Source: http://bratzler.com/index.php?article_id=11&clang=1
Timestamp: 2019-04-20 22:10:41+00:00

Document:
Our web site contains links to other web sites. We does not accept any responsibility for the content of these links or the protection of personal data on these web sites. Bratzler & Co. GmbH will not assume any liability whatsoever for any damage resulting directly or indirectly from the use, misuse or the functionality of this www server. Bratzler & Co. GmbH cannot give any guarantee concerning the accuracy or completeness of texts, graphics, links, other data and representations on this www server.
1.1.	Data protection is especially important to Bratzler.
Any data subject can contact our data protection officer at any time if they have any questions or remarks regarding data privacy.
4.2.	In order to guarantee this, we would like to explain the terms used beforehand. The terms used, such as “personal data” or its “processing”, are defined in Art. 4 of the General Data Protection Regulation (GDPR).
Personal data is all information that relates to an identified or identifiable natural person (hereinafter referred to as “data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, particularly via allocation to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific features that express the physical, physiological, genetic, psychological, economic, cultural, or social identity of this person.
A data subject is any identified or identifiable natural person whose personal data is processed by the party responsible for the processing.
Processing is any process or any such sequence of processes that takes place with or without the aid of automated procedures and is related to personal data, such as collection, logging, organisation, sorting, storage, adjustment or modification, reading, requesting, use, disclosure by transmission, distribution or any other form of provision, comparison or linking, restriction, deletion, or erasure.
Restriction of processing is the marking of stored personal data with the objective of restricting its future processing.
Profiling is any type of automated processing of personal data that consists of this personal data being used in order to evaluate certain personal aspects related to a natural person, particularly with the aim of analysing or predicting aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behaviour, place of residence, or location changes of this natural person.
Pseudonymisation is the processing of personal data in a manner in which the personal data can no longer be matched with a specific data subject without the involvement of additional information, provided that this additional information is stored separately and technical and organisational measures are in place that guarantee that the personal data cannot be matched with an identified or identifiable natural person.
The controller or party responsible for the processing is the natural or legal person, authority, organisation, or other body that decides on the purpose and means of the processing of personal data, alone or together with others. If the purpose and means of this processing are set by Union law or the law of the member states, the specific criteria of their designation can be set for the controller(s) in accordance with Union law or the law of the member states.
The processor is a natural or legal person, authority, organisation, or other body that processes personal data on behalf of the controller.
A recipient is a natural or legal person, authority, organisation, or other body that personal data is disclosed to, regardless of whether it is a third party or not. Authorities that may receive personal data within the framework of a specific investigation mandate in accordance with Union law or the law of the member states, however, are not considered recipients.
A third party is a natural or legal person, authority, organisation, or other body apart from the data subject, controller, processor, and the people who are authorised to process the personal data under the direct responsibility of the controller or the processor.
Consent is any declaration of will submitted by the data subject voluntarily, in an informed manner and unambiguously, in the form of a declaration or another clear confirmatory action with which the data subject indicates that it agrees to the processing of its personal data.
We generally only collect and use personal data of our users if this is necessary for the provision of a functioning website and our content and services. The collection and use of personal data of our users usually only takes place with the consent of the user. An exception applies in cases in which the prior acquisition of consent is not possible for practical reasons, and the processing of the data is permitted by statutory provisions.
5.2.1.	If we obtain consent from the data subject for personal data processing operations, Art. 6(1)(a) GDPR serves as the legal basis.
5.2.2.	During the processing of personal data that is necessary for the performance of a contract of which the data subject is a contracting party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies for processing operations that are necessary for the implementation of precontractual measures.
5.2.3.	If the processing of personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
5.2.4.	In the case that vital interests of the data subject or another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.
5.2.5.	If the processing is necessary for the protection of a legitimate interest of our company or a third party and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the first-named interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
5.3.1.	The personal data of the data subject is erased or blocked as soon as the purpose of the storage ceases to apply. Storage can additionally take place if this has been provided by the European or national legislators in Union law regulations, laws, or other provisions to which the controller is subject.
5.3.2.	A blockage or erasure of the data will take place if a storage period provided by the named standards expires, unless it is necessary to continue to store the data for the conclusion or performance of a contract.
