DEENFRITNLCNAR

Privacy Policy

Data Protection Declaration


We are pleased that you are interested in our company. Data protection is a high priority for the management of HJP Immobilien GmbH. In principle, the HJP Immobilien GmbH website can be used without providing any personal data. However, processing personal data may become necessary if a data subject wishes to use particular services offered by our company through the website. If personal data must be processed and there is no statutory basis for doing so, we generally obtain the data subject’s consent.

Personal data, such as a data subject’s name, address, email address or telephone number, is always processed in accordance with the General Data Protection Regulation and the country-specific data protection provisions applicable to HJP Immobilien GmbH. Through this privacy policy, our company wishes to inform the public about the nature, scope and purpose of the personal data we collect, use and process. This privacy policy also explains the rights available to data subjects.

As the controller, HJP Immobilien GmbH has implemented numerous technical and organisational measures to provide the most comprehensive protection possible for personal data processed through this website. Nevertheless, internet-based data transmission may have security vulnerabilities, so absolute protection cannot be guaranteed. Every data subject is therefore free to send personal data to us by other means, for example by telephone.
1. Definitions
The privacy policy of HJP Immobilien GmbH is based on the terms used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy policy should be easy to read and understand for the public, our customers and our business partners. To ensure this, we explain the terminology used below.
In this privacy policy, we use, among others, the following terms:

a) Personal data
Personal data means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is someone who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.


b) Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.


c) Processing
Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.


d) Restriction of processing
Restriction of processing means marking stored personal data with the aim of limiting its processing in the future.

e) Profiling
Profiling means any form of automated processing of personal data that uses this data to evaluate certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation
Pseudonymisation means processing personal data in such a way that it can no longer be attributed to a specific data subject without additional information, provided that this additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data cannot be attributed to an identified or identifiable natural person.

g) Controller or controller responsible for processing
The controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of processing are determined by Union or Member State law, that law may provide for the controller or the specific criteria for its nomination.


h) Processor
A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.


i) Recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the framework of a particular inquiry under Union or Member State law are not considered recipients.


j) Third party
A third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons authorised to process personal data under the direct authority of the controller or processor.


k) Consent
Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of their personal data, through a statement or a clear affirmative action.


2. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions concerning data protection is:

HJP Immobilien GmbH
Steideleweg 12
A-6604 Höfen / Tyrol
T. 0043 (0)5672 / 21660
E. office@lechappart.at
www.lechappart.at

3. Cookies

The websites of HJP Immobilien GmbH use cookies. Cookies are text files placed and stored on a computer system through an internet browser.

Many websites and servers use cookies. Many cookies contain a cookie ID, a unique identifier consisting of a string of characters through which websites and servers can identify the particular browser in which the cookie was stored. This allows websites and servers to distinguish the data subject’s individual browser from other browsers containing different cookies. A particular browser can be recognised and identified through its unique cookie ID.

By using cookies, HJP Immobilien GmbH can offer users of this website more user-friendly services that would not be possible without cookies.

Cookies allow the information and offers on our website to be optimised for the user. As mentioned above, cookies allow us to recognise visitors to our website. The purpose of this recognition is to make the website easier to use. For example, users of a website that uses cookies do not need to re-enter their login details on every visit because the website and the cookie stored on their computer perform this task. Another example is an online shop’s shopping-cart cookie, which enables the shop to remember the items placed in the virtual basket.

Data subjects can prevent cookies from being set by our website at any time by changing the settings of their browser, thereby permanently objecting to cookies. Cookies already set can also be deleted at any time through a browser or other software. This is possible in all common browsers. If a data subject disables cookies in their browser, some website functions may not be fully available.


4. Collection of general data and information

The HJP Immobilien GmbH website collects general data and information whenever a data subject or an automated system accesses it. This information is stored in server log files. It may include (1) browser types and versions, (2) the accessing system’s operating system, (3) the website from which the accessing system reaches our website (the referrer), (4) the subpages accessed on our website, (5) the date and time of access, (6) an internet protocol address (IP address), (7) the accessing system’s internet service provider and (8) similar data and information used to protect our IT systems in the event of attacks.

