Source: http://www.tkh-tea.com/en/data-protection.html
Timestamp: 2019-04-26 05:47:44+00:00

Document:
We are very pleased about your interest in our company. The protection of your data is especially of major importance for us.
The processing of your personal data is carried out in compliance with the EU General Data Protection Regulation and with the country-specific data protection provisions that are applicable for us. With our privacy statement we would like, among others, to inform you about the collection and storage of personal data, about the type and the purpose of their use, the respectively decisive legal basis for this purpose as well as about the rights to which you are entitled.
This privacy statement may be supplemented or changed in future, for example owing to statutory requirements. Therefore, please inform yourself regularly about the current status. The respective current privacy statement can be called and printed out by you on our website at all times.
Personal data are all information, which refer to an identified or identifiable natural person (hereinafter "data subject"). A natural person will be seen as identifiable, who can be identified directly or indirectly, in particular by means of allocation to an identifier such as a name, to a code number, to location data, to an online identifier or to one or several special features, which are an expression of the physical, physiological, genetic, mental, financial, cultural or social identity of this natural person.
A data subject is each identified or identifiable natural person, whose personal data are processed by the data controller responsible for the processing.
Processing is each activity carried out with or without the help of automated processes or each such series of activities in connection with personal data such as the collection, entry, organisation, classification, the storage, adjustment or change, the reading out, query, use, disclosure by transmission, distribution or any other form of provision, comparison or the linking, limitation, erasure or the destruction.
The limitation to the processing is the marking of stored personal data with the aim of limiting their future processing.
Profiling is each type of automated processing of personal data, which consists of the fact that these personal data are used in order to assess certain personal aspects, which refer to a natural person, in particular in order to analyse or foresee aspects with regard to work performance, financial position, health, personal preferences, interests, reliability, conduct, place of abode or change in location of this natural person.
Pseudonymisation is the processing of personal data in a manner in which the personal data can no longer be allocated to a specific data subject without involving additional information, if this additional information is stored separately and is subject to technical and organisational measures, which guarantee that the personal data is not allocated to an identified or identifiable natural person.
Data controller or person responsible for the processing is the natural person or legal entity, authority, institution or other body, which decides on its own or together with others about the purposes and means of the processing of personal data. If the purposes and means of this processing are stipulated by Union law or the law of the member states then the data controller respectively the certain criteria for his appointment can be envisaged according to Union law or the law of the member states.
The contract data processor is a natural person or legal entity, authority, institution or other body, which processes personal data by order of the data controller.
The recipient is a natural person or legal entity, authority, institution or other body, to which personal data are disclosed, irrespective whether it concerns a third party or not. Authorities, which possibly receive personal data within the scope of a certain investigation order according to Union law or the law of the member states, shall however not be deemed as recipients.
A third party is a natural person or legal entity, authority, institution or other body except the data subject, the data controller, the contract data processor and the persons who, under the direct responsibility of the data controller or the contract data processor, are authorised to process the personal data.
The consent is each expression of intent submitted by the data subject voluntarily for the certain case unmistakably and in an informed manner in the form of a declaration or any other clear confirming act, with which the data subject gives to understand that it agrees with the processing of the personal data relating to him/her.
A breach of the protection of personal data is a breach of the security, which leads to the destruction, to the loss or the change, whether unintended or unlawfully, or to the unauthorised disclosure of respectively to the unauthorised access to personal data, which were transmitted, stored or processed in any other manner.
The legal basis for the data processing is Art. 6 Para. 1 S. 1 lit. f GDPR. Our legitimate interest is derived from the purposes listed above for the data collection. In no way do we use the collected data for the purpose to draw conclusions about your person.
We collect personal data if you provide these to us voluntarily when contacting us per e-mail to info@thueringer-kraeuterhof.de or via our contact form. Which data are collected can be seen from the input form. We use the data communicated by you for processing your enquiries and for processing the contract. After the full processing of your enquiry or after the full processing of the contract or after deletion of your user account your data will be blocked for further use and they will be erased after the expiry of the storage deadlines under tax and commercial law, if you have not explicitly consented to a further use of your data or we reserve a data use beyond this, which is permitted by law and about which we will inform you below.
