Privacy policy

Privacy policy of the website and at the same time information of the data subjects according to article 13 and article 14 GDPR


I. Name and address of the person responsible

The responsible person in terms of the basic data protection regulation and other national data protection ¬laws of the member states as well as other data protection regulations is
watt24 GmbH 
To Kleifeld 13 | D-59469 Ense  
Phone: +49 (0) 69 66 773 73 95 
E-mail: info@watt24.com 

II. Name and address of the Data Protection Officer 

The data protection officer of the person responsible is:
Thorsten Schröers | SAFE-PORT Consulting GmbH
Hülshoff-Strasse 7 | D-59469 Ense 
Phone: +49 (0) 2938 977 978 
E-mail: privacy@safe-port.de 

III. General information on data processing

1. The scope of processing of personal data
As a matter of principle, we only process personal data of our users as far as this is necessary to provide a functional website and our contents and services. The processing of personal data of our users regularly only takes place with the user's consent. An exception is made in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
Art. 6 para. 1 lit. b GDPR serves as the legal basis for the processing of personal data required for the performance of a contract to which ¬the data subject is a party. This also applies to processing operations which are necessary for the implementation of pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
If the vital interests of the data subject or another natural person make it necessary to process personal data, Art. 6 para. 1 lit. d GDPR serves as the legal ¬basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.

3. Data deletion and storage duration
The personal data of the person concerned will be deleted or blocked as soon as the purpose of the storage no longer applies. Furthermore, data may be stored if this has been provided for by the European or national legislator in Union regulations, laws or other regulations to which the person responsible is subject. Blocking or erasure of data is also carried out when a storage period prescribed by the above-mentioned standards expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.

4. Note on data transfer to the USA
Among other things, our website includes tools from companies based in the USA. If these tools are active, your personal data may be passed on to the US servers of these companies¬. We would like to point out that the USA is not a safe third country in terms of EU data protection law. US companies are obliged to release personal data to security ¬authorities without you as the data subject being able to take legal action against this. It cannot therefore be excluded that US authorities (e.g. secret services) may process, evaluate and permanently store your data on US servers for monitoring purposes. We have no influence on these processing activities. We have concluded valid appropriate guarantees with the service providers for the transmission to these third countries in accordance with Art. 46 para. 2 GDPR. If you have any further questions, please contact our data protection officer.

IV. Provision of the website and creation of log files

1. Hosting
This website is hosted by an external service provider (provider). The personal data collected on this website is stored on the provider's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated by a website.
The use of the provider is for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR).
Our provider will only process your data to the extent necessary to fulfil its performance obligations and will follow our instructions with regard to this data.
In order to guarantee data protection compliant processing, we have concluded a contract for order¬ processing¬ with our provider.

2. Description and scope of data processing
For the purely informational use of our website, it is generally not necessary for you to provide personal data. Whenever our website is called up, our system automatically records data and information from the computer system of the calling terminal.
The following data is collected:
  • Browser type and version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address
The data is also stored in the log files of our system. These data are not stored together with other personal data of the user.

3. Legal basis for data processing  
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

4. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Storage in log files is done to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
The use of the provider is for the purpose of fulfilling the contract vis-à-vis our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider.
These purposes also include our legitimate interests in data processing in accordance with Art. 6 para. 1 lit. f GDPR.

5. Storage duration
The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. In the case of the collection of data for the purpose of providing the website, this is the case when the relevant session has ended. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated so that it is no longer possible to assign the calling client.

6. Possibility of opposition and removal
The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. There is therefore no ¬possibility of objection on the part of the user.

V. Data collection on this website

1. Use of cookies
a) Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. If a user calls up a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.
We use cookies to make our website more user-friendly. Some elements of our website require the calling browser to be able to be identified even after a page change.
In addition, we use cookies on our website, which enable an analysis of the surfing behavior of the users.
When calling up our website, the user is informed about the use of cookies by a content banner and his consent to the processing of the personal data used in this context is obtained and documented in accordance with data protection regulations. In this context, reference is also made to this data protection declaration. There is also a reference there in this context to how the storage of cookies can be prevented in the browser settings.
Whether cookies can be set and retrieved is determined by the settings in your browser. You can, for example, completely deactivate the storage of cookies in your browser, restrict it to certain websites or configure your browser so that it automatically notifies you as soon as a cookie is to be set and asks you for feedback. However, for technical reasons it is necessary to allow the above-mentioned for the full range of functions of our website.

b) Legal basis for data processing
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR.
The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 para. 1 lit. a GDPR if the user has given his consent to this; this consent may be revoked at any time.

c) Purpose of the data processing
If a use of technically necessary cookies takes place:
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser ¬is recognized even after a page change.
These purposes also include our legitimate interest in the processing of personal data in accordance with Art. 6 para. 1 lit. f GDPR.
The user data collected through technically necessary cookies is not used to create user ¬profiles.
The analysis cookies are used to improve the quality of our website and its contents. The analysis cookies enable us to find out how the website is used and thus to constantly optimize our offer.

d) Duration of storage, possibility of objection and removal
Cookies are stored on the user's computer and transmitted by the user to our site. Therefore you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it may not be possible to use all the functions of the website to their full extent.
You will be informed about the exact storage period in the notes in our content tool. You can contradict already made agreements there.