6.1.1.	Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
6.1.3.	The data is also stored in log files in our system. This data is not stored together with other personal data of the user.
6.1.4.	The data is also stored in the log files of our system. This does not concern the IP address of the user or other data that enables the data to be matched with a user. This data is not stored together with other personal data of the user.
6.2.1.	The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR.
6.4.	The temporary storage of the IP address by the system is necessary to enable the website to be supplied to the computer of the user. For this purpose, the IP address of the user must be stored for the duration of the session.
6.5.	Storage in log files takes place in order to ensure the functionality of the website. In addition, the data enables us to optimise the website and ensure the security of our information technology systems. In this respect, the data is not analysed for marketing purposes.
6.6.	Another one of these purposes is our legitimate interest in data processing in accordance with Art. 6(1)(f) GDPR.
6.8.	The data is deleted as soon as it is no longer required to achieve the purpose of its collection. In the case of the logging of the data for the provision of the website, this is the case when the respective session has ended.
6.9.	In the case of the storage of the data in log files, this is the case after 30 days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or distorted, so that a match with the accessing client is no longer possible.
The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. As a result, it is not possible for the user to object.
7.1.1.	On the basis of our legitimate interests, we use the possibility of contacting us via email on this website.
7.1.2.	It is possible to contact us via the email address provided. In this case, the personal data of the user sent with the email will be stored.
7.1.3.	In this respect, no data is passed on to third parties. The data is only used to process the conversation.
7.2.1.	The legal basis for the processing of the data that is sent in the course of an email transmission is Art. 6(1)(f) GDPR. If the email contact is aimed at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis for the processing.
7.3.1.	In the case of contact via email, this also includes the necessary legitimate interest in the processing of the data.
7.4.1.	The data will be deleted as soon as it is no longer required to achieve the purpose of its collection. For the personal data that is sent via email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be gathered from the circumstances that the issue in question has been conclusively clarified.
7.5.1.	The user has the right at any time to withdraw its consent to the processing of the personal data. If the user contacts us via email, it can object to the storage of its personal data at any time. In such a case, the conversation cannot be continued.
7.5.2.	All personal data that is stored in the course of the contact will be erased in this case.
8.1.1.	On the basis of our legitimate interests, we use the Google Maps service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”).
8.1.2.	Google Maps is an online map service provided by Google. The Earth’s surface can be seen as a roadmap, or as an aerial or satellite image.
8.1.3.	The use of the service takes place to include map data on our webpages. The inclusion of Google Maps is carried out via a server request to Google via an interface, the Google Maps API.
8.1.4.	When accessing a page on our website in which an according map section has been included, a request is sent to a Google server in the USA, where it is stored and processed. Via the use of Google Maps, the Google servers send data to the browser of the user to present map information.
8.1.5.	Google is certified under the terms of the Privacy Shield agreement and hereby offers a guarantee that European data protection law is obeyed (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
8.1.6.	Further information about the Google Maps service can be found at https://support.google.com/maps/.
The legal basis for the processing of the personal data of the user is Art. 6(1)(f) GDPR.
8.3.1.	The data processing takes place in the interest of the analysis, optimisation, and economic operation of the website, in order to include content or service offers of third parties and their content and services.
8.3.2.	We use Google Maps to include verified map data on our website.
8.4.1.	The data will be erased as soon as it is no longer necessary for our recording purposes.
8.5.1.	Further information about data use by Google, and setting and objection possibilities, can be found on the Google websites https://www.google.com/intl/en/policies/privacy/partners (“How Google uses information from sites or apps that use our services”), http://www.google.com/policies/technologies/ads (“Advertising”), http://www.google.com/settings/ads (“Managing information that Google uses in order to show you advertisements”).
9.1.1.	You can request that the controller confirms to you whether personal data concerning you is processed by us.
(8)	the existence of an automated decision-making process including profiling in accordance with Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, and the scope and intended effects of such processing for the data subject.
9.1.3.	You have the right to request information about whether the personal data concerning you is sent to a third country or an international organisation. In this respect, you can request that you be informed about the suitable guarantees in accordance with Art. 46 GDPR in connection with the transfer.
9.2.1.	You have a right to rectification and/or completion by the controller, if the processed personal data concerning you is incorrect or incomplete. The controller must carry out the rectification immediately.