HJP Immobilien GmbH does not use this general data and information to draw conclusions about the data subject. Rather, it is needed to (1) deliver website content correctly, (2) optimise website content and advertising, (3) ensure the continuing functionality of our IT systems and website technology and (4) provide law enforcement authorities with information necessary for prosecution in the event of a cyberattack. HJP Immobilien GmbH therefore analyses this anonymously collected information for statistical purposes and to improve data protection and security within the company, ultimately ensuring an optimal level of protection for the personal data we process. Anonymous server log data is stored separately from personal data provided by a data subject.


5. Registration on our website

Data subjects may register on the controller’s website by providing personal data. The registration form determines which personal data is sent to the controller. The personal data entered is collected and stored exclusively for the controller’s internal use and its own purposes. The controller may arrange for it to be transferred to one or more processors, such as a parcel delivery provider, which also uses the data exclusively for internal purposes attributable to the controller.

Registration also records the IP address assigned to the data subject by their internet service provider (ISP), and the date and time of registration. This information is stored to prevent misuse of our services and, if necessary, to allow offences to be investigated. Storing it is therefore necessary to protect the controller. It is generally not disclosed to third parties unless there is a legal obligation to do so or disclosure serves law enforcement purposes.

Registration with voluntarily provided personal data allows the controller to offer content or services that, by their nature, can only be made available to registered users. Registered persons may change the personal data provided during registration at any time or have it completely erased from the controller’s records.

On request, the controller will inform any data subject at any time about the personal data stored about them. The controller will also correct or erase personal data at the data subject’s request or upon notification, unless statutory retention obligations prevent this. Any data protection officer named in this policy and all employees of the controller are available as contacts in this regard.


6. Subscription to our newsletter
The HJP Immobilien GmbH website allows users to subscribe to our company’s newsletter. The subscription form determines which personal data is sent to the controller when the newsletter is requested.

HJP Immobilien GmbH regularly informs customers and business partners about company offers through a newsletter. In principle, a data subject can receive it only if (1) they have a valid email address and (2) they register to receive it. For legal reasons, a confirmation email is sent to an email address first entered for a newsletter subscription using the double opt-in procedure. This confirms whether the email address owner, as the data subject, has authorised receipt of the newsletter.

When a newsletter subscription is made, we also store the IP address assigned by the ISP to the computer used at registration, and the date and time of registration. This information is required to trace any subsequent misuse of a data subject’s email address and therefore serves to protect the controller legally.

Personal data collected during newsletter registration is used exclusively to send our newsletter. Subscribers may also be informed by email where necessary for the operation of the newsletter service or registration, for example if the newsletter offering or technical arrangements change. Personal data collected for the newsletter service is not disclosed to third parties. Data subjects may cancel their subscription at any time and withdraw their consent to the storage of data provided for this purpose. Each newsletter contains a corresponding withdrawal link. Users may also unsubscribe directly on the controller’s website at any time or notify the controller by other means.


7. Newsletter tracking

Newsletters from HJP Immobilien GmbH contain tracking pixels. A tracking pixel is a miniature image embedded in HTML emails that allows log-file recording and analysis. It enables statistical evaluation of the success or failure of online marketing campaigns. Through the embedded pixel, HJP Immobilien GmbH can determine whether and when an email was opened and which links it contained were accessed by the data subject.

The controller stores and analyses personal data collected through newsletter tracking pixels to optimise newsletter delivery and tailor future content more closely to the data subject’s interests. This data is not disclosed to third parties. Data subjects may withdraw the separate consent given through the double opt-in procedure at any time. Following withdrawal, the controller erases this personal data. HJP Immobilien GmbH automatically treats unsubscribing from the newsletter as withdrawal of consent.


8. Contact through the website

To comply with statutory requirements, the HJP Immobilien GmbH website contains information enabling quick electronic contact and direct communication with our company, including a general email address. If a data subject contacts the controller by email or a contact form, the personal data sent is stored automatically. Personal data voluntarily provided in this way is stored to handle the enquiry or contact the data subject. It is not disclosed to third parties.


9. Blog comment function on the website

HJP Immobilien GmbH allows users to leave individual comments on blog posts on the controller’s website. A blog is a usually publicly accessible website portal on which one or more people, called bloggers or web bloggers, post articles or write thoughts in blog posts. Third parties can generally comment on these posts.

When a data subject leaves a comment on the blog, the comment, its submission time and the chosen username or pseudonym are stored and published. The IP address assigned by the data subject’s ISP is also recorded. This is done for security reasons and in case the comment infringes third-party rights or contains unlawful content. Storage is therefore in the controller’s own interest so that it may, if necessary, establish its lack of responsibility in the event of an infringement. This personal data is not disclosed to third parties unless legally required or necessary for the controller’s legal defence.


