry out any requests. Responses to contact enquiries involving contractual or pre-contractual relationships are made to fulfil our contractual obligations or to answer (pre-)contractual enquiries and otherwise based on the legitimate interests in responding to the enquiries.

– Data types processed: basic information (e.g., names, addresses), contact details (e.g., e-mails, telephone numbers), content data (e.g., entries in online forms).
– Affected persons: those communicating with us.
– Purposes of processing: contact enquiries and communication.
– Legal basis: Contract fulfilment and pre-contractual enquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).

3.4. Cookies

When you visit our website, we may store information on your computer in the form of cookies. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters through which websites and servers can be assigned to the specific Internet browser in which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser can be recognised and identified via the unique cookie ID.

Through the use of session cookies, the controller can provide the users of this website with a user-friendly service that would not be possible without setting cookies. Unless we receive consent, we only use technically necessary cookies on the legal basis of legitimate interest pursuant to Art. 6 (1) (f) GDPR.

We use personal cookies only to improve our website or for marketing/advertising purposes with your consent. On your first visit, you can voluntarily consent to tracking or analysis via the cookie banner that appears. Your data may be passed on to partners or third-party providers. These cookies are only stored if you explicitly consent to this; the legal basis is then your consent pursuant to Art. 6 (1) (a) GDPR. You can change your settings concerning the use of cookies here at any time:

Renew or change your cookie consent

3.5. Consent Management

Cookiebot

Our website uses consent technology from Cookiebot to obtain your consent to store certain cookies on your end device or to use certain technologies and document these in compliance with data protection regulations. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter referred to as “Cookiebot”).

When you enter our website, a connection is established to the Cookiebot servers in order to obtain your consent and other declarations regarding the use of cookies. Cookiebot then stores a cookie in your browser in order to assign the consents given or their revocation to you. The data collected in this way is stored until you ask us to erase it or delete the Cookiebot cookie yourself or the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected by this.

Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 (1) (c) GDPR.

We have made an order processing contract pursuant to Art. 28 GDPR with the above-mentioned provider. This is a contract prescribed by data protection law, which ensures that the data controller processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

4. Service optimisation

4.1 Platform

jsDelivr CDN

This website uses a content delivery network (CDN) from jsDelivr.

A CDN is a service that helps to deliver the content of our online offering – particularly large media files such as graphics or scripts – more quickly with the aid of regionally distributed servers connected via the Internet. User data is processed exclusively for the above-mentioned purposes and to maintain the security and functionality of the CDN.

For this reason, the browser you are using must establish a connection to the CDN servers. This informs them that our website has been accessed via your IP address.

The data is used based on our legitimate interests, namely the interest in secure and efficient provision, analysis and optimisation of our online offering in accordance with Art. 6 (1) (f) GDPR.

Further information can be found in the privacy policy of jsDelivr

4.2. Newsletter

We use the double opt-in procedure for sending our newsletter. In other words, we will only send you a newsletter by e-mail if you have expressly indicated to us beforehand that we are to activate the newsletter service. We will then send you a notification e-mail and ask you to confirm that you wish to receive our newsletter by clicking on a link contained in this e-mail. When you register for our newsletter, we store your IP address and the date when you registered. The sole purpose of this storage is to provide evidence in the event that a third party should misuse your e-mail address to subscribe you to the newsletter without your knowledge or authorisation. If you no longer wish to receive newsletters from us at a later date, you can inform us of this at any time without incurring any costs other than transmission costs according to the basic rates.

HubSpot

We use the service “HubSpot” provided by HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA, to manage customer contacts, carry out marketing activities and provide forms. In particular, we use HubSpot to manage contact data (customer relationship management), to run and analyse marketing campaigns and to provide forms (e.g. contact, newsletter and registration forms). In this context, personal data (e.g. name, e-mail address, usage data) may be processed and linked with one another. The processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Our newsletter is sent and its recipients are managed via HubSpot. Our newsletters contain so-called tracking technologies (e.g. tracking pixels) which allow us to determine whether and when e-mails were opened and which links were clicked. These analyses serve to optimise our content and to tailor it more closely to the interests of our recipients. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Art. 7 GDPR; the logging of the registration procedure is based on Art. 6 (1) (f) GDPR (proof of consent). You may withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in the newsletter.

