Source: https://www.centurion.de/en/privacy-policy-146
Timestamp: 2019-04-24 00:51:43+00:00

Document:
Merida & Centurion Germany GmbH (hereinafter referred to as “MCG” or “we”) is pleased to welcome you to our website www.merida-bikes.com (hereinafter also referred to as “our website”). The following paragraphs are intended to inform you about how we process your personal data when you use our website.
According to the GDPR, personal data covers all information that refers to an identified or identifiable natural person. This means information such as your name, date of birth, address, e-mail address, IP address, telephone number and your user behaviour. In contrast, information that cannot be directly connected to your true identity – such as generally preferred websites by all users or the number of users on a page – is not considered personal data.
The person concerned is each identified or identifiable natural person whose personal data will be processed by the party responsible for processing data.
Processing is any procedure executed with or without the assistance of automated processes or any series of procedures performed in conjunction with personal data, such as collecting, recording, organising, filing, saving, adapting or changing, exporting, querying, using, disclosing personal data by transmitting, distributing or any other form of provision, comparing or linking, restricting, deleting or destroying said data.
Restricting the processing of data means highlighting stored personal data with the goal of restricting its processing in the future.
The responsible party is the natural person or legal entity, authority, institution or other office that, alone or together with others, makes decisions regarding the purposes and means of processing personal data. If the purposes and means of processing said data are specified by Union law or the rights of the Member States, the responsible party(ies) can stipulate the specific criteria for his/her appointment according to Union law or the rights of the Member States.
A processor is a natural person or legal entity, authority, institution or other office that processes personal data on behalf of the responsible party.
The recipient is a natural person or legal entity, authority, institution or other office to whom the personal data is disclosed, regardless of whether it is a third party or not. However, authorities that may receive personal data as part of a specific investigative order in accordance with Union law or the rights of Members States shall not be considered as recipients.
A third party is a natural person or legal entity, authority, institution or other office, not including the person concerned, the responsible party, the processor and persons under the direct supervision of the person in charge or the processor, who is authorized to process the personal data.
Consent is any declaration of intention in the form of a declaration or other clear confirmation of treatment voluntarily issued by the person concerned in an informed and unmistakable manner for the specific situation in which the person concerned makes clear that he/she consents to have his/her relevant personal data processed.
In principle, we collect and use the personal data of our users only as much as is necessary to provide a functional website as well as our content and services. The collection and use of your personal data is usually done only with your consent. However, one exception applies in such cases in which prior receipt of consent is not possible for actual reasons and processing the data is nevertheless permitted by legal regulations.
The data transmitted by you or collected are collected, used, processed and saved exclusively under the data protection laws (GDPR, Federal Data Protection Act and the Telemedia Act) in effect and, if applicable forwarded to third parties – to the extent legally specified, contractually necessary or permitted as part of the legal bases presented below.
1. Art. 6 Para. 1 a) GDPR is the legal basis for personal data processing procedures if the person concerned has given his/her consent.
2. Art. 6 Para. 1 b) GDPR is the legal basis for processing personal data that is necessary to comply with a contract and whose contractual party is the person concerned. This legal basis also refers to those processing procedures that are necessary to carry out pre-contractual actions.
3. If we have to process personal data to meet a legal obligation of our company, then Art. 6 Para. 1 c) GDPR is the legal basis for this.
4. Art. 6 Para. 1 d) GDPR serves as the legal basis if vital interests of the person concerned by the data processing or another natural person make it necessary to process their personal data.
5. If the processing of personal data is necessary to protect a justified interest of our company or a third party and, in the process, the interests, fundamental rights and freedoms of the person concerned do not outweigh this initial interest of our company, or the interest of a third party, then processing is carried out on the legal basis stated in Art. 6 Para. 1 f) GDPR.
As soon as the purpose for storing the respective personal data of the person concerned no longer exists, these data are deleted or blocked. Nevertheless, storage can extend beyond this time frame if a legal basis for this was intended in European or national directives, laws or other provisions that we, as the responsible party for data processing, are subject to. Data are also blocked or deleted if a storage period specified by the standards mentioned expires, unless there is a need to further store such data for concluding a contract or fulfilling a contract.
It is generally not necessary to enter your personal data to visit and use our website for informational purposes only. Rather, we automatically collect, use and store information sent to us by the respective browser during your visit to our website in the server log files.
The data are stored in our system's log file. We do not store this data together with the user's other personal data, such as name, address, telephone number or e-mail address.
