Source: https://circlon.de/en/privacy
Timestamp: 2019-04-25 20:14:04+00:00

Document:
As a general rule, we only process personal data relating to our users if this is necessary to provide a functional website as well as our content and services. In general, personal data relating to our users is only processed after the user has granted his/her consent. An exception applies in those cases in which prior consent cannot be obtained for practical reasons and the processing of the data is permitted by statutory provisions.
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 (1a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
In respect of the processing of personal data required for the performance of an agreement to which the data subject is party, Art. 6 (1b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to perform pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1c) GDPR serves as the legal basis.
In the event that the vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1d) GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh these legitimate interests, Art. 6 (1f) GDPR serves as the legal basis for processing.
The personal data relating to the data subject will be erased or blocked as soon as the purpose of storage ceases to apply. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased if a storage period set out by the aforementioned standards expires, unless there is a need for the further storage of the data for the conclusion or performance of an agreement.
The legal basis for the temporary storage of the data and log files is Art. 6 (1f) GDPR.
The temporary storage of the IP address by the system is necessary to enable the website to be displayed on the user's computer. This means that the user’s IP address has to remain stored for the duration of the session.
The data is stored in log files to ensure the functionality of the website. In addition, the data helps us to optimise the website and to ensure the security of our information technology systems. The data is not analysed for marketing purposes within this context.
Our legitimate interest in data processing in accordance with Art. 6 (1f) GDPR also lies in these purposes.
The data will be erased as soon as it is no longer necessary to achieve the purpose for which it was collected. Regarding the data collected for the provision of the website, this is the case when the session in question has ended.
For data stored in log files, this is the case after seven days at the latest. Further storage is possible. In such cases, the user IP addresses will be erased or masked so that they can no longer be assigned to the accessing client.
The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. As a result, users have no rights to object.
The user data collected in this way is pseudonymised using technical precautions. This means that the data can no longer be allocated to the accessing user. The data will not be stored together with other personal data relating to the users.
The legal basis for the processing of personal data using cookies is Art. 6 (1f) GDPR.
The analysis cookies are used to improve the quality of our website and its content. The analysis cookies show us how the website is being used, allowing us to optimise our offering on an ongoing basis.
Our legitimate interest in the processing of personal data in accordance with Art. 6 (1f) GDPR also lies in these purposes.
If you purchase goods or services on our website and provide us with your e-mail address, we may use this e-mail address to send you a newsletter in the future. In such cases, the newsletter will only be used to send you direct advertising for similar goods or services that we offer.
No data is passed on to third parties in connection with data processing for the dispatch of newsletters. The data will only be used to send out the newsletter.
The legal basis for the processing of data following registration for the newsletter by the user with the user’s consent is Art. 6 (1a) GDPR.
The legal basis for sending the newsletter as a result of the sale of goods or services is section 7 (3) of the German Unfair Competition Act (UWG).
The user's e-mail address is collected so that the newsletter can be sent out.
The collection of other personal data as part of the registration process serves to prevent the misuse of the services or the e-mail address used.
The data will be erased as soon as it is no longer necessary to achieve the purpose for which it was collected. This means that the user's e-mail address will be stored for as long as the subscription to the newsletter is active.
The subscription to the newsletter can be cancelled by the user at any time. A corresponding link can be found on the website for this purpose.
There is a contact form on our website which can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored.
No further data will be stored when the message is sent. In the course of the input mask dispatch process, your consent is obtained for the processing of the data and reference is made to this data privacy statement. Alternatively, you can contact us using the e-mail address provided. In this case, the user's personal data transmitted in the e-mail will be stored. The data will not be passed on to third parties within this context. The data will only be used to process the conversation.
The legal basis for the processing of data with the user’s consent is Art. 6 (1a) GDPR. The legal basis for the processing of data transmitted when an e-mail is sent is Art. 6 (1f) GDPR. If the e-mail contact is aimed at the conclusion of an agreement, the additional legal basis for the processing is Art. 6 (1b) GDPR.
We only process the personal data from the input mask to process the enquiry. In the event of contact by e-mail, this also constitutes the necessary legitimate interest in the processing of the data. The other personal data processed during the dispatch process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.
The data will be erased as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the contact form input mask and the data that was sent by e-mail, this is the case when the conversation with the user is finished. The conversation is also considered to have ended when it can be inferred from the circumstances that the matter in question has been definitively clarified. The other personal data collected during the dispatch process will be erased after a period of seven days at the most.
The user can revoke his/her consent to the processing of personal data at any time. If the user contacts us by e-mail, he/she can object to the storage of his/her personal data at any time. In such cases, the conversation cannot be continued.
All personal data stored in the course of the user’s contact with us will be erased in this case.
You have the right to request information as to whether the personal data concerning you is transmitted to a third country or to an international organisation. Within this context, you can request the appropriate safeguards in accordance with Art. 46 GDPR in connection with the transmission.
You have a right to rectification and/or completion vis-à-vis the controller if the personal data concerning you that is processed is incorrect or incomplete. The controller shall make the correction without delay.
(4) you have objected to processing pursuant to Article 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override yours.
Where the processing of the personal data concerning you has been restricted, such data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If the processing has been restricted according to the above conditions, you will be informed by the controller before the restriction is lifted.
(1) the personal data concerning you is longer necessary in relation to the purposes for which it was collected or otherwise processed.
(2) you withdraw your consent on which the processing is based according to Article 6 (1a) or Article 9 (2a) GDPR, and where there is no other legal ground for the processing.
Where the controller has made the personal data concerning you public and is obliged pursuant to Article 17 (1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, this personal data.
If you have exercised your right to have the controller rectify, erase or restrict the processing, the latter is obliged to inform all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You shall have the right, vis-à-vis the controller, to be informed of such recipients.
In exercising this right, you also have the right to request that the personal data concerning you be transmitted directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 (1e) or (1f) GDPR, including profiling based on those provisions.
You have the right to revoke your data protection declaration of consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
These decisions shall not, however, be based on special categories of personal data referred to in Article 9 (1) GDPR, unless Article 9 (2a) or (2g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
In the cases referred to in (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express its point of view and to contest the decision.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46