The newsletter registration form is technically embedded as external content from HubSpot and is only loaded after you have expressly consented to the loading of external content (two-click solution). When the form is loaded, technical data (e.g. IP address) is transmitted to HubSpot and cookies or comparable identifiers are set (including hubspotutk, __hstc, __hssc and __hssrc). The legal basis for this is your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent to the loading of external content at any time via the consent management (section 3.5).

To protect the form against automated submissions, it is secured with reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This transmits your IP address and information about your usage behaviour to Google. The legal basis is our legitimate interest in preventing abusive submissions pursuant to Art. 6 (1) (f) GDPR.

Beyond the forms, we also use the HubSpot tracking code on our website. It is only loaded after you have consented to the “marketing” category in the consent management. Without your consent, no connection to HubSpot is established. After you have given your consent, HubSpot records information about your use of our website, in particular the pages you visit, the time you spend on them, the page you previously visited (referrer) as well as details about your browser, operating system and device, and sets cookies or comparable identifiers for this purpose (including hubspotutk, __hstc, __hssc and __hssrc). By means of these identifiers, your usage behaviour can be recognised on repeat visits and, if you submit one of our HubSpot forms, linked to your contact record in HubSpot. We use these analyses to improve our website and our marketing activities.

Legal bases: Art. 6 (1) (a) GDPR (consent) and Section 25 (1) TDDDG (consent to the storage of information on your device and access to it). You may withdraw your consent at any time with effect for the future via the consent management settings (section 3.5).

When using HubSpot, personal data may be transferred to the USA. HubSpot is certified under the EU-US Data Privacy Framework, so that the transfer takes place on the basis of Art. 45 GDPR. If no certification exists, the transfer takes place on the basis of standard contractual clauses pursuant to Art. 46 GDPR.

4.3. Chatbot

Userlike

We use Userlike (hereinafter “Userlike”) to process user enquiries via our support channels or via live chat systems. The provider is Userlike UG (limited liability), Probsteigasse 44-46, 50670 Cologne, Germany.

Messages that you send to us can be saved in the Userlike ticket system or answered by our employees in a live chat. When you communicate with us via Userlike, the information stored by us and Userlike includes the following: your name and e-mail address, if you have provided them, and your chat history. This data is summarised in a profile. The messages sent to us will remain with us until you ask us to erase them or the purpose for storing the data no longer applies (e.g., after your enquiry has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected by this.

The use of Userlike is subject to Art. 6 (1) (f) GDPR. We have a legitimate interest in achieving the fastest, most reliable and most efficient processing of your enquiries.

You can obtain further information in the privacy policy of Userlike: https://www.userlike.com/de/data-privacy and https://www.userlike.com/de/blog/live-chat-software-datenschutz-dsgvo

We have made an order processing contract with the above-mentioned provider. This is a contract prescribed by data protection law, which ensures that the data controller processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

4.4. Map service

Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary for your IP address to be stored. This information is generally transferred to a Google server in the United States and stored there. The provider of this site has no influence on this transfer of data. If Google Maps is activated, Google may use Google Web Fonts for the purpose of standardising the display of fonts. When you call up Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

The use of Google Maps is subject to Art. 6 (1) (f) GDPR. Our legitimate interest is to show you our rental locations, as this is essential for providing our service.

In addition, Google is certified in accordance with the Data Privacy Framework programme and thus fulfils the requirements for the secure transfer of data in accordance with the EU Commission’s adequacy decision for the United States.

You can find more information on the handling of user data in Google’s privacy policy.