2. Cookie consent-tool OneTrust
a) Description and scope of data processing
Our website uses the cookie-content technology of OneTrust, LLC, represented in two main offices ¬in the USA and England: Atlanta, GA, USA (Co-Headquarters), 1200 Abernathy Rd NE, Building 600, Atlanta, GA 30328 United States, and London, England (Co-Headquarters), Dixon House, 1 Lloyd's Avenue, London, EC3N 3DQ (hereinafter "OneTrust"), to obtain your consent to store certain cookies on your terminal device and to document this consent in a manner consistent with data protection.
When you enter our website, a OneTrust cookie is stored in your browser in order to be able to allocate the consents you have given or their revocation. The data collected in this way is stored until you request us to delete it, delete the consent manager provider cookie itself or the purpose for which the data is stored no longer applies. Mandatory legal storage obligations remain unaffected.

b) Legal basis for data processing
OneTrust is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR.

c) Further information
We have concluded a contract for order processing with OneTrust. This is a contract which is prescribed by data protection law and ensures that OneTrust processes the personal¬ ¬data of our website visitors only according to our instructions and in compliance with the GDPR.

3. Google Analytics
a) Description, purpose and scope of data processing
This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyses the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, length of stay, operating systems used and the origin of the user. Google may combine this data in a profile which is assigned to the respective user or his terminal device.
Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google on the use of this website is usually transferred to a Google server in the USA and stored there.

b) Legal basis for data processing
This analysis tool is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the analysis of user behavior in order to optimize both his website and his advertising. If a corresponding consent has been requested (e.g. consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.
Data transmission to the US is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

c) Duration of storage, possibility of objection and removal
User and event-level data stored at Google that is linked to cookies, user IDs (e.g. User ID) or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) is anonymized or deleted after 14 months. Details can be found under the following link: https://support.google.com/analytics/answer/7667196?hl=de.
You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
You can find more information on how Google Analytics handles user data in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

d) Further information
IP anonymization
We have activated the IP anonymization function on this website. This means that your IP address will be truncated by Google within member states of the European Union or in other states which are party to the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on the website activities and to provide further services to the website operator in connection with the use of the website and the internet. The IP address transmitted by your browser within the framework of Google Analytics is not combined with other data from Google.

Order processing
We have concluded a contract with Google for order processing and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographic characteristics in Google Analytics
This website uses the "demographic features" feature of Google Analytics to help the website visitors find appropriate ads within the Google advertising network. This allows reports to be generated which contain information about the age, gender and interests of the site visitors. This data is derived from interest-based advertising by Google and from visitor data from third parties. This data cannot be associated with any particular person. You can deactivate this function at any time via the ad settings in your Google Account or generally prohibit the collection of your data by Google Analytics as described in the section "Objection to data collection".

Google Analytics e-commerce tracking
This website uses the "e-commerce tracking" function of Google Analytics. With the help of e-commerce tracking, the website operator can analyses the purchasing behavior of website visitors to improve his online marketing campaigns. Information such as the orders placed, average order values, shipping costs and the time from viewing to purchase of a product is recorded. This data can be summarized by Google under a transaction ID, which is assigned to the respective user or his device.

4. Google AdWords and Google Conversion Tracking
Google Ads
a) Description, purpose and scope of data processing
The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads enables us to display advertisements in the Google search engine or on third party websites if the user enters certain search terms in Google (keyword targeting). Furthermore, targeted advertisements can be played out on the basis of the user data available on Google (e.g. location data and interests) (target group targeting). We as website operators can evaluate this data quantitatively, for example by analyzing which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.

b) Legal basis for data processing
The use of Google Ads is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in marketing his service products as effectively as possible.

c) Further information
Data transmission to the US is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

Google Conversion Tracking
a) Description, purpose and scope of data processing
This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google conversion tracking allows Google and us to see if the user has performed certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently. This information is used to create conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information that can be used to personally identify the user. Google itself uses cookies or comparable recognition technologies for identification purposes.

b) Legal basis for data processing
The use of Google Conversion Tracking is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the analysis of user behavior in order to optimize both his website and his advertising. If a corresponding consent has been requested (e.g. consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be revoked at any time.

c) Further information
For more information about Google Conversion Tracking, please see the Google Privacy Policy: https://policies.google.com/privacy?hl=de.

5. Facebook pixel
a) Description, purpose and scope of data processing
This website uses Facebook to measure conversions of visitor's action pixels. This service is provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected is also transferred to the United States and other third countries.
This allows the behavior of site visitors to be tracked after they have clicked on a Facebook ad to be redirected to the provider's website. This allows the effectiveness of Facebook Ads to be evaluated for statistical and market research purposes and future advertising measures to be optimized.
The collected data is anonymous for us as the operator of this website, we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in accordance with the Facebook Data Usage Guidelines. This enables Facebook to enable the placement of advertisements on pages of Facebook as well as outside of Facebook. This use of the data cannot be influenced by us as a site operator.

b) Legal basis for data processing
The use of Facebook pixels is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in effective advertising measures including social media. If the relevant consent has been requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be revoked at any time.

c) Possibility of opposition and removal
You can also disable the Custom Audiences remarketing feature in the Advertising Settings section of https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do this.
If you do not have a Facebook account, you can disable usage-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

d) Further information
You will find further information on the protection of your privacy in the Facebook data protection information: https://de-de.facebook.com/about/privacy/.
Data transmission to the US is based on the standard contractual clauses of the EU Commission. Details can be found at https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