The legal basis for this temporary storage of data and the log files is Art. 6 Para. 1 f) GDPR (see above III. (2) 5.) because our justified interests – as presented in the following – in storing this data outweigh your interests, fundamental rights and freedoms: The IP address is considered personal data. The temporary storage of the IP address by the system is necessary to enable the transmission of our website to your browser. To this end, the IP address must remain stored for the remainder of the session. Log files are stored to ensure the functionality of our website. The data are also used to optimize our website and ensure the security of our information technology systems. The data are not analysed for marketing purposes in this context.
The data are deleted as soon as they are no longer needed to achieve the purpose for which they were collected in the first place. If the data are collected to make our website available, this is the case if the respective session is ended. If the data were stored in the log files, this is the case no later than after 30 days. However, storage above and beyond this is also possible. In this case, however, your IP address is deleted or distorted so that it can no longer be assigned to your person.
The collection of data to access our website and store the data in the log files is absolutely necessary for operating the website. There is consequently no option to object in this case.
You can contact us using the e-mail addresses provided vertrieb@merida-centurion.com, marketing@merida-centurion.com and service@merida-centurion.com. In this case, your personal data transmitted with the e-mail will be stored in our system.
The legal basis for processing the data is, if and as long as your consent is available, Art. 6 Para. 1 lit. a) GDPR (see above III. (2) 1.).
The legal basis for processing the data that is transmitted as part of a sent e-mail is additionally Art. 6 Para. 1 lit. f) GDPR (see above III. (2) 5.). If the e-mail contact is already targeting the conclusion of an agreement, then Art. 6 Para. 1 lit. b) GDPR (see above III. (2) 2.) is also an additional legal basis for processing.
Processing personal data from an e-mail sent to us is used solely to process the contact. This also covers the necessary justified interest in processing the data if they are processed based on Art. 6 Para. 1 f) GDPR.
The data are deleted as soon as they are no longer needed to achieve the purpose they were collected for in the first place. For personal data that was sent via e-mail, this is then the case if the respective conversation with the user is over. The conversation is over when it is understood from the circumstances that the relevant matter has been conclusively clarified.
You have the option of revoking your consent to have your personal data processed at any time. If you contact us using the e-mail contact form, you can request that your personal data no longer be stored. In such a case, however, the conversation cannot be continued. All personal data that was saved during the e-mail contact process will be deleted in this case.
In order to protect your transmitted data, we use SSL encryption. You can identify this type of encrypted connection with the prefix “https://” in the page link in your browser’s URL line. All data that you transmit to our website – for example when using our contact forms – cannot be read by third parties thanks to SSL encryption.
We use technologically necessary cookies to make our website more user-friendly. Several elements from our website require that the browser accessing the site can also be identified after changing pages.
The user data collected by technologically necessary cookies is not used to create user profiles.
(1) Our website uses Google Analytics, a web analysis service of Google Inc. (“Google”). Google Analytics uses “cookies” or text files that are stored on your computer which facilitate an analysis of how you use our website.
(2) The information on your use of our website generated by the cookie is generally transmitted (including your IP address) to a Google server in the U.S. and stored there. However, we have activated IP anonymisation: On our website www.merida-bikes.com, Google Analytics added the code “gat._anonymizeIp();” to ensure an anonymised collection of IP addresses (IP masking), thus ruling out direct reference to particular persons. If your personal data collected identifies you, this is immediately excluded and the personal data therefore promptly deleted. Activating the IP anonymisation function on our website results in the shortening of your IP address by Google in the Member States of the European Union or in other treaty states of the European Economic Area Agreement. Only in exceptional cases is the complete IP address sent to a Google server in the U.S. and shortened there. On behalf of the operator of this website, Google uses this information to analyse your website use so that it can then compile reports on the website activities and render additional associated services to the website operator regarding website and Internet use. We have signed an order processing agreement with Google regarding this.
(3) The IP address transmitted by Google Analytics from your browser is not merged with other Google data. However, if applicable, Google will transmit this information to third parties as long as this is legally required or to the extent that third parties process these data on behalf of Google.
(4) You can prevent cookies from being stored by setting your browser software accordingly; however, we will point out that if you do so, you may no longer be able to use all functions on this website to their full extent. Furthermore, you can prevent the collection of data generated by the cookie and that draws on your use of the website (incl. your IP address) going to Google as well as Google’s processing of these data by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
(5) If you use a mobile application – such as a tablet or smart phone – the browser plug-in does not work. However, you can nevertheless prevent your data from being collected by Google Analytics by clicking the link "Deactivate Google Analytics" below. This sets an opt-out cookie that prevents your data from being collected when you visit this website in the future.