5. Tools and services for analysis, statistics and marketing

5.1. Analysis and statistics

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that helps us integrate tracking or statistics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, store any cookies or conduct any independent analyses. It is used only to manage and display the tools that are integrated within it. However, Google Tag Manager records your IP address, which may also be transmitted to Google’s parent company in the United States.

The use of Google Tag Manager is subject to Art. 6 (1) (f) GDPR.

Google Analytics (4)

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. The website operator receives various usage data, such as page views, length of visit, operating systems used and user origin. This data is summarised in a user ID and assigned to the respective end device of the website visitor.

In addition, we can use Google Analytics to record your mouse and scroll movements, your clicks, etc. Furthermore, Google Analytics also uses various modelling approaches to supplement the collected data records and employs machine learning technologies for data analysis.

Google Analytics uses technologies that make it possible to recognise the user for the purpose of analysing user behaviour (e.g., cookies or device fingerprinting). The information recorded by Google about the use of this website is usually transferred to a Google server in the United States and stored there. The use of this service is based on your consent pursuant to Art. 6 (1) (a) GDPR and Sec. 25 (1) TDDDG (German Telecommunications, Digital Services and Data Privacy Act). You can revoke your consent at any time.

The transfer of data to the United States is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/

Browser Plugin

You can prevent the collection and processing of your data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. You can find more information on the handling of user data at Google Analytics in Google’s privacy policy.

Google signals

We use Google signals. When you visit our website, Google Analytics records your location, search history and YouTube history, demographic data (visitor data) and other information. This data can be used for personalised advertising with the aid of Google signals. If you have a Google account, the visitor data from Google signals will be linked to your Google account and used for personalised advertising messages. The data is also used to compile anonymised statistics on the user behaviour of our users.

Google Analytics ecommerce metrics

This website uses the “ecommerce metrics” function of Google Analytics. By using ecommerce metrics, website operators can analyse the purchasing behaviour of website visitors to improve their online marketing campaigns. Information such as orders placed, average order values, shipping costs and the time from viewing to purchasing a product is recorded. This data can be summarised by Google under a transaction ID that is assigned to the respective user or their device.

5.2. Advertising and marketing

Facebook & Instagram Pixel

This website uses Facebook’s visitor action pixel to measure conversions. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, however, the data collected is also transferred to the United States and other third countries.

In this way, the behaviour of site visitors can be tracked after they have been redirected to the provider’s website after clicking on a Facebook ad. This allows the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

The data collected is anonymous to us as the operator of this website; we are unable to draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook so that a link to the respective user profile is possible, and Facebook can use the data for its own advertising purposes in accordance with the Facebook Data Policy. This enables Facebook to place ads on Facebook pages and outside of Facebook. This use of the data cannot be influenced by us as the website operator.

The use of this service is based on your consent pursuant to Art. 6 (1) (a) GDPR and Sec. 25 (1) TDDDG (German Telecommunications, Digital Services and Data Privacy Act). You can revoke your consent at any time. The transfer of data to the United States is based on the standard contractual clauses of the EU Commission. Facebook is also certified in accordance with the Data Privacy Framework programme. https://www.facebook.com/legal/EU_data_transfer_addendum and https://nl-nl.facebook.com/help/566994660333381

Facebook is also certified in accordance with the Data Privacy Framework.

Insofar as personal data is collected on our website with the aid of the tools described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited exclusively to the recording of data and its transfer to Facebook. The processing performed by Facebook after the data has been forwarded is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in an agreement on joint processing. The text of the agreement can be found here: https://www.facebook.com/legal/controller_addendum.

According to this agreement, we are responsible for providing the data protection information when using the Facebook tool and for the secure implementation of the tool on our website in accordance with data protection law. Facebook is responsible for the data security of Facebook products. Rights of data subjects (e.g., requests for information) regarding the data processed by Facebook can be asserted directly with Facebook. If you assert your data subject rights with us, we are obligated to forward them to Facebook. You can find more information on how to protect your privacy in Facebook’s privacy policy here: https://facebook.com/about/privacy/.