10. Routine erasure and blocking of personal data

The controller processes and stores the data subject’s personal data only for as long as necessary to achieve the purpose of storage or for the period required by European or other applicable laws or regulations to which the controller is subject.

If the purpose of storage no longer applies or a retention period prescribed by the European legislator or another competent legislator expires, personal data is routinely blocked or erased in accordance with statutory requirements.


11. Rights of the data subject

a) Right to confirmation
Every data subject has the right granted by the European legislator to obtain confirmation from the controller as to whether personal data concerning them is being processed. Anyone wishing to exercise this right may contact our data protection officer or another employee of the controller at any time.


b) Right of access
Every data subject has the right granted by the European legislator to obtain, free of charge and at any time, information from the controller about the personal data stored concerning them and a copy of that information. The European legislator also grants access to the following information:

  • the purposes of processing
  • the categories of personal data being processed
  • the recipients or categories of recipients to whom personal data has been or will be disclosed, particularly recipients in third countries or international organisations
  • where possible, the intended period for which personal data will be stored or, if that is not possible, the criteria used to determine that period
  • the existence of the right to request rectification or erasure of personal data, restriction of processing by the controller, or to object to that processing
  • the right to lodge a complaint with a supervisory authority
  • where personal data was not collected from the data subject, any available information about its source
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of that processing for the data subject
  • The data subject is also entitled to information about whether personal data has been transferred to a third country or an international organisation. If so, they may obtain information about the appropriate safeguards relating to the transfer.

    Anyone wishing to exercise this right of access may contact our data protection officer or another employee of the controller at any time.


c) Right to rectification
Every data subject has the right granted by the European legislator to obtain prompt rectification of inaccurate personal data concerning them. Taking account of the processing purposes, they also have the right to have incomplete personal data completed, including by providing a supplementary statement.

Anyone wishing to exercise this right to rectification may contact our data protection officer or another employee of the controller at any time.

d) Right to erasure (right to be forgotten)
Every data subject has the right granted by the European legislator to require the controller to erase personal data concerning them without delay where one of the following grounds applies and processing is not necessary:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
  • The data subject withdraws the consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
  • The data subject objects to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or objects under Article 21(2) GDPR.
  • The personal data has been processed unlawfully.
  • Erasure is necessary to comply with a legal obligation under Union or Member State law to which the controller is subject.
  • The personal data was collected in connection with information society services offered under Article 8(1) GDPR.

If one of the above grounds applies and a data subject wishes to have personal data held by HJP Immobilien GmbH

  •  erased, they may contact our

        data protection officer or another employee of the

        controller at any time. The data protection officer 

       of HJP Immobilien GmbH or another employee will 
       ensure that the erasure request is promptly fulfilled.

Where HJP Immobilien GmbH has made personal data public and, as controller, is obliged to erase it under Article 17(1) GDPR, HJP Immobilien GmbH takes reasonable measures, including technical measures, having regard to available technology and implementation costs, to inform other controllers processing the published data that the data subject has requested erasure of links to, copies of or reproductions of that personal data, insofar as processing is not necessary. The data protection officer of HJP Immobilien GmbH or another employee will arrange the necessary steps in each individual case.


e) Right to restriction of processing
Every data subject has the right granted by the European legislator to require the controller to restrict processing where one of the following conditions applies:

  • The data subject contests the accuracy of the personal data, for a period allowing the controller to verify its accuracy.
  • Processing is unlawful and the data subject opposes erasure, requesting restriction of the use of the data instead.
  • The controller no longer needs the personal data for processing purposes, but the data subject needs it to establish, exercise or defend legal claims.
  • The data subject has objected to processing under Article 21(1) GDPR, pending verification of whether the controller’s legitimate grounds override those of the data subject.
  • If one of these conditions applies and a data subject wishes to request restriction of personal data held by 

      HJP Immobilien GmbH

  • they may contact our data protection officer or another employee of the controller at any time. The data protection officer of 

       HJP Immobilien GmbH or another employee will arrange 
       for processing to be restricted.


f) Right to data portability

Every data subject has the right granted by the European legislator to receive personal data concerning them that they provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit it to another controller without hindrance from the controller to which it was provided, where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or a contract under Article 6(1)(b) GDPR and is carried out by automated means, provided processing is not necessary for a task performed in the public interest or in the exercise of official authority vested in the controller.