6. Microsoft Advertising ("Bing Ads")
a) Description, purpose and scope of data processing
This website uses Microsoft Advertising (formerly Bing Ads), a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (hereinafter referred to as: "Microsoft"). Microsoft Advertising collects and stores data from which user profiles are created using pseudonyms.
If you access our website via a Bing display, Microsoft will store a cookie on your end device. This cookie has a limited validity. We ourselves only learn the total number of users who clicked on a Bing ad and were then redirected to the conversion page. No personal information about the identity of the user is disclosed. If you visit certain pages on our site and the cookie has not expired, Microsoft and we may recognize that you clicked on the ad and were redirected to that page. The information that may be collected may include, but is not limited to, the following: IP address, identifiers (tags) assigned by Microsoft, information about the browser you are using and the device you are using, referrer URL (web page from which you accessed our site), URL of our site.

b) Legal basis for data processing
We use Microsoft Advertising for marketing and optimization purposes, in particular to analyses the use of our website and to continuously improve individual functions and offers as well as the user experience. By statistically evaluating user behavior, we can improve our offer and make it more interesting for you as a user. This is also where our legitimate interest lies in the processing of the above data by the third-party provider. The legal basis is Art. 6 para. 1 lit. f GDPR.
The data processing, in particular the setting of cookies, is carried out with your consent on the basis of Art. 6 para. 1 lit. a GDPR.

c) Possibility of opposition and removal
You can prevent the evaluation by deleting existing cookies and deactivating the storage of cookies in the settings of your web browser. We would like to point out that in this case you may not be able to use all functions of our website to their full extent. You can also prevent Microsoft from displaying personalized advertising by setting an opt-out cookie on the following linked website: https://choice.microsoft.com/de-de/opt-out. Please note that this setting will be deleted if you delete your cookies.

d) Further information
Microsoft guarantees compliance with the EU data protection level on the basis of the standard contractual clauses.
For more information about Microsoft Advertising's privacy practices and cookies, please see Microsoft's privacy statement: https://privacy.microsoft.com/de-de/privacystatement.
For more information on Microsoft Advertising's analytics services: https://help.ads.microsoft.com/#apex/3/de/53056/2.

7. LinkedIn Analytics / Insight Tag
a) Description, purpose and scope of data processing
This website uses the Insight tag from LinkedIn. This service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
We use the LinkedIn Insight tag to obtain information about visitors to our website. If a website visitor is registered with LinkedIn, we can analyses, among other things, the key professional data (e.g. country, location, industry and job title) of our website visitors and thus better tailor our site to the respective target groups. We can also use LinkedIn Insight tags to measure your user behavior on our website (conversion measurement). The conversion measurement can also be carried out across devices. LinkedIn Insight Tag also offers a retargeting function that allows us to display targeted advertising to visitors to our website outside of the website. According to LinkedIn, no identification of the advertising addressee takes place.

b) Legal basis for data processing
We use LinkedIn Analytics for marketing and optimization purposes, in particular to analyses the use of our website and to continuously improve individual functions and offers as well as the user experience. By statistically evaluating user behavior, we can improve our offer and make it more interesting for you as a user. This is also our legitimate interest in the processing of the above data by the third party provider. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR
The data processing, in particular the setting of cookies, is carried out with your consent on the basis of Art. 6 para. 1 lit. a GDPR.

c) Possibility of opposition and removal
You can prevent the evaluation by deleting existing cookies and deactivating the storage of cookies in the settings of your web browser. We would like to point out that in this case you may not be able to use all functions of our website to their full extent. We object to the analysis of usage behavior and targeted advertising by LinkedIn under the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. We would like to point out that this setting will be deleted if you delete your cookies.
In addition, LinkedIn members may control the use of their personal information for promotional purposes in their account settings. To prevent LinkedIn from linking information collected on our site to your LinkedIn account, you must log out of your LinkedIn account before you visit our site.

d) Further information
We have a contract for order processing with LinkedIn. The data transfer to the US is based on the standard contractual clauses of the EU Commission. Details can be found at https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs. For more information on the third party provider, please see LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.

8. AWIN
a) Description, purpose and scope of data processing
This website uses components of the company AWIN (the operating company of AWIN is AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany). AWIN is a German affiliate network and serves as an interface between merchants and affiliates.
As part of its tracking services, AWIN stores cookies on end devices of users who visit or use websites or other online offers of its customers (e.g. register for a newsletter or place an order in an online shop) in order to document transactions (e.g. leads and sales). These cookies serve the sole purpose of correctly allocating the success of an advertising medium and the corresponding billing within its network. AWIN's tracking cookie does not store any personal data whatsoever, but only the ID of the intermediary partner and the order number of the advertising material clicked on by the visitor, which are required for payment processing.

b) Legal basis for data processing
The processing described is based on our justified financial interest in processing commission payments with AWIN in accordance with Art. 6 para. 1 lit. f GDPR.

c) Possibility of opposition and removal
The person concerned can prevent the setting of cookies by our website, as described above, at any time by means of a corresponding setting in the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent AWIN from setting a cookie on the information technology system of the person concerned. Furthermore, cookies already set by AWIN can be deleted at any time via an Internet browser or other software programs.

d) Further information
The applicable data protection regulations and information on the use of AWIN data can be found at https://www.awin.com/de/rechtliches/privacy-policy.