You can also deactivate the “Custom Audiences” remarketing function in Settings for ads at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be logged in to Facebook.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising programme of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to show ads in the Google search engine or on third-party websites whenever the user enters specific search terms into Google (keyword targeting). Furthermore, targeted ads can also be shown based on the user data available with Google (e.g., location data and interests) (target group targeting). As the website operator, we can evaluate this data quantitatively, such as by analysing which search terms led to our ads being shown and how many ads resulted in corresponding clicks.

The European Commission has issued an adequacy decision for the United States, provided that companies are certified under the Data Privacy Framework programme. Google is certified accordingly and thus fulfils the requirements of the EU Commission.

Google AdSense (not personalised)

This website uses Google AdSense, a service for integrating ads. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. We use Google AdSense in “non-personalised” mode. In contrast to personalised mode, the ads are not based on your previous user behaviour, and no user profile is created for you. Instead, “context information” is used in selecting advertisements. For example, the ads selected are based on your location, the content of the website you are on or your current search terms. You can find out more about the differences between personalised and non-personalised targeting with Google AdSense here: https://support.google.com/adsense/answer/9007336

Please note that, even when using Google AdSense in non-personalised mode, cookies or comparable recognition technologies (e.g., device fingerprinting) may be used. According to Google, these are used to combat fraud and abuse. The use of this service is based on your consent pursuant to Art. 6 (1) (a) GDPR and Sec. 25 (1) TDDDG (German Telecommunications, Digital Services and Data Privacy Act). You can revoke your consent at any time.

The transfer of data to the United States is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/. Moreover, the European Commission has issued an adequacy decision for the United States, provided that companies are certified under the Data Privacy Framework programme. Google is certified accordingly and thus fulfils the requirements of the EU Commission.

You can customise your advertising settings yourself in your user account. To do this, click on the following link and log in: https://adssettings.google.com/authenticated.

Further information on Google’s advertising technologies can be found here: https://policies.google.com/technologies/ads/ and https://www.google.nl/intl/nl/policies/privacy/

6. Economic analysis and market research

For business reasons and in order to identify market trends and the wishes of contractual partners and users, we analyse the data we have on business transactions, contracts, enquiries, etc., whereby the group of data subjects may include contractual partners, interested parties, customers, visitors and users of our online offering. These analyses are conducted for the purpose of business evaluations, marketing and market research (e.g., to determine customer groups with different characteristics). In doing so, we can take into account the profiles of any registered users together with their information, such as on services used. These analyses are for us alone and are not disclosed externally unless they involve anonymous analyses with summarised – that is, anonymised – values. Furthermore, we take the privacy of users into account and process the data for analysis purposes pseudonymously wherever possible and, if feasible, anonymously as well (e.g., as summarised data).

7. Payment service providers

As part of contractual and other legal relationships, due to legal obligations or otherwise based on our legitimate interests, we offer data subjects efficient and secure payment options and use other payment service providers in addition to banks and credit institutions (collectively referred to as “payment service providers”).

The data processed by the payment service providers includes inventory data, such as name and address; bank data, such as account numbers or credit card numbers, passwords, TANs and checksums as well as contract, amount and recipient-related information. This information is required for carrying out the transactions. However, the data entered will be processed only by the payment service providers and stored by them. In other words, we do not receive any account or credit card-related information but are only informed whether or not the payment has been made. Under certain circumstances, the payment service providers may transfer the data to credit agencies. This is done for the purpose of checking identity and creditworthiness. For more information, please refer to the General Terms and Conditions and the data protection notices of the payment service providers. Payment transactions are subject to the General Terms and Conditions and the data protection notices of the respective payment service providers, which can be reviewed within the respective websites or transaction applications. Please refer to these for further information and for asserting your right of revocation, your right to information and other data subject rights.

