Source: https://www.treuhand.de/zh/data-protection-and-legal-notes/
Timestamp: 2019-04-25 22:01:23+00:00

Document:
hereinafter collectively referred to as the person responsible. The aforementioned are solely responsible for the other processing of personal data.
The task of the German State’s Data Protection Commissioners (LfD) is to monitor compliance with data protection regulations both by the authorities and other public authorities as well as by commercial enterprises and other non-public bodies in Lower Saxony, thus ensuring the right to informational self-determination.
In principle, we only process our users’ personal data insofar as this is necessary, to provide a functioning website as well as our content and services. The processing of our users’ personal data only takes place on a regular basis with the consent of the user. An exception applies to cases, in which prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.
Insofar as we obtain the consent of the data subject for the processing of personal data, art. 6 sec. 1 lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
In the processing of personal data necessary for the performance of a contract to which the data subject is a party, art. 6 sec. 1 lit. b of the GDPR serves as the legal basis. This also applies to processing operations required to carry out precontractual measures.
Insofar as the processing of personal data is required to fulfill a legal obligation our company is subject to, art. 6 sec. 1 lit. c of the GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, art. 6 sec. 1 lit. d of the GDPR serves as the legal basis.
If processing is necessary to safeguard the legitimate interests of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not prevail over the former interest, art. 6 sec. 1 lit. f of the GDPR serves as the legal basis said processing.
If, in the context of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant access to the data, this will only be done on the basis of legal permission (e.g. if transmission of the data to third parties, such as to payment service providers, is required to fulfill the contract in accordance with art. 6 sec. 1 lit. b of the GDPR), you have consented, a legal obligation stipulates it or based on our legitimate interests (e.g. when using agents, web hosts, etc.).
If we commission third parties with the processing of data based on a so-called “Agreement on data processing”, this is conducted based on art. 28 of the GDPR.
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or do this in the context of using third party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfill our (pre)contractual obligations, based on your consent, based on a legal obligation or based on our legitimate interests. Subject to legal or contractual permissions, we only process or have the data processed in a third country if the special requirements pursuant to art. 44 ff. of the GDPR are met. That means processing takes place e.g. on the basis of specific guarantees, such as the officially recognised identification of an EU compliant data protection standard (e.g. for the US through the Privacy Shield) or in compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).
The data subject’s personal data will be erased or blocked as soon as the purpose of the storage is no longer given. Furthermore, such storage may take place if this is stipulated by the European or national legislative authorities in EU regulations, laws or other regulations to which the controller is subject. Blocking or erasure of the data also takes place if a retention period stipulated by the aforementioned standards expires, unless there is a need for the further storage of the data to conclude a contract or fulfill a contract. The data is blocked and not processed for other purposes. For instance, this applies to data, which must be retained for reasons subject to commercial or tax laws.
According to legal requirements, retention is, in particular, carried out for 6 years in accordance with § 257 sec. 1 of the German Commercial Code (HGB) (trading books, inventories, opening balance sheets, annual accounts, business letters, accounting records, etc.) and for 10 years in accordance with § 147 sec. 1 of the General Tax Code (AO) (books, records, management reports, accounting records, commercial and business letters, documents relevant to taxation, etc.).
We take appropriate technical measures in accordance with art. 32 of the GDPR, taking the best available technology, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different likelihood and severity of the risk to the rights and freedoms of natural persons into account and appropriate technical and organisational measures, to ensure a level of protection appropriate for the risk; in particular, measures include ensuring the confidentiality, integrity and availability of data by controlling physical access to the data as well as access it is affected by, input, disclosure, securing availability and its separation. Furthermore, we have established procedures, which ensure data subject rights being able to be exercised, data erasure and a reaction to data vulnerability. Moreover, we already consider the protection of personal data in the development phase or selection of hardware, software as well as procedures, according to the principle of data protection by technology design and by privacy-friendly default settings (article 25 of the GDPR).
In particular, the encrypted transfer of data between your browser and our server belongs to the security measures. This also applies to the transmission of emails between our server and our clients.
You can request a confirmation from the controller on whether or not we have processed your personal data.
You have the right to request information on whether or not your personal data is transmitted to a third country or an international organisation. In this context, you can request being informed about the appropriate guarantees in accordance with art. 46 of the GDPR in connection with the transmission.
This right of access can, insofar, be limited to the extent it is likely to render impossible or seriously affect the realisation of research or statistical purposes and the restriction is required to fulfil the research or statistical purposes.