9. Criteo
This website uses features provided by Criteo. The provider is Criteo SA, 32 Rue Blanche, 75009 Paris (hereinafter "Criteo").
Criteo is used to display interest-based advertisements within the Criteo advertising network. Your interests are determined based on your past usage patterns. For example, Criteo records which products you have viewed, added to your shopping cart or purchased.
In order for us or other Criteo partners to display interest-based advertising to you, we or other Criteo partners must be able to recognize you. To this end, a cookie is stored on your terminal device or a comparable identifier is used to link your user behavior to a pseudonymous user profile.

b) Legal basis for data processing
Criteo is used in the interest of targeted advertising. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If the relevant consent has been requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be revoked at any time.

c) Possibility of opposition and removal
The person concerned can prevent the setting of cookies by our website, as described above, at any time by means of a corresponding setting in the Internet browser used and thus permanently object to the setting of cookies. You can also deactivate the Criteo services at https://www.criteo.com/de/privacy/.

d) Further information
Details of Criteo's data processing practices are set out in Criteo's Privacy Policy at: https://www.criteo.com/de/privacy/.
Criteo and we are jointly responsible in the sense of Art. 26 GDPR. An agreement on joint processing has been concluded between Criteo and us, the main contents of which Criteo describes under the following link: https://www.criteo.com/de/privacy/how-we-use-your-data/.

VI. Own services (use of offers, contact possibilities and applications)

1. Contact form
a) Description and scope of data processing
Our contact data and contact form are stored on our website, which can be used to contact us. If a user takes advantage of the possibility via the contact form, the data entered in the input mask is transmitted to us and stored. These data are:
  • Name
  • E-mail address
  • Company
  • Phone number (optional)
  • Other data within the message
The following data is also saved at the time the message is sent:
  • The IP address of the user
  • Date and time of dispatch
For the processing of the data, your consent will be obtained during the sending process and reference will be made to this data protection declaration.
We use the Customer Relationship Management (CRM) "HubSpot", a service of HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland (hereinafter referred to as "HubSpot"). HubSpot is a web-based CRM and pipeline management solution that enables us to track and structure our communications with our customers.
Alternatively, it is possible to contact us via the e-mail address or telephone number provided. In this case the transmitted personal data (name and enquiry) of the user will be stored and processed by us for the purpose of processing your request.
In this context, the data will not be passed on to third parties without your consent. The data will be used exclusively for processing the conversation.

b) Legal basis for data processing
The legal basis for the processing of the data is Art. 6 para. 1 lit. a GDPR if the user has given his consent.
The legal basis for the processing of the data transmitted in the course of sending a request is Art. 6 para. 1 lit. f GDPR. The legitimate interest lies in the efficient and rapid processing of user enquiries. If the e-mail contact is aimed at the conclusion of a contract, an additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

c) Purpose of the data processing
The processing of the personal data from the input mask or otherwise transmitted data serves us to process the establishment of contact and the handling of user enquiries. In the case of contacting us by e-mail, this is also the necessary legitimate interest in the processing¬ of the data.
The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

d) The duration of the storage
The data will be deleted as soon as they are ¬¬no longer necessary for the purpose for which they were collected. This is the case for the personal data from the input mask of the contact form and those sent by e-mail when the respective conversation with the user has ended. The conversation is ended when it can be concluded from the circumstances that the matter in question has been conclusively clarified.

e) Possibility of opposition and removal
The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case the conversation cannot be continued¬. To revoke the consent, you can contact our data protection officer at any time¬ using ¬the contact details above.
All personal data stored in the course of the contact will be deleted in this case.

f) Further information
For more information about "HubSpot", please see the "HubSpot" section of this Privacy Policy.

2. Newsletter
a) Description and scope of data processing
On our website you can subscribe to a free newsletter. When registering for the newsletter, the data from the input mask is transmitted to us. In order to register for our e-mail newsletter service, we require, in addition to your data protection consent, at least your e-mail address to which the newsletter is to be sent and your name for personal contact. In addition, the date and time of your registration will be recorded.
We use the so-called double opt-in procedure for the newsletter dispatch, i.e. we will only send you the newsletter if you first confirm your registration via a confirmation e-mail sent to you for this purpose via the link contained therein. In this way we want to ensure that only you yourself, as the owner of the e-mail address provided, can subscribe to the newsletter. Your confirmation must be sent within 5 working days of receipt of the confirmation e-mail, otherwise your newsletter registration will be automatically deleted from our database.

b) Legal basis for data processing
The legal basis for the processing of data in newsletter marketing is Art. 6 para. 1 lit. a GDPR if the user has given his consent.
In so far as we transfer data to third countries, we have taken appropriate guarantees in accordance with Art. 46 GDPR in connection with the transfer. We would like to point out that the level of data protection in these countries may differ from the GDPR due to different laws.

c) Purpose of the data processing
Any further information is voluntary and will be used to address you personally and to be able to personally design the content of the newsletter and to be able to clarify any queries regarding your e-mail address. The collection of other personal data during the registration process serves to prevent misuse of the services or the e-mail address used.

d) The duration of the storage
The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. The user's e-mail address is therefore stored for as long as the subscription to the newsletter is active. The other personal data collected during the registration process is usually deleted after a period of seven days.

e) Possibility of opposition and removal
You can unsubscribe from a newsletter you have subscribed to at any time. To do so, you can either send us an informal e-mail to the above-mentioned contact details or cancel using the link at the end of the newsletter. The revocation does not affect the lawfulness of the processing that has taken place on the basis of the consent given until the revocation. This also enables a revocation of the consent to store the personal data collected during the registration process.
After you have been removed from the newsletter distribution list, your e-mail address may be stored in a blacklist by us or the newsletter service provider to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in compliance with the legal requirements when sending newsletters (legitimate interest in the sense of Art. 6 para. 1 lit. f GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

f) Further information
For more information about "HubSpot", please see the "HubSpot" section of this Privacy Policy.