8. Online presence on social media

If you have given your consent to the respective social media operator according to Art. 6 (1) (1) (a) GDPR, your data will be automatically collected and stored for market research and advertising purposes when you visit our online social media channels, and user profiles will be created from the data using pseudonyms. For example, these user profiles can be used to place ads inside and outside platforms that presumably correspond to your interests. Cookies are generally used for this purpose. For detailed information on the processing and use of data by the respective social media operator and for a contact option and your rights in this regard and setting options to protect your privacy, please refer to the linked data protection notices of the providers on their websites. Feel free to contact us if you still need help with this.

9. Security

We have taken technical and administrative security precautions to protect your personal data against loss, destruction, manipulation and unauthorised access. All our employees and service providers working for us are obligated to comply with the applicable data protection laws.

Whenever we collect and process personal data, it is encrypted before it is transmitted. This means that your data cannot be misused by third parties. Our security precautions are subject to a continuous improvement process, and our privacy policies are constantly being revised. Please ensure that you have the latest version.

10. What data is processed and from what sources does this data originate?

We process the data that we receive from you while initiating or processing the contract, based on your consent or as part of your application to us or as part of your employment with us.

Personal data includes the following:

Your master/contact data; for customers, this includes first name and surname, address, contact details (e-mail address, telephone number, fax), bank details.

For applicants and employees, this includes first name and surname, address, contact details (e-mail address, telephone number, fax), date of birth, data from CV and references, bank details, religious affiliation, photographs.

For business partners, this includes name of their legal representative, company name, commercial register number, VAT number, company number, address, contact details (e-mail address, telephone number, fax), bank details.

For visitors to our company, this includes name and signature.

For journalists, this includes first and last name, e-mail address, fax number.

For contest participants, this includes first and last name, e-mail address, fax number.

In addition, we process the following personal data as well:

– Information on the type and content of contract data, order data, sales and document data, customer and supplier history and consulting documents
– Advertising and sales data
– Other data that we have received from you in the course of our business relationship (e.g., in customer meetings)
– Data that we generate ourselves from master/contact data and other data, such as by means of analyses of customer requirements and customer potential
– Documentation of your declaration of consent, such as for receiving newsletters.
– Photographs taken during events.

For what purposes and on what legal basis is the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the 2018 Federal Data Protection Act as amended:

– For fulfilment of (pre-)contractual obligations (Art. 6 (1) (b) GDPR):
Your data is processed online or at one of our branches in order to process contracts with your workforce in our company. In particular, the data is processed when initiating business and executing contracts with you.
– For fulfilment of legal obligations (Art. 6 (1) (c) GDPR):
Processing of your data is necessary for the purpose of fulfilling various legal obligations, such as from the German Commercial Code or the German Fiscal Code.
– For safeguarding justified interests (Art. 6 (1) (f) GDPR):
Based on a balancing of interests, data may be processed beyond the actual fulfilment of the contract to protect our legitimate interests or those of third parties. Data processing to protect legitimate interests takes place in the following cases, for example:
- + Advertising or marketing (see no. 4)
- + Measures for business management and further development of services and products
- + Maintaining a group-wide customer database to improve customer service
- + In pursuing legal action
- + Sending non-sales-promoting information and press releases
– As part of your consent (Art. 6 (1) (a) GDPR):
If you have given us your consent to process your data, such as to send you our newsletter, publish photos, competitions, etc.

Processing of personal data for advertising purposes

You can revoke your consent to the use of your personal data for advertising purposes at any time, either overall or for individual measures, without incurring any costs other than the transmission costs according to the basic rates.

We are authorised under the legal requirements of Sec. 7 (3) UWG (German Fair Trade Practices Act) to use the e-mail address you provided when you concluded the contract to directly advertise our own similar goods or services. You will receive these product recommendations from us regardless of whether you have subscribed to a newsletter. If you do not wish to receive such recommendations from us by e-mail, you can revoke your consent to the use of your address for this purpose at any time without incurring any costs to do this other than the transmission costs according to the basic rates. A notification in written form is sufficient for this. Naturally, every e-mail always contains an unsubscribe link.