When exercising the right to data portability under Article 20(1) GDPR, the data subject also has the right to have personal data transmitted directly from one controller to another where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To exercise the right to data portability, the data subject may contact the data protection officer appointed by HJP Immobilien GmbH or another employee at any time.


g) Right to object

Every data subject has the right granted by the European legislator to object at any time, on grounds relating to their particular situation, to processing of their personal data based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

In the event of an objection, HJP Immobilien GmbH will no longer process the personal data unless we demonstrate compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where HJP Immobilien GmbH processes personal data for direct marketing, the data subject may object at any time to processing for that purpose. This also applies to profiling insofar as it relates to direct marketing. If the data subject objects to HJP Immobilien GmbH processing data for direct marketing, HJP Immobilien GmbH will no longer process it for that purpose.

The data subject also has the right to object, on grounds relating to their particular situation, to processing of their personal data by HJP Immobilien GmbH for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless processing is necessary for a task carried out in the public interest.

To exercise the right to object, the data subject may contact the data protection officer of HJP Immobilien GmbH or another employee directly. In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may also exercise the right to object by automated means using technical specifications.


h) Automated individual decision-making, including profiling
Every data subject has the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Exceptions apply where the decision (1) is necessary to enter into or perform a contract between the data subject and the controller, (2) is authorised by Union or Member State law to which the controller is subject and that law provides appropriate safeguards for the data subject’s rights, freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

Where the decision (1) is necessary to enter into or perform a contract between the data subject and the controller or (2) is based on explicit consent, HJP Immobilien GmbH implements suitable safeguards for the data subject’s rights, freedoms and legitimate interests. These include at least the right to obtain human intervention on the controller’s part, express their point of view and contest the decision.

Anyone wishing to exercise rights concerning automated decisions may contact our data protection officer or another employee of the controller at any time.


i) Right to withdraw consent to data processing
Every data subject has the right granted by the European legislator to withdraw consent to the processing of personal data at any time.

Anyone wishing to withdraw consent may contact our data protection officer or another employee of the controller at any time.


12. Data protection for job applications and recruitment

The controller collects and processes applicants’ personal data to administer recruitment. Processing may also take place electronically, particularly where an applicant submits application documents electronically, for example by email or through a web form. If the controller enters into an employment contract with an applicant, the data is stored to administer the employment relationship in compliance with statutory requirements. If no employment contract is concluded, application documents are automatically erased two months after the rejection decision is communicated, unless other legitimate interests of the controller prevent erasure. Such an interest may include the obligation to provide evidence in proceedings under the General Equal Treatment Act (AGG).


13. Data protection provisions concerning AddThis

The controller has integrated components of AddThis on this website. AddThis is a bookmarking provider that allows websites to be bookmarked easily using buttons. Moving the mouse over or clicking an AddThis component displays a list of bookmarking and sharing services. AddThis is used on over 15 million websites and, according to its operator, its buttons are displayed over 20 billion times each year.

AddThis is operated by AddThis, Inc., 1595 Spring Hill Road, Suite 300, Vienna, VA 22182, USA.

Whenever a page operated by the controller that contains an AddThis component is accessed, the component automatically causes the data subject’s browser to download data from www.addthis.com. As part of this technical process, AddThis learns about the visit and the particular page accessed by the data subject’s IT system. It also receives the computer’s ISP-assigned IP address, browser type and language, the previously visited website, and the date and time of the visit. AddThis uses this information to create anonymised user profiles. The data transmitted in this way allows AddThis, its affiliates and partners to target visitors to the controller’s website with personalised advertising based on their interests.

AddThis displays personalised and interest-based advertising using a cookie it sets. The cookie analyses the individual browsing behaviour of the data subject’s computer and stores the websites visited from that system.

As explained above, the data subject may prevent cookies from being set by our website at any time through browser settings and thereby permanently object to cookies. Such settings also prevent AddThis from placing a cookie on the data subject’s IT system. AddThis cookies already set can be deleted at any time through a browser or other software.

The data subject may also permanently object to AddThis processing personal data. To do so, they must click the opt-out button at https://www.addthis.com/privacy/opt-out, which places an opt-out cookie on their IT system. If cookies are deleted after opting out, the data subject must revisit the link and set a new opt-out cookie.