(6) We use Google Analytics to be able to analyse and regularly improve the use of our website. The statistics we receive help us improve our products and services and make them more interesting for you as a user. For the exceptional cases in which your personal data is transmitted to the U.S., Google is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 Para. 1 S. 1 lit. f GDPR.
(7) Third-party information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User terms and conditions: http://www.google.com/analytics/terms/de.html, overview on data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, as well as the privacy statement: http://www.google.de/intl/de/policies/privacy.
We use the services of Google Maps on our website. This allows us to directly provide a partner search function based on postal codes and enables you to conveniently use this map function.
When you use Google Maps, Google is notified that you have accessed the corresponding sub-page of our website. Moreover, the data mentioned under IV of this privacy statement are transmitted to Google. This occurs regardless of whether Google has provided a user account that you are logged into or no user account exists.
When you are logged into Google, your data are directly allocated to your account. If you do not want them to be allocated to your Google account, you have to log off before activating the button.
So that you can use Google Map services, Google Maps needs your IP address. You cannot use these services unless it is forwarded. Our interest is increasing user-friendliness on our website. If you use the service to search for a partner, the use of your IP address is also in your initial interest according to Art. 6 lit. f) GDPR (see above III. (2) 5.).
However, Google also stores your data as a user profile and uses it for advertising, market research purposes and/or the needs-based design of its website. Such an analysis is performed (even for users not logged in) to provide needs-based advertising and to inform other users of the social network regarding your activities on our website.
You have the right to object to the creation of these user profiles, although you have to assert this right with Google [see also below (e)]. We have no influence on Google’s processing of data.
We cannot make any statements regarding any deletion of data that is collected by Google.
You have the right to object to the creation of user profiles mentioned above under (c), although you have to assert this right directly with Google.
Information on the purpose and scope of the data collection and its processing by the plug-in supplier can be obtained from the privacy statement of the supplier. It will provide you with more information on your privacy rights and settings options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the U.S. and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
We've included YouTube videos in our online offering, which are stored on http://www.YouTube.com and are directly playable from our website.
When you use YouTube, Google is notified that you have accessed the corresponding sub-page of our website. Moreover, the data mentioned under IV of this privacy statement are transmitted to Google. This occurs regardless of whether Google has provided a user account that you are logged into or no user account exists.
So that you can use YouTube services, Google needs your IP address. You cannot use these services unless it is forwarded. Our interest is increasing user-friendliness on our website. If you use the service to search for a partner, the use of your IP address is also in your initial interest according to Art. 6 lit. f) GDPR (see above III. (2) 5.).
This page uses so-called web fonts supplied by Google to ensure the fonts are uniformly displayed.
When accessing a page, your browser loads the necessary web fonts in your browser cache in order to correctly display texts and fonts. At this time, the browser you are using must connect to the Google servers. In doing so, Google obtains the information that our website was accessed through your IP address. According to the privacy statement information on Google under https://developers.google.com/fonts/faq, this information is not mapped as part of your other Google services.
The legal basis for using Google fonts is Art. 6 Para. 1 lit f) GDPR.
Google web fonts are used in the interest of a uniform and appealing display of our online products and services. This presents a justifiable interest as defined by Art. 6 Para. 1 lit. f GDPR.
If you want to prevent the use of Google fonts, you would need to use a different browser or an older version of the above.
For more information on Google web fonts, please visit https://developers.google.com/fonts/faq and review the Google privacy statement: https://www.google.com/policies/privacy/.
On our website, there is currently no possibility to subscribe to a free newsletter.
On our website, we have inserted links to our respective profiles on Facebook, Twitter and Xing. By clicking on the respective icon, you can navigate to our profiles on the desired social media platforms.
When you click on these links, none of your data is transmitted to the operator of the respective social media platform. If you click on one of these links, you will be directed to the respective social network website. Depending on your browser, this happens by opening a new tab or pop-up. The operator of the respective network does not collect or process your data until the URL changes.
In the privacy statement provisions of these social networks, you will find information on protecting and managing your data.
For more detailed information on Facebook, click on this link: https://www.facebook.com/about/privacy/update?ref=old_policy.
For more detailed information on Twitter, click on this link: https://twitter.com/de/privacy.