3. Live chat
a) Description, purpose and scope of data processing
This website uses the live chat function of HubSpot, "Messages". The content you enter there will be processed accordingly by the HubSpot system, allowing you to contact us directly.

b) Legal basis for data processing
The data is processed on the basis of the user's consent (Art. 6 para. 1 lit. a GDPR).
Insofar as the processing is not based on your consent, the processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our justified interest in improving the stability and functionality of our website, as well as for the uniform control of various channels.

c) The duration of the storage
The data will be deleted as soon as they are no longer required for our recording purposes.

d) Possibility of opposition and removal
If you do not want HubSpot to process your data, you can prevent this with your browser settings or by using the opt-out function.

e) Further information
For more information about "HubSpot", please see the "HubSpot" section of this Privacy Policy.

4. Registration on this website and partner program of watt24
a) Description, purpose and scope of data processing
You can register on this website to use additional features on the site. We will only use the data entered for this purpose for the purpose of using the respective offer or service for which you have registered. The mandatory data requested during registration must be provided in full. Otherwise we will refuse registration. Which data is collected can be taken from the respective input form masks.
In the event of important changes, for example in the scope of the offer or technically necessary changes, we will use the e-mail address provided during registration to inform you in this way.

b) Legal basis for data processing
The data entered during registration is processed for the purpose of implementing the user relationship established by the registration and, if necessary, for initiating further contracts (Art. 6 para. 1 lit. b GDPR).

c) The duration of the storage
The data collected during registration is stored by us for as long as you are registered on this website and is then deleted. Legal retention periods remain unaffected.

5. Handling of applicant data
a) Description and scope of data processing
We offer you the opportunity to apply for a job with us (e.g. by e-mail or by post). In the following we will inform you about the scope, purpose and use of your personal data collected during the application process. We assure you that the collection, processing and use of your data will be in accordance with the applicable data protection laws and all other legal requirements and that your data will be treated in strict confidence.

b) Legal basis for data processing
The legal basis for data processing is § 26 BDSG n.F. according to German law (initiation of an employment relationship), Art. 6 para. 1 lit. b GDPR (general contract initiation) and - if you have given your consent - Art. 6 para. 1 lit. a GDPR. Consent may be revoked at any time. Within our company, your personal data will only be passed on to persons¬ who are involved in the processing of your application.
If the application is successful, the data you have submitted will be stored in our data processing systems for the purpose of carrying out the employment relationship on the basis of § 26 BDSG n.F. and Art. 6 para. 1 lit. b GDPR.

c) Purpose of the data processing
If you apply for a job with us, we collect and process your personal data for the purpose of handling the application procedure, for deciding on the establishment of an employment relationship and for carrying out pre-contractual measures.
Only authorized employees from the personnel department or employees involved in the application¬ process have access to your data.
As a matter of principle, personal data is stored exclusively for the purpose of filling the vacant position for which you have applied.

d) The duration of the storage
Your data will be stored for a period of 6 months beyond the end of the application process. This is usually done to fulfil legal obligations or to defend against any claims arising from legal regulations. Afterwards we are obliged to delete or make your data anonymous. In this case, the data is only available to us as so-called metadata without direct personal reference for statistical analysis (e.g. percentage of women or men in applications, number of applications per period, etc.).
You will not be informed separately about the deletion of your data.
In addition, we reserve the right to store your data for inclusion in our "Talent Pool" for one year after completion of the application process in order to identify any other positions of interest to you. This also applies, for example, to applications for a training or internship position. For this purpose, we provide you with a separate consent form in which you can agree to any further storage of your data and inclusion in our "Talent Pool". The data will be deleted from the "Talent Pool" after one year.
You will not be informed separately about the deletion of your data.
If you receive an offer of employment with us as part of the application process and accept it, we will store the personal data collected during the application process at least for the duration of the employment relationship.

e) Possibility of opposition and removal
If personal data are processed by us as the responsible body, you as a data subject have certain rights under Chapter III of the EU Data Protection Regulation (GDPR), depending on the legal basis and purpose of the processing. These can be found in the chapter "Rights of the data subject" of this data protection declaration.
Insofar as the processing of personal data is based on your consent, you have the right to revoke this data protection consent in accordance with Art. 7 para. 3 GDPR. In order to assert your rights as a data subject with regard to the data processed in the application procedure, please contact our data protection officer at the above-mentioned contact details.

VII Social Media

1. Processing of personal data
We maintain publicly accessible profiles in social networks. You can find the social networks we use in detail below.
Social networks such as Facebook, Twitter, etc. can usually analyses your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). A visit to our social media sites triggers numerous data protection-relevant processing procedures. In detail:
If you are logged in to your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal¬ data may also be recorded if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies that are stored on your end device or by recording your IP address.
With the help of the data collected in this way, the operators of social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-related advertising can be displayed to you both within and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are or were logged in.
Please also note that we are not able to trace all processing on the social media portals. Depending on the provider, further processing may therefore be carried out by the operators of the social media portals. For details, please refer to the ¬terms of use and data protection regulations of the respective social media portals.