Setting an opt-out cookie may, however, mean that the controller’s websites can no longer be used in full.

The applicable AddThis privacy provisions are available at https://www.addthis.com/privacy/privacy-policy.

14. Data protection provisions concerning Facebook

The controller has integrated components of Facebook on this website. Facebook is a social network.

A social network is an online meeting place or community that generally allows users to communicate and interact in a virtual space. It can serve as a platform for sharing opinions and experiences or providing personal or business-related information. Facebook allows users, among other things, to create personal profiles, upload photographs and connect through friend requests.

Facebook is operated by Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. Where a data subject resides outside the USA or Canada, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, is responsible for processing personal data.

Whenever a page operated by the controller that includes a Facebook component (Facebook plug-in) is accessed, that component automatically causes the data subject’s browser to download a representation of the relevant component from Facebook. An overview of Facebook plug-ins is available at https://developers.facebook.com/docs/plugins/?locale=en_US. Through this technical process, Facebook learns which particular subpage of our website the data subject visits.

If the data subject is logged in to Facebook at the same time, Facebook recognises which particular subpages are visited whenever our website is accessed and throughout the visit. The Facebook component collects this information and associates it with the data subject’s Facebook account. If the data subject uses an integrated Facebook button, such as the ‘Like’ button, or submits a comment, Facebook associates that information with their personal user account and stores the personal data.

The Facebook component informs Facebook of a visit to our website whenever the data subject is logged in to Facebook at the time of access, regardless of whether they click the component. If the data subject does not want this information transmitted, they can prevent it by logging out of Facebook before visiting our website.

Facebook’s data policy at https://de-de.facebook.com/about/privacy/ explains its collection, processing and use of personal data, and the settings it offers to protect the data subject’s privacy. Applications that prevent data transmission to Facebook are also available. Data subjects may use these applications to prevent transmission.

15. Data protection provisions concerning Google AdSense. The controller has integrated Google AdSense into this website. Google AdSense is an online service that places advertising on third-party websites. It uses an algorithm to select advertisements matching the content of the respective third-party page and permits interest-based targeting through individual user profiles. The component is operated by Alphabet Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Its purpose is to display advertisements on our website. Google AdSense sets a cookie on the data subject’s IT system; cookies are explained above. This allows Alphabet Inc. to analyse use of our website. Whenever a page containing an AdSense component is accessed, it automatically causes the browser to transmit data to Alphabet Inc. for online advertising and commission settlement. Alphabet Inc. receives personal data, such as the IP address, used among other things to trace the origin of visitors and clicks and enable commission calculations. As explained above, data subjects can permanently prevent cookies by adjusting their browser settings. This also prevents Alphabet Inc. from setting a cookie. Cookies already set can be deleted through the browser or other software. Google AdSense also uses tracking pixels: miniature images embedded in webpages that allow log-file recording and analysis for statistical evaluation. These pixels enable Alphabet Inc. to recognise whether and when a page was opened and which links were clicked, and are used, among other things, to analyse visitor traffic. Through Google AdSense, personal data and information, including the IP address, necessary to record and bill displayed advertisements is transmitted to Alphabet Inc. in the United States. It is stored and processed there and may be disclosed to third parties. Further information about Google AdSense is available at https://www.google.de/intl/de/adsense/start/.

16. Data protection provisions concerning Google Analytics (with anonymisation). The controller has integrated Google Analytics with anonymisation into this website. Google Analytics is a web analytics service. Web analytics involves collecting and evaluating data about website visitors’ behaviour, including the referring website, subpages accessed, and the frequency and duration of visits. It is mainly used to optimise websites and assess the costs and benefits of online advertising. Google Analytics is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. The controller uses the extension ‘_gat._anonymizeIp’. This causes Google to shorten and anonymise the IP address of the data subject’s internet connection when access comes from an EU Member State or another state party to the European Economic Area Agreement. The component’s purpose is to analyse visitor traffic. Google uses the data to evaluate website use, compile online reports about website activity and provide related services. Google Analytics sets a cookie on the data subject’s IT system; cookies are explained above. This enables Google to analyse website use. Whenever a page containing the component is accessed, the browser is automatically instructed to transmit data to Google for online analysis. Google receives personal data, such as the IP address, which it uses, among other things, to trace the origin of visitors and clicks and enable commission calculations. The cookie stores personal information such as access time, the location from which access took place and visit frequency. On each visit, this information, including the IP address, is transmitted to Google in the United States, stored there and may be disclosed to third parties. As explained above, data subjects can permanently prevent cookies by adjusting browser settings, which also prevents Google setting a cookie. Existing Google Analytics cookies can be deleted through the browser or other software. Data subjects may also object to and prevent collection of website-use data generated by Google Analytics and its processing by Google by downloading and installing the browser add-on at https://tools.google.com/dlpage/gaoptout. The add-on tells Google Analytics through JavaScript that no website-visit information may be transmitted. Google treats installation as an objection. If the IT system is subsequently erased, formatted or reinstalled, the add-on must be reinstalled to disable Google Analytics. If the data subject or someone within their sphere of control uninstalls or disables it, it may be reinstalled or reactivated. Further information and Google’s applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/ and https://www.google.com/analytics/terms/de.html. Google Analytics is explained at https://www.google.com/intl/de_de/analytics/.