Who receives my data?

If we use a service provider to process your order, we nevertheless remain responsible for protecting your data. All order processors are contractually obligated to treat your data confidentially and to process it only as part of providing the service. The order processors commissioned by us will receive your data if they require it to fulfil their respective services. For example, they include IT service providers that we need for the operation and security of our IT system as well as advertising and address publishers for our own advertising campaigns. This data is made available to the Group companies if necessary for fulfilling the contract. Customer data is stored separately for each company, with our parent company acting as a service provider for the individual participating companies. If there is a legal obligation or as part of legal action, authorities and courts as well as external auditors may be recipients of your data. In addition, insurance companies, banks, credit agencies and service providers may be recipients of your data for the purpose of initiating and fulfilling a contract.

How long will my data be stored?

We process your data until the end of the business relationship or until the expiry of the applicable statutory retention periods (e.g., as stipulated by the German Commercial Code, the German Fiscal Code or the Working Hours Act), and beyond this until the end of any legal disputes in which the data is required as evidence.

11. What data protection rights do I have?

You have the right to information and to have your stored data rectified, erased or its processing restricted, a right to revoke your consent to having your data processed, a right to data portability and a right to lodge a complaint in accordance with the requirements of data protection law.

Right to information:

You can request information from us as to whether and to what extent we process your data.

Right to rectification:

If we process data on you that is incomplete or incorrect, you can request that we rectify or complete it at any time.

Right to erasure:

You can demand that we erase your data if we process it unlawfully or if the processing disproportionately interferes with your legitimate protection interests. Please note that there may be reasons that prevent immediate erasure of data, such as in the case of statutory retention obligations. Irrespective of the exercise of your right to such erasure, we will erase your data completely and without delay, provided that there is no legal or statutory retention obligation to the contrary.

Right to restriction of processing:

You can request that we restrict the processing of your data in the following situations:

– You contest the accuracy of the data – for a period that enables us to verify the accuracy of the data.
– The processing of the data is unlawful, but you decline to have it erased and instead request that usage of the data be restricted.
– We no longer need the data for the intended purpose, but you still need this data for asserting or defending against legal claims.
– You revoke your consent to the data being processed.

Right to data portability:

You may request that we provide you with the data supplied to us by you in a structured, commonly used and machine-readable format that will allow you to transmit this data to another controller without hindrance from us, provided that

– we are processing this data based on consent given and revocable by you or for the fulfilment of a contract between us, and
– this processing is carried out using automated procedures.

If technically feasible, you can request that we transfer your data directly to another controller.

Right of revocation:

If we process your data based on a legitimate interest, you can revoke your consent to this data processing at any time; this would also apply to any profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for processing it which override your interests, rights and freedoms or unless processing it aids with establishing, exercising or defending legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without giving reasons.

Right of appeal:

If you are of the opinion that we are violating German or European data protection law when processing your data, please contact us so that we can clarify any questions you may have. Naturally, you also have the right to contact the supervisory authority responsible for you: the respective state office for data protection supervision. If you wish to assert one of the aforementioned rights against us, please contact our Data Protection Officer. In case of doubt, we may request additional information to confirm your identity.

Am I obligated to provide data?

Processing your data is necessary for concluding or fulfilling the contract you have entered into with us. If you do not provide us with this data, we will generally have to refuse to conclude the contract or will no longer be able to fulfil an existing contract and will therefore have to terminate it. However, you are not obligated to give your consent to the processing of data that is not relevant or legally required for fulfilling the contract.

12. Changes to this privacy policy

We reserve the right to amend our privacy policies should this be necessary due to new technologies. Please ensure that you have the latest version. If fundamental changes are made to this privacy policy, we will announce them on our website.