You have a right to rectification and/or completion vis-á-vis the controller if your processed personal data is incorrect or incomplete. The controller must make the correction without delay.
Your right to rectification can, insofar, be limited to the extent it is likely to render impossible or seriously affect the realisation of research or statistical purposes and the restriction is required to fulfil the research or statistical purposes.
if you objected to processing pursuant to art. 21 sec. 1 of the GDPR and it is not yet determined whether the controller’s legitimate reasons override your reasons.
If the processing of your personal data has been restricted, this data can only be processed – with the exception of its storage – with your consent and for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural person or legal entity or for reasons of a significant public interest of the Union or of a Member State. If processing was restricted according to the preceding conditions, you will be informed by the controller before the restriction is lifted. Your right to restriction of processing can, insofar, be limited to the extent it is likely to render impossible or seriously affect the realisation of research or statistical purposes and the restriction is required to fulfil the research or statistical purposes.
Your personal data is no longer required for the purpose, for wich it was collected or otherwise processed.
You revoke your consent, wich was based on processing in accordance with art. 6 sec. 1 lit. a or 9 sec. 2 lit. a of theGDPR and there is no other legal basis for processing.
You object to processing in accordance with art. 21 sec. 1 of the GDPR and there are no overriding legitimate reasons for said processing or you object to processing in accordance with art. 21 sec. 2 of the GDPR.
Your personal data was processed illegally .
The erasure of your personal data is required to fulfill a legal Obligation under European Union law or the law of the Member States, wich the controller is subject to.
Your personal data was collected with regard to the offers of information society services in accordance with art. 8 sec. 1 of the GDPR.
If the controller publicised your personal data and is obligated to erase it in accordance with art. 17 sec. 1 of the GDPR, the controller will take appropriate measures taking the available technology and implementation costs into account, including technical means, to inform data controllers, which process the personal data, that you have requested them to erase all links pertaining to this personal data or copies or replications of this person data.
If you asserted the right to rectification, erasure or restriction of processing vis-á-vis the controller, the controller is obligated to notify all recipients, to which your personal data was disclosed, of this correction or erasure of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort.
You have the right to request the controller to inform you of these recipients.
processing is conducted using automated procedures.
In exercising this right, you also have the right to initiate that your personal data is directly transmitted to another controller by a controller, insofar as this is technically feasible. The freedoms and rights of other persons can not be affected by this.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or which takes place in exercising official authority, which was delegated to the controller.
You have the right to object to the processing of your personal data at any time for reasons that arise from your particular situation and which is carried out in accordance with art. 6 sec. 1 lit. e or f of the GDPR; this also applies to a profiling based on these provisions.
The controller will no longer process your personal data unless it can verify compelling grounds for processing worthy of protection, which override your interests, rights and freedoms or processing serves asserting, exercising or defending legal claims.
If your personal data is processed to engage in direct advertising, you have the right to object to this processing of your personal data for the purpose of such advertising at any time; this also applies to profiling, insofar as it is associated with such direct advertising.
Regardless of Directive 2002/58/EC, you have the option, in connection with the use of information society services, of exercising your right to object using automated procedures, which apply technical specifications.
You also have the right, for reasons that arise from your particular situation, to object to the processing of your personal data, which takes place for scientific or historical research purposes or for statistical purposes in accordance with art. 89 sec. 1 of the GDPR.
Your right to object can, insofar, be limited to the extent it is likely to render impossible or seriously affect the realisation of research or statistical purposes and that the restriction is required to fulfil the research or statistical purposes.
You have the right to revoke your consent in line with data privacy at any time. The revocation of consent does not affect the legality of processing conducted based on consent until the revocation has been effected.
take place with your explicit consent.
However, these decisions cannot be based on special categories of personal data according to art. 9 sec. 1 of the GDPR, unless art. 9 sec. 2 lit. a or g of the GDPR applies and reasonable measures have been taken to protect the rights and freedoms as well as your legitimate interests.
Regarding the cases referred to in (1) and (3), the controller will take appropriate measures to uphold the rights and freedoms and your legitimate interests, which at least include the right to obtain the intervention of an individual on the part of controller, to express one’s own position and be heard on contesting the decision.
Regardless of any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular, in the Member State of your abode, place of work or place of alleged violation if you believe, that the processing of your personal data violates the GDPR.
The supervisory authority the complaint was lodged with must inform the complainant of the status and results of the complaint including the possibility of a judicial remedy in accordance with art. 78 of the GDPR.