2. Legal basis
Our social media appearances are designed to ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a GDPR).
In some cases, the use of our social media sites is based on Art. 6 para. 1 lit. f GDPR (legitimate interests). Our interests lie in the analysis of trends, interaction with our social media users and the improvement of our campaigns and services. If you require further information on the balancing of interests to be carried out in accordance with Art. 6 para. 1 lit. f GDPR, please contact our data protection officer at the contact details given in this data protection declaration. If necessary, we will obtain your consent for data processing (Art. 6 para. 1 lit. a GDPR).
3. Person responsible and assertion of rights
If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can assert your rights (information, correction, deletion, restriction of processing, data transferability and complaints) both against us and against the operator of the respective social media portal (e.g. against Facebook).
Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing procedures of the social media portals. Our possibilities depend largely on the corporate policy of the respective provider.
If personal data are processed by us as the responsible body, you as a data subject have certain rights under Chapter III of the EU Data Protection Regulation (GDPR), depending on the legal basis and purpose of the processing. These can be found in the chapter "Rights of the data subject" of this data protection declaration.

4. Storage duration
The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for storing them no longer applies, you request us to delete them, revoke your consent to storage or the purpose for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory legal provisions - in particular ¬retention ¬periods - remain unaffected.
We have no influence on the storage period of your data, which is stored by the operators of social networks for their own purposes. For details, please contact the social network operators directly (e.g. in their privacy policy, see below).

5. Social media appearances
5.1 Facebook
We have a profile on Facebook. This service is provided by Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the USA and other third countries.
We have entered into a Joint Controller Addendum agreement with Facebook ("Joint Controller"). This agreement defines which data processing operations we or Facebook are responsible for when you visit our Facebook page. You can view this Agreement and the Controller Addendum to this Agreement by clicking on the link below:
https://www.facebook.com/legal/terms/page_controller_addendum (agreement) and
https://www.facebook.com/legal/controller_addendum (addition for responsible persons).
You can adjust your advertising settings independently in your user account. To do so, click on the following link and log in:
https://www.facebook.com/settings?tab=ads.
Details can be found in the Facebook privacy policy: https://www.facebook.com/about/privacy/.

5.2 Instagram
We have a profile with Instagram. The supplier is Instagram Inc, 1601 Willow Road, Menlo Park, CA, 94025, USA. For details of how they handle your personal information, please see the Instagram Privacy Policy:
https://help.instagram.com/519522125107875.

5.3 Xing
We have a profile on XING. The provider is New Work SE, Dammtorstrasse 30, 20354 Hamburg, Germany. Details on how they handle your personal data can be found in the XING data ¬protection -declaration:
https://privacy.xing.com/de/datenschutzerklaerung.
5.4 LinkedIn
We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.
If you want to disable LinkedIn advertising cookies, please use the following link:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
For details of how they handle your personal information, please see the LinkedIn Privacy Policy:
https://www.linkedin.com/legal/privacy-policy. 
6. Further information about our social media appearances
Facebook - For more information on how you can assert or implement your rights as a data subject directly with Facebook, please visit
https://www.facebook.com/privacy/explanation.
Instagram - For more information on how you can exercise your rights as a data subject directly against Facebook (as operator of Instagram), please visit
https://www.facebook.com/help/instagram/155833707900388.
LinkedIn - For more information on how to exercise your ¬rights directly against LinkedIn, please visit LinkedIn:
https://www.linkedin.com/help/linkedin/answer/50191?trk=microsites-frontend_legal_privacy-policy.


VIII Plugins, tools and partner programs

1. YouTube with enhanced data protection
This website incorporates videos from YouTube. The operator of the site is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in advanced privacy mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, the extended privacy mode does not necessarily exclude the sharing of information with YouTube partners. For example, YouTube connects to the Google DoubleClick network whether or not you are watching a video.
As soon as you start a YouTube video on this website, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited. If you are logged in to your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.
Furthermore, YouTube can store various cookies on your end device after starting a video or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to gather video statistics, improve the user experience and prevent fraud.
If necessary, further data processing procedures may be triggered after the start of a YouTube video, over which we have no influence.
YouTube is used in the interest of an attractive presentation of our online offers. This represents a legitimate interest in the sense of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.
For more information about YouTube's privacy policy, please see their privacy policy at: https://policies.google.com/privacy?hl=de.

2. Google Maps
This site uses the map service Google Maps. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps it is necessary to save your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.
The use of Google Maps is in the interest of an attractive presentation of our online offers and to make it easy to find the places we have indicated on the website. This represents a legitimate interest in the sense of Art. 6 para. 1 lit. f GDPR. If the relevant consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be revoked at any time.
Data transmission to the US is based on the standard contractual clauses of the EU Commission. Details can be found at https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
For more information on how we handle user data, please refer to Google's privacy policy: https://policies.google.com/privacy?hl=de.

3. HubSpot
We use the CRM system of the provider HubSpot, a software company from the USA with a branch in Ireland (Ground Floor, Two Dockland Central Guild Street, Dublin 1, Ireland), in order to be able to process user enquiries faster and more efficiently and to optimize our contact management (legitimate interest according to Art. 6 para. 1 lit. f. GDPR).
We have entered into a contract with HubSpot under which HubSpot processes your data only on our behalf: https://legal.hubspot.com/de/dpa.
HubSpot offers various functions, of which we use contact forms, newsletter software, tracking and analysis CRM (Customer Relation Management) and chat software.
For more information on data processing by HubSpot, please visit the HubSpot website: https://www.hubspot.de/data-privacy/gdpr.