More information on the purpose and scope of data collection and processing by YouTube can be found in the privacy statement. There, you can find additional information on your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the U.S. and is now subject to the EU-US Privacy Shield, see https://www.privacyshield.gov/EU-US-Framework.
For more information on Instagram, click on the following link for Instagram’s privacy statement: http://instagram.com/about/legal/privacy/.
Dealers can only login if they are already our customer. Data collection on the website for login use for registered partners occurs only within the framework already presented here.
You can ask us for confirmation as to whether we process personal data that relates to you.
7. all available information on the origin of the data if the personal data are not collected from you as the person concerned.
You have the right to request information on whether your personal data will be transmitted to a third country or to an international organisation. In this context, you can request to be informed of such transmissions via suitable guarantees in accordance to Art. 46 GDPR.
You have the right to demand from us – as the responsible party or, for example, from Google – correction and/or completion if the personal data that affects you and that we process is incorrect or incomplete. We must immediately perform the corrections.
(d) if you file an objection against data processing in accordance with Art. 21 Para. 1 GDPR and it has not yet been determined whether the justified reasons that we have asserted outweigh your reasons.
If processing your personal data was restricted, then these data – aside from saving them – may only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural person or legal entity or for reasons of an important public interest of the Union or a Member State.
If the processing of data according to the above conditions was restricted, you shall be informed before such restrictions are lifted.
1. The personal data that affects you are no longer needed for the purpose for which said data was collected or in any other way processed.
2. You revoke your consent on which the processing is based according to Art. 6 Para. 1 lit. a) or Art. 9 Para. 2 lit. a) GDPR, and no other reason can be found to support data processing.
3. You file an objection against processing in accordance with Art. 21 Para. 1 GDPR and there are no overriding justified grounds for data processing, or you file an objection against data processing in accordance with Art. 21 Para. 2 GDPR.
4. Your personal data was unlawfully processed.
5. The deletion of your personal data is necessary to meet a legal obligation according to Union law or the law of Member States that we are subject to.
6. Your personal data was collected as part of services offered by the information company according to Art. 8 Para. 1 GDPR.
If we disclosed your personal data to the public and we are obligated to delete it according to Art. 17 Para. 1 GDPR, we shall take the appropriate actions, taking into account available technology and the implementation costs, even those of a technical kind, to inform others who are responsible for data processing, who process your personal data, that you, as the person concerned, have requested the deletion of all links to your personal data or want copies or replications of this personal data.
If you have asserted the right to correction, deletion or restriction to processing with us, we are obligated to inform all recipients, to whom your personal data was disclosed, of this correction or deletion of data or restriction to processing, unless this proves to be impossible or is associated with unreasonable time and expense. You have the right to be informed about these recipients by us.
2. processing occurs with the aid of an automated procedure.
In exercising this right, you further have the right to ensure that your personal data is transmitted directly by us as the responsible party to another responsible party, as long as this is technologically feasible. Freedoms and rights of other persons may not be impaired by this action.
The right to data transmission shall not apply to processing personal data that is necessary to perform a task, that is in the public interest or occurs as part of exercising public authority that was transferred to us as the responsible party.
You have the right to file an objection – for reasons that result from your special situation – to the processing of your personal data, which occurs based on Art. 6 Para. 1 lit. e) or f) GDPR; this also applies to profiling based on these provisions.
We no longer process your personal data unless we can provide compelling and legitimate grounds for processing the data that outweigh your interests, rights and freedoms, or processing the data serves to assert, exercise or defend legal claims.
If your personal data are processed to operate a direct advertising campaign, you have the right to file an objection at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling as long as it is connected to such direct advertising. If you object to data processing for the purpose of direct advertising, your personal data shall no longer be processed for these purposes.
You have the option, in conjunction with the use of services from an information company – regardless of Directive 2002/58/EU – to exercise your right to object using an automated process for which technical specifications are used.
You have the right to revoke your data privacy declaration of consent at any time. By revoking your consent, the legality of the data processing that has occurred up to the point of your revocation shall not be affected.
Without prejudice to another administrative or legal remedy, you have the right to file a complaint with a supervisory authority, especially in the Member State where you reside, your workplace or the location of the alleged violation if you are of the opinion that the processing of your personal data violates the GDPR.
The supervisory authority to whom the complaint was filed shall inform you, as the claimant, regarding the status and outcome of the complaint, including the option of a legal remedy according to Art. 78 GDPR.
We reserve the right to modify this privacy statement in order to adapt it to the respective provisions in effect as well as our products and services on the website.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 78