Our website is provided by our provider, with whom we have concluded a job processing contract. They provide us with infrastructure, storage space on the web server and technical support for the website.
Every time our website is called up our server automatically records data and information from the computer system of the computer making the call.
Information about the browser type, the version used and the user’s operating system.
In the case of a security-relevant incident all headers of the http communication between the browser and server, as well as the contents sent back to the server answer, will also be logged.
The data will also be stored in our system’s logfiles. This data will not be stored together with user personal data.
The legal basis for temporary storage of data and logfiles is Art. 6 (1) f of the GDPR.
It is necessary for the system to store the IP address temporarily so as to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address has to be stored for the duration of the session.
This storage is made in logfiles so as to ensure the functionality of the website. We also use the data to optimise the website and to ensure the security of our information technology systems. This data will not be evaluated for marketing purposes.
Our legitimate interest in these purposes can also be found in Art. 6 (1) f of the GDPR.
Data will be erased as soon as it is no longer required for the purpose of its collection. If data is recorded to provide the features of the website, this data be the erased once the relevant session has been ended.
If data is recorded in logfiles, this will be the case after fourteen days at the latest. Storage beyond this period is possible. In this case users’ IP addresses will be erased or masked so that no allocation to the client will be possible.
Recording data to provide the website and storing the data in logfiles is essential for operating the website. The user cannot object to this.
We use so-called session cookies, which are only placed for the duration of the current visit to our website.
This is necessary in order to realise the functionality of our website. For example, this is the only way to enable your login status to be stored or the shopping basket to be provided and thus to use our online range at all.
A randomly generated, clear identification number will be placed in a session cookie, a so-called session ID. A cookie also includes disclosures about its origin and the duration of storage. These cookies cannot store any other data. Session cookies will be erased once you end your use of our online range and e.g. log out or close the browser.
The user data collected in this manner is pseudonymised through technical precautions.
The legal basis for processing personal data when using technically necessary cookies is Art. 6 (1) f of the GDPR.
The legal basis for processing personal data when using cookies for analysis purposes is the existence of the user’s consent as per Art. 6 (1) a of the GDPR.
User data collected by technically necessary cookies will not be used to generate user profiles.
Analysis cookies are used for the purpose of improving the quality of our website and its contents. Through analysis cookies we find out how the website is used and can thus continuously optimise our range. We use the analysis software Matomo for this purpose.
Our legitimate interest in processing personal data can also be found in Art. 6 (1) f of the GDPR.
We use “Google Analytics” on our website. Google has been commissioned to evaluate the use of our online range by users, to compile reports about activities within this online range and to provide additional services to us connected with the use of this online range and internet use. In the process, pseudonymised use profiles can be made for users from the processed data. To do this Google places a cookie on the user’s system. The information generated by the cookie about use of the online range by the user is usually sent to a Google server in the USA and stored there.
We use Google Analytics with activated IP anonymisation. This means, the user’s IP address will be shortened by Google within member states of the European Union or in other contracting states to the European Economic Area. The full IP address will only be transmitted to a Google server in the USA and shortened there in exceptions.
The legal basis for processing personal data is Art. 6 (1) f of the GDPR.
Google is certified under the Privacy Shield Framework and thus offers a guarantee that it complies with European data protection law.
Processing users’ personal data enables us to analyse the surfing behaviour of our users. By evaluating the data we have acquired, we are in a position to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user friendliness. Our legitimate interest in processing data for these purposes can also be found in Art. 6 (1) f of the GDPR. By anonymising the IP address users’ interests in protecting their personal data are sufficiently taken into account.
Google will erase or anonymise the user’s personal data after 14 months.
On our website we offer users the possibility to opt out from the analysis procedure. This sets another cookie on your system which then signals to Google that is must not store the user’s data. If the user has since erased this cookie from their own system, they will have to set the opt-out cookie again.
You will find the Google plugin here: http://tools.google.com/dlpage/gaoptout?hl=de.
policies.google.com/technologies/ads and in the setting for displaying advertising inserts by Google adssettings.google.com/authenticated.
We operate a fan page on the social network Facebook and access the technical platform and services of Facebook to do so.
We must point out that you use our Facebook fan page and its functions at your own risk. This applies in particular to use of the interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also call up the information offered on this site on our internet range at treuhand.de.
We process Facebook Insights data in our Facebook presence. This is statistical data such as the total number of calls of the site, “likes”, site activities, contribution interactions, video views, contribution reach, comments, shared contents, answers, the proportion of men and women, origin related to country, town/city and language. We do not have any influence on the data provided.