(4)	if you have objected to the processing in accordance with Art. 21(1) GDPR and it is not yet certain whether the legitimate interests of the controller override your rights.
9.3.2.	If the processing of the personal data concerning you has been restricted, this data may only be processed – apart from its storage – with your consent or for the assertion, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of an important public interest of the Union or a member state.
9.3.3.	If the restriction of the processing in accordance with the above requirements has been restricted, you will be informed by the controller before the restriction is lifted.
(1)	The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
(2)	You withdraw your consent on which the processing in accordance with Art. 6(1)(a) or Art. 9(2)(a) GDPR is based, and there is no other legal basis for the processing.
(3)	You object to the processing in accordance with Art. 21(1) GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing in accordance with Art. 21(2) GDPR.
(5)	The erasure of the personal data concerning you is necessary for the fulfilment of a legal obligation in accordance with Union law or the law of the member states to which the controller is subject.
(6)	The personal data concerning you has been collected in relation to the offer of information society services in accordance with Art. 8(1) GDPR.
If the controller has made the personal data concerning you public and is obliged to erase it in accordance with Art. 17(1) GDPR, it will take appropriate measures, including measures of a technological nature, in consideration of the available technology and the implementation costs, in order to inform parties responsible for the data processing, which process the data, that you as the data subject have requested from them the erasure of all links to this personal data, or copies or replications of this personal data.
(5)	for the assertion, exercise, or defence of legal claims.
9.7.1.	If you have exercised the right to rectification, erasure, or restriction of the processing vis-à-vis the controller, the controller is obliged to inform all recipients to whom the personal data concerning you has been disclosed of this rectification or deletion of the data or restriction of the processing, unless this proves to be impossible or is associated with a disproportionate effort.
9.7.2.	You have the right to be informed by the controller about these recipients.
(2)	the processing takes place with the aid of an automated process.
9.8.2.	In exercising this right, you also have the right to arrange for the personal data concerning you to be transferred directly from one controller to another controller, provided that this is technically feasible. Freedoms and rights of other people may not be impaired by this action.
9.8.3.	The right to data portability does not apply for the processing of personal data that is necessary for the performance of a task that is in the public interest or takes place in the exercise of public authority that has been assigned to the controller.
10.1.	You have the right, for reasons resulting from your particular situation, to object at any time to the processing of the personal data concerning you that takes place in accordance with Art. 6(1)(e) or (f); this also applies for profiling based on these provisions.
10.2.	The controller will no longer process the personal data concerning you unless it can prove compelling reasons for the processing that are worth protecting and override your interests, rights, and freedoms, or the processing is for the assertion, exercise, or defence of legal claims.
10.3.	If the personal data concerning you is processed for direct advertising purposes, you have the right at any time to object to the processing of the personal data concerning you for the purpose of such advertising; this also applies for the profiling if it is related to such direct advertising.
10.4.	If you object to the processing for the purposes of direct advertising, the personal data concerning you will no longer be processed for these purposes.
10.5.	You have the opportunity, in relation to the use of information society services – irrespective of Directive 2002/58/EC – to exercise your right to object via an automated process in which technical specifications are applied.
You have the right at any time to withdraw your declaration of consent given under data protection law. The withdrawal of consent will not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.
(3)	takes place with your explicit consent.
12.1.	However, these decisions may not be based on specific categories of personal data in accordance with Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to protect the rights and freedoms, as well as your legitimate interests, have been taken.
12.2.	Regarding the cases named in (1) and (3), the controller takes suitable measures in order to protect the rights and interests, as well as your legitimate interests, which include at least the right to effect the intervention of a person by the controller, to state one’s own point of view, and to contest the decision.
13.2.	legal remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your place of residence, your place of work or the location of the suspected violation, if you are of the opinion that the processing of the personal data concerning you violates the GDPR.
13.3.	The supervisory authority to which the complaint is submitted will inform the complainant about the status and the outcome of the complaint, as well as the possibility of legal remedy in accordance with Art. 78 GDPR.
The data processing is based on your request and is legally determined under § 26 of the German Federal Data Protection Act, BDSG, for the purposes mentioned in processing your application.
Your personal data is not disclosed to third parties.

References: Art. 4
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78
 § 26