17. Data protection provisions concerning Google Remarketing. The controller has integrated Google Remarketing services into this website. Google Remarketing is a Google AdWords feature allowing companies to display advertisements to users who have previously visited their websites. It allows personalised, interest-based advertising to be created. The service is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Its purpose is to display advertisements relevant to users’ interests. It enables us to display advertisements through the Google advertising network or on other websites, tailored to users’ needs and interests. Google Remarketing sets a cookie on the data subject’s IT system; cookies are explained above. The cookie enables Google to recognise a visitor when they subsequently access websites belonging to the Google advertising network. Whenever a website containing Google Remarketing is accessed, the browser automatically identifies itself to Google. Google receives personal data, such as the IP address or browsing behaviour, used among other things to display relevant advertisements. The cookie stores personal information, such as websites visited. On each visit to our website, personal data, including the IP address, is therefore transmitted to Google in the United States and stored there. Google may disclose it to third parties. As explained above, data subjects can permanently prevent cookies by adjusting their browser settings, which also prevents Google from setting a cookie. Existing Google Analytics cookies can be deleted through the browser or other software. Data subjects may also object to Google’s interest-based advertising by visiting www.google.de/settings/ads in each browser they use and selecting their preferred settings. Further information and Google’s applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/.

18. Data protection provisions concerning Google+. The controller has integrated the Google+ button into this website. Google+ is a social network: an online meeting place or community that generally allows users to communicate and interact virtually, exchange opinions and experiences, and provide personal or business-related information. Google+ allows users, among other things, to create personal profiles, upload photographs and connect through friend requests. It is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Whenever a page containing a Google+ button is accessed, the button automatically causes the data subject’s browser to download its representation from Google. Through this process, Google learns which subpage is visited. More information is available at https://developers.google.com/+/. If the data subject is logged in to Google+ at the same time, Google recognises the particular subpages visited whenever our website is accessed and throughout the visit. The button collects this information and associates it with the data subject’s Google+ account. If the data subject clicks a Google+ button to make a Google+1 recommendation, Google assigns this information to their personal account and stores it. Google stores and publishes the recommendation in accordance with the terms accepted by the data subject. A Google+1 recommendation made on this website is subsequently stored and processed together with other personal data, such as the account name and photograph, in other Google services, including search results or the data subject’s Google account, and elsewhere, such as on websites or in connection with advertisements. Google can also link the visit to other personal data it holds and records this information to improve or optimise its various services. The Google+ button informs Google of a website visit whenever the data subject is logged in to Google+ at the time of access, regardless of whether they click it. A data subject who does not want personal data transmitted to Google can prevent this by logging out of Google+ before visiting our website. Further information and Google’s privacy provisions are available at https://www.google.de/intl/de/policies/privacy/. Information about the Google+1 button is available at https://developers.google.com/+/web/buttons-policy.