4. Affilinet
The data controller has integrated components of the Affilinet company on this website. Affilinet is a German affiliate network that offers affiliate marketing.
Affiliate marketing is an Internet-supported form of distribution that enables commercial operators of Internet sites, so-called merchants or advertisers, to display advertising, which is usually remunerated by click or sale commissions, on the Internet sites of third parties, i.e. distribution partners also known as affiliates or publishers. Via the affiliate network, the Merchant provides a means of advertising, i.e. an advertising banner or other suitable means of Internet advertising, which is subsequently integrated by an Affiliate on its own Internet pages or advertised via other channels, such as keyword advertising or e-mail marketing.
The operating company of Affilinet is Affilinet GmbH, Sapporobogen 6-8, 80637 Munich, Germany.
Affilinet places a cookie on the information technology system of the person concerned. What cookies are has already been explained above. The tracking cookie of Affilinet does not store any personal data. Only the identification number of the affiliate, i.e. the partner referring the potential customer, as well as the serial number of the visitor of a website and the advertising medium clicked on are stored. The purpose of storing this data is the processing of commission payments between a merchant and the Affiliate, which are processed via the Affiliate network, i.e. Affilinet.
The person concerned can prevent the setting of cookies by our website, as described above, at any time by means of a corresponding setting in the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the used internet browser would also prevent Affilinet from setting a cookie on the information technology system of the person concerned. In addition, cookies already set by Affilinet can be deleted at any time via an internet browser or other software programs.
The current data protection policy of Affilinet can be found here: https://www.awin.com/de/datenschutzerklarung?utm_medium=redirect&utm_source=www.affili.net
5. Trustpilot
We use the review portal Trustpilot to publish reviews from our customers. For this purpose we give your email address, first name and an internal booking number to Trustpilot A/S, Trommesalen 5, 3. sal, 1614 Copenhagen (Denmark).
Your participation is of course voluntary. After submission, your reviews will be published according to Trustpilot's guidelines on their websites and possible partners. Reviews can also be published in Google search results. However, a right to publication does not arise from this.
The legal basis for the processing is your consent (Art. 6 DSGVO para. 1 lit a.). Your rights as a data subject remain, including the revocation of your consent. Completed processes remain unaffected by future objections.
All details and data protection conditions of the provider Trustpilot are published at https://legal.trustpilot.de/end-user-privacy-terms and https://legal.trustpilot.de/end-user-terms-and-conditions.

IX. eCommerce and payment providers

Processing of data (customer and contract data)
We collect, process and use personal data only to the extent that they are necessary for the establishment, content or modification of the legal relationship (inventory data). This is done on the basis of Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. We collect, process and use personal data on the use of this website (usage data) only to the extent necessary to enable or charge the user for the use of the service.
The collected customer data will be deleted after completion of the order or termination of the business relationship. Legal retention periods remain unaffected.
Data transfer upon conclusion of contract for online shops, dealers and dispatch of goods
We only transfer personal data to third parties if this is necessary within the scope of the contract processing, for example to the companies entrusted with the delivery of the goods or the credit institute commissioned with the payment processing. A further transmission of the data does not take place or only if you have expressly agreed to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.
Data transmission on conclusion of contract for services and digital content
We only transfer personal data to third parties if this is necessary within the framework of the contract, e.g. to the credit institution commissioned with the handling of payments.
No further transmission of the data will take place or only if you have expressly agreed to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.
The basis for data processing is Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.
Payment service provider
We integrate payment services of third party companies on our website. When you make a purchase from us, your payment data (e.g. name, payment amount, bank account details, credit card number) are processed by the payment service provider for the purpose of payment processing. The respective contractual and data protection provisions of the respective providers apply to these transactions. The payment service providers are used on the basis of Art. 6 para. 1 lit. b GDPR (contract processing) and in the interest of a payment transaction that is as smooth, convenient and secure as possible (Art. 6 para. 1 lit. f GDPR). Insofar as your consent is required for certain actions, Art. 6 para. 1 lit. a GDPR is the legal basis for data processing; consent may be revoked at any time in the future.
We use the following payment services / payment service providers within the scope of this website:
PayPal
The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). Details can be found in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Instant bank transfer ("Sofortüberweisung")
The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter referred to as "Sofort GmbH"). With the help of the "Sofortüberweisung" procedure, we receive a payment confirmation from Sofort GmbH in real time and can immediately begin to fulfil our obligations. If you have decided on the payment method "immediate transfer", please send the PIN and a valid TAN to Sofort GmbH, with which it can log into your online banking account. Sofort GmbH automatically checks your account balance after logging in and carries out the bank transfer to us with the help of the TAN you provided. Afterwards, it immediately sends us a transaction confirmation. After logging in, your turnover, the credit limit of the overdraft facility and the existence of other accounts and their balances are also checked automatically. In addition to the PIN and the TAN, the payment data entered by you as well as personal data will be transmitted to Sofort GmbH. Your personal data includes first and last name, address, telephone number(s), e-mail address, IP address and any other data required for payment processing. The transmission of this data is necessary to determine your identity beyond doubt and to prevent fraud attempts. For details of payment by instant bank transfer, please refer to the following links: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

X. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis the person responsible:
1. Right of information
You can request confirmation from the person responsible as to whether personal data concerning you is being processed by us.
In the event of such processing, you may request the following information from the data controller:
(1) the purposes for which the personal data are processed
(2) the categories of personal data which are processed
(3) the recipients or the categories of recipients to whom the personal¬ data relating to you have been or will be disclosed
(4) the planned duration of storage of the personal data relating to you or, if it is not possible to give specific details, criteria for determining the duration of storage
(5) the existence of a right of rectification or erasure of personal data concerning you, a right to have the processing limited by the controller or a ¬¬¬right of opposition to such processing
(6) the existence of a right of appeal to a supervisory authority;
(7) all available information on the origin of the data, if the personal data are not collected from the data subject
(8) the existence of automated decision-making, including profiling in accordance with Art. 22 (1) and (4) GDPR and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of such processing on the data subject
You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organization. In this context¬, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. Right of rectification
You have the right to ask the data controller to correct and/or complete any personal data processed concerning you if it is incorrect or incomplete. The data controller must make the correction without delay.