We use the data provided by Facebook to make our contributions more attractive, to address target groups directly and to find the right point in time for publication.
We use Facebook Insights data as per Article 6 (1) f of the GDPR.
You will find additional information in the privacy information from Facebook at: facebook.com/help/568137493302217 and information about page insights data at facebook.com/legal/terms/information_about_page_insights_data .
The manner in which Facebook uses data from visits to Facebook pages for its own purposes, the scope with which activities on Facebook can be attributed to individual users, how long Facebook stores this data and whether data from a visit to Facebook is transferred to third parties has not been clearly and conclusively specified by Facebook and is not known to us.
When accessing a Facebook page, the IP address allocated to your terminal will be transmitted to Facebook. According to information from Facebook, these IP addresses will be anonymised and erased after 90 days. Facebook also stores data about its users’ terminal (e.g. using the function “Login alerts”); this may make it possible for Facebook to attribute IP addresses to individual users.
If you are currently logged in to Facebook as a user, there will be a cookie on your terminal with your Facebook identifier. This puts Facebook in a position to trace that you have visited this page and how you used it. This also applies to all other Facebook pages. Advertising and content tailored to you can be offered on the basis of this data.
If you want to prevent this, you should log out of Facebook or deactivate the function “stay logged in”, erase the cookies on your terminal, close your browser and restart. In this manner Facebook will erase information that can be used to identify you directly. So you can use our Facebook page without your Facebook identifier being disclosed. If you access interactive functions of the page (like, comment, share, news etc.), a Facebook login screen will appear. After logging in you will once again be recognisable to Facebook as an identifiable person.
You will find information about how you can administer or erase available information on the following Facebook support pages:facebook.com/about/privacy#.php.
There is a contact form on our website that can be used to make contact electronically. If the user makes use of this possibility, all the data entered in the relevant screen will be transmitted to us and stored.
Alternatively, it is possible to make contact using the email address provided. In this case the user’s personal data transmitted with the email will be stored.
No data will be transferred to third parties in this connection. The data will be used exclusively to process the conversation.
The legal basis for processing this data is the existence of the user’s consent as per Art. 6 (1) a of the GDPR.
The legal basis for processing the data transmitted when sending an email is Art. 6 (1) f of the GDPR. If the aim of the email contact is to conclude a contract, an additional legal basis for this processing is Art. 6 (1) b of the GDPR.
The collection of the user’s email address is intended to deliver the newsletter.
The collection of any other personal data as part of the login procedure is intended to prevent any misuse of the services or the email address used and as proof that you have subscribed to the newsletter.
Data will be erased as soon as it is no longer required for the purpose of its collection. Accordingly, the user’s email address will be stored for as long as the newsletter subscription is active. Due to the burden of proof this also applies to any other personal data collected as part of the login procedure.
Your consent will be obtained for the processing of your data during the registration process and reference will be made to this data protection declaration.
No data will be passed on to third parties in connection with data processing for the dispatch of newsletters. The data will be used exclusively for sending the newsletter.
Data subjects can cancel a subscription to the newsletter at any time. There is a link for this purpose in every newsletter. This also withdraws consent to the storage of personal data collected during the login procedure.
Within our online range we use third-party provider offers so as to include their contents and services, such as fonts, graphics, videos, maps, information etc. When calling up our website your browser will make a direct connection with the third-party provider’s servers so as to display the necessary contents. As a result, the corresponding third-party provider will receive information about the time and contents of use of this website, including users’ IP addresses. Depending on the service, additional information (e.g. geo-data for a route planner) may also be transmitted to the third-party provider.
We do not have any influence over the scope, further processing or use of data collected by third-party providers.
We refer to the third-party provider privacy policies for the concrete scope of data processing.
The legal basis for processing this data is Art. 6 (1) f of the GDPR. Third-party providers that process data outside the EU, process it in accordance with the Privacy Shield Framework.
The purpose of data collection and further processing of the data can be taken from the third-party providers’ privacy policies.
The duration of storage of the data can be taken from the third-party providers’ privacy policies.
We refer to the third-party providers’ privacy policies for the possibility to object and for rectification.

References: art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 28
 art. 44
 § 257
 § 147
 art. 32
 art. 46
 art. 21
 art. 6
 art. 21
 art. 21
 art. 8
 art. 17
 art. 6
 art. 89
 art. 9
 art. 9
 art. 78
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6