19. Data protection provisions concerning Google AdWords. The controller has integrated Google AdWords into this website. Google AdWords is an online advertising service that allows advertisers to place advertisements in Google search results and throughout the Google advertising network. Advertisers can select keywords so that an advertisement appears in search results only when a user searches for relevant terms. In the Google advertising network, an automated algorithm uses the selected keywords to distribute advertisements to relevant websites. The service is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Its purpose is to promote our website through interest-based advertisements on third-party websites and in Google search results, and to display third-party advertisements on our website. When a data subject reaches our website through a Google advertisement, Google sets a conversion cookie on their IT system. Cookies are explained above. The conversion cookie expires after 30 days and is not used to identify the data subject. While valid, it tracks whether certain subpages, such as an online shop’s basket, were accessed. The cookie allows both us and Google to determine whether someone who arrived through an AdWords advertisement generated revenue by completing a purchase or abandoned it. Google uses conversion-cookie information to compile website visit statistics. We use these to determine how many users were referred through AdWords advertisements, evaluate each advertisement’s success or failure and optimise future advertisements. Neither our company nor other Google AdWords advertising customers receive information from Google that would identify the data subject. The cookie stores personal information, such as websites visited. On each visit, personal data, including the IP address, is transmitted to Google in the United States, stored there and may be disclosed to third parties. As explained above, data subjects can permanently prevent cookies by adjusting browser settings, which also prevents Google from setting a conversion cookie. Existing Google AdWords cookies can be deleted through the browser or other software. Data subjects may object to Google’s interest-based advertising by visiting www.google.de/settings/ads in every browser they use and selecting their preferred settings. Further information and Google’s applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/.

20. Data protection provisions concerning Instagram. The controller has integrated Instagram components into this website. Instagram is an audiovisual platform allowing users to share photographs and videos and distribute them through other social networks. It is operated by Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA. Whenever a page containing an Instagram component (Insta button) is accessed, that component automatically causes the data subject’s browser to download its representation from Instagram. Through this technical process, Instagram learns which subpage is visited. If the data subject is logged in to Instagram at the same time, Instagram recognises the particular subpages visited whenever our website is accessed and throughout the visit. The component collects this information and associates it with the data subject’s Instagram account. If an integrated Instagram button is clicked, the transmitted information is assigned to their personal account and stored and processed by Instagram. The component informs Instagram of a website visit whenever the data subject is logged in at the time of access, regardless of whether they click it. A data subject who does not want this information transmitted can prevent transmission by logging out of Instagram before visiting our website. Further information and Instagram’s applicable privacy provisions are available at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

21. Data protection provisions concerning Pinterest. The controller has integrated components of Pinterest Inc. into this website. Pinterest is a social network: an online meeting place or community that generally allows users to communicate and interact virtually, exchange opinions and experiences, and provide personal or business-related information. Pinterest allows users, among other things, to publish image collections, individual images and descriptions on virtual boards (‘pinning’), which other users can share (‘repinning’) or comment on. It is operated by Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA. Whenever a page containing a Pinterest component (plug-in) is accessed, the component automatically causes the data subject’s browser to download its representation from Pinterest. Further information is available at https://pinterest.com/. Through this process, Pinterest learns which subpage is visited. If the data subject is logged in to Pinterest at the same time, Pinterest recognises the particular subpages visited whenever our website is accessed and throughout the visit. The component collects this information and associates it with the data subject’s Pinterest account. If an integrated button is clicked, Pinterest assigns this information to their personal account and stores the personal data. The component informs Pinterest of a visit whenever the data subject is logged in at the time of access, regardless of whether they click it. A data subject who does not want this information transmitted can prevent it by logging out of Pinterest before visiting our website. Pinterest’s privacy policy at https://about.pinterest.com/privacy-policy explains its collection, processing and use of personal data.

22. Data protection provisions concerning Twitter. The controller has integrated Twitter components into this website. Twitter is a multilingual, publicly accessible microblogging service on which users can publish and distribute short messages called tweets, limited to 140 characters. These messages can be accessed by anyone, including people not registered with Twitter. Tweets are also displayed to the user’s followers: other Twitter users who follow their messages. Hashtags, links and retweets also enable messages to reach a wider audience. Twitter is operated by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Whenever a page containing a Twitter component (button) is accessed, the component automatically causes the data subject’s browser to download its representation from Twitter. More information about Twitter buttons is available at https://about.twitter.com/de/resources/buttons. Through this process, Twitter learns which subpage is visited. The component is integrated to let users share our website’s content, raise awareness of the website online and increase visitor numbers. If the data subject is logged in to Twitter at the same time, Twitter recognises the particular subpages visited whenever our website is accessed and throughout the visit. The component collects this information and associates it with the data subject’s Twitter account. If an integrated button is clicked, the transmitted information is assigned to their personal account and stored and processed by Twitter. The component informs Twitter of a website visit whenever the data subject is logged in at the time of access, regardless of whether they click it. A data subject who does not want this information transmitted can prevent it by logging out of Twitter before visiting our website. Twitter’s applicable privacy provisions are available at https://twitter.com/privacy?lang=de.