3. Right to restrict processing
Under the following conditions, you may request that the processing of personal data concerning you be restricted:
(1) if you dispute the accuracy of the personal data concerning you for a period of time which enables the person responsible to verify the accuracy of the personal data
(2) the processing is unlawful and you object to the deletion of the personal data and instead request the restriction of the use of the personal data
(3) the controller no longer needs the personal data for the purposes of the processing, but you need it for the purposes of exercising or defending legal claims; or
(4) if you have lodged an objection to the processing in accordance with Art. 21 para. 1 GDPR and it has not yet been established whether the legitimate reasons of the controller outweigh your reasons.
If the processing of personal data relating to you has been restricted, such data, apart from being stored, may be processed only with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of major public interest of the Union or a Member ¬State.
If the restriction on processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

4. Right of cancellation
4.1 Duty to delete
You may request the controller to delete personal data concerning you without delay and the controller is obliged to delete such data without delay if one of the following reasons applies:
(1) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed
(2) You revoke your consent on which the processing was based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for the processing, or you object¬ to the processing pursuant to Art. 21 (2) GDPR.
(4) Personal data concerning you have been processed unlawfully.
The deletion of personal data concerning you is necessary to comply with a legal obligation¬ under Union law or the law of the Member States to which the controller¬ is subject.
(6) The personal data relating to you has been collected in relation to the services offered by the Information¬¬ Society in accordance with Art. 8 para. 1 GDPR.

4.2 Information to third parties
If the data controller has made public the personal data concerning you and is obliged to delete them in accordance with Art. 17 para. 1 of the DPA, it shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that you, as a data subject, have requested them to delete all links to this personal data or copies or replications of this personal data.

4.3 Exceptions
The right of cancellation does not apply if the processing is necessary
(1) to exercise the right to freedom of expression and information;
(2) in order to comply with a legal obligation imposed on the controller by Union or national law to which the controller is subject or in order to perform a task carried out in the public interest or in the exercise of official authority vested in the controller
(3) for reasons of public interest in the field of public health pursuant to Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR;
(4) for archiving, scientific or historical research purposes in the public interest¬ or for statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the law referred to in section a) is likely to render impossible or seriously prejudice the attainment of the objectives of such processing¬, or
(5) to assert, exercise or defend legal claims.

5. Right to information
If you have asserted the right to rectify, erase or limit the processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification, erasure or limitation of processing, unless this proves impossible or involves a disproportionate effort.
They have the right to be informed of these recipients by the person responsible.

6. Right to data transferability
You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, common and machine-readable format. You also have the right to have this data communicated to another controller without interference from the controller to whom the personal data has been communicated, provided that
(1) the processing is based on a consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and
(2) the processing is carried out by means of automated procedures.
In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller, as far as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to data transferability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right of objection
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6, para. 1, lit. e or f of the DPA; this also applies to profiling based on these provisions.
The person responsible will no longer process the personal data concerning you unless he/she can demonstrate compelling reasons for processing which are worthy of protection and which outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.
If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing, including profiling, insofar as it relates to such direct marketing.
If you object to processing for direct marketing purposes, the personal¬ data relating to you will no longer be processed for these purposes.
You have the possibility of exercising your right of objection in connection with the use of Information Society services, without prejudice to Directive 2002/58/EC, by means of automated procedures involving technical specifications.

8. Right to revoke the declaration of consent under data protection law
You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the lawfulness of the processing that has taken place on the basis of your consent until revocation.

9. Automated decision in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects in relation to you or significantly affects you in a similar way. This does not apply if the decision
(1) for the conclusion or performance of any contract between you and the person responsible,
(2) is authorised by Union or national legislation to which the person responsible is subject and that legislation provides for appropriate measures to safeguard your rights and freedoms and your legitimate interests; or
(3) with your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or g GDPR applies and appropriate measures¬ have been taken to protect rights and freedoms and your legitimate interests.
With regard to the cases referred to in (1) and (3), the responsible person shall take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which shall include at least the right to obtain the intervention of any person from the responsible person, to express his point of view and to challenge the decision.

10. Right of appeal to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority, in particular in the Member State in which you are resident, your place of work or the place of the suspected infringement, if you consider that the processing of personal data concerning you is in breach of the DPA.
The supervisory authority to which the complaint has been submitted shall inform the complainant about the status and the results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

XI. Data security, third-party websites, changes

1. SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. Data protection and third party websites
The website may contain hyperlinks to and from third party websites. If you follow a hyperlink to one of these websites, please note that we cannot accept any responsibility or guarantee for third-party content or data protection conditions. Please check the applicable data protection conditions before you submit personal data to these websites.

3. Amendments to this data protection policy
We reserve the right to change these data protection provisions at any time with effect for the future. A current version is available on the website. Please visit the website regularly and inform yourself about the applicable data protection regulations.

Status 16.10.2020 | v1.11.3