23. Data protection provisions concerning YouTube. The controller has integrated YouTube components into this website. YouTube is an online video portal allowing publishers to upload video clips free of charge and other users to view, rate and comment on them free of charge. All types of videos may be published, including complete films and television programmes, music videos, trailers and user-created videos. YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Whenever a page containing a YouTube component (video) is accessed, it automatically causes the data subject’s browser to download its representation from YouTube. More information is available at https://www.youtube.com/yt/about/de/. Through this process, YouTube and Google learn which subpage is visited. If the data subject is logged in to YouTube at the same time, YouTube recognises the particular subpage when one containing a YouTube video is accessed. YouTube and Google collect this information and associate it with the data subject’s account. The component informs YouTube and Google of a website visit whenever the data subject is logged in at the time of access, regardless of whether they click a video. A data subject who does not want this information transmitted can prevent it by logging out of YouTube before visiting our website. YouTube’s privacy provisions at https://www.google.de/intl/de/policies/privacy/ explain the collection, processing and use of personal data by YouTube and Google.

24. Data protection provisions concerning GetClicky
This website uses Getclicky, a web analytics service provided by Roxr Software, Ltd (‘Getclicky’). Getclicky uses cookies: text files stored on your computer that enable analysis of your website use. Information generated by the cookie about your use, including your IP address, is transmitted to and stored on a Getclicky server in the USA. Getclicky uses it to evaluate website use, compile website activity reports for website operators and provide other services relating to website and internet use. Getclicky may also transmit it to third parties where legally required or where third parties process it on Getclicky’s behalf. Getclicky will never associate your IP address with other Getclicky data. You can prevent cookies being installed through browser settings, although you may then be unable to use all website functions in full. By using this website, you agree to Getclicky processing data collected about you in the manner and for the purposes described above.

25. Legal basis for processing
Article 6(1)(a) GDPR is the legal basis for processing for which our company obtains consent for a specific purpose. Where processing is necessary to perform a contract to which the data subject is a party, for example to supply goods or provide a service or consideration, processing is based on Article 6(1)(b) GDPR. This also applies to processing necessary for pre-contractual measures, such as enquiries about our products or services. Where our company is subject to a legal obligation requiring processing, for example tax obligations, processing is based on Article 6(1)(c) GDPR. In rare cases, processing may be necessary to protect the vital interests of the data subject or another natural person. For example, if a visitor were injured on our premises, their name, age, health insurance details or other vital information might need to be disclosed to a doctor, hospital or another third party. This would be based on Article 6(1)(d) GDPR. Finally, processing may be based on Article 6(1)(f) GDPR where none of the above grounds applies and processing is necessary for the legitimate interests of our company or a third party, provided the data subject’s interests, fundamental rights and freedoms do not override them. The European legislator specifically recognised such processing, noting that a legitimate interest may exist where the data subject is a customer of the controller (Recital 47, sentence 2, GDPR).

26. Legitimate interests pursued by the controller or a third party. Where processing is based on Article 6(1)(f) GDPR, our legitimate interest is conducting our business for the benefit of the wellbeing of all our employees and shareholders.

27. Period for which personal data is stored. The applicable statutory retention period determines how long personal data is stored. Once it expires, the data is routinely erased unless it is still required to perform or initiate a contract.

28. Statutory or contractual requirements to provide personal data; necessity for entering into a contract; the data subject’s obligation to provide personal data; possible consequences of not providing it. Providing personal data may be required by law, for example tax regulations, or arise from contractual arrangements, such as details of the contracting party. It may be necessary for a data subject to provide personal data for us to enter into a contract and subsequently process it. For example, the data subject must provide personal data when our company concludes a contract with them. Failure to provide it would mean that the contract could not be concluded. Before providing personal data, the data subject must contact our data protection officer, who will explain in the individual case whether provision is legally or contractually required or necessary to enter into the contract, whether there is an obligation to provide it and the consequences of failing to do so.

29. Automated decision-making. As a responsible company, we do not use automated decision-making or profiling. This privacy policy was prepared, among other sources, using the GDPR Privacy Policy Generator of the German Association for Data Protection, in cooperation with RC GmbH, which recycles used IT equipment and the law firm’s media law lawyers at WILDE BEUGER SOLMECKE | Rechtsanwälte.
Additional sources: GetClicky, eRecht24