The data processing for the purpose of contacting us or with the creation of a user account with our company shall be carried out according to Art. 6 Para. 1 S. 1 lit. a GDPR based on your voluntarily granted consent.
The data processing with the conclusion of a contract with us shall be carried out according to Art. 6 Para. 1 S. 1 lit. a GDPR based on your voluntarily granted consent or according to Art. 6 Para. 1 S. 1 lit. b GDPR in order to fulfil the contract.
You can object to the storage and use of your data for these purposes at all times by a message to the contact possibilities stated above under Subclause 1.
The data transmission in the internet (e.g. with the communication per e-mail) can feature security gaps. Information, which you send to us unencrypted per electronic post (e-mail), can be read, stored and used for purposes not as intended by third parties while en route. Therefore, please do not send any confidential information without using an encryption programme.
Your personal data will not be transmitted to third parties for any other purposes than those listed below.
As many other websites we also use "cookies", small text files, which make it possible to store specific information relating to the access device of the user (PC, tablet, smartphone) on the device. They serve, on the one hand, the purpose of user-friendliness of our website and thus for the user, on the other hand however also the statistical entry of the data or the website use and therefore to improve our offer. Several of the cookies used by us will be deleted again after the end of the browser session, thus after closing your browser, so-called session cookies. Other cookies remain on your terminal device and enable us to recognise your browser with the next visit, persistent cookies.
The legal basis for the data processing, i.e. for the use of so-called cookies, is Art. 6 Para. 1 S. 1 lit. f GDPR. Our legitimate interest is derived from our interest in the user-friendliness of our website and in improving our offer.
The information generated by the cookie regarding the use of our offer is stored on the server of the provider in Germany. The IP address is anonymised immediately after the processing.
Matomo supports the "Do Not Track" process of current web browsers. If you want to generally prevent the analysis of your web behaviour we recommend that you activate this option in your browser.
You can receive information relating to data protection of Matomo under: matomo.org/privacy-policy/.
The legal basis for the use of Matomo is Art. 6 Para. 1 S. 1 lit. f GDPR. We have a legitimate interest in the statistical evaluation of the user accesses in order to optimise our web appearance.
We collect and process the personal data of applicants for the purpose of carrying out the application procedure. The processing can also be carried out by using electronic means. This is, in particular, the case if an applicant transmits corresponding application documents to us by using electronic means, for example per e-mail or via a web form located on the website.
If we conclude an employment contract with an applicant, the transmitted data will be stored for the purpose of carrying out the employment relationship by complying with the statutory regulations.
If we do not conclude an employment contract with an applicant the application documents will be deleted automatically 6 months after announcement of the rejection decision, insofar as a deletion does not oppose any other legitimate interests of the data controller responsible for the processing within the meaning of Art. 6 Para. 1 S. 1 lit. f GDPR. Any other legitimate interest in accordance with this regulation is, for example, an obligation to provide proof in proceedings according to the General Equal Treatment Act (AGG).
The legal basis for the processing of your personal data in the application procedure is your consent, Art. 6 Para. 1 lit. a GDPR. The legal basis for the use of your data for the purpose of processing the employment relationship is Art. 6 Para. 1 lit. b GDPR.
pursuant to Art. 77 GDPR irrespective of another legal remedy under administrative law or court legal remedy to lodge a complaint at a supervisory authority, in particular in the member state of your customary place of abode, your workplace or the location of the presumed breach. A list of the supervisory authorities with the respective contact data can be taken from the following link: www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
Insofar as your personal data are processed based on legitimate interests pursuant to Art. 6 Para. 1 S. 1 lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to file an objection against the processing of your personal data, insofar as reasons exist for this purpose, which arise from your special situation or the objection is directed against direct marketing. In the latter case you have a general right to object, which will be implemented by us without stating a special situation.
If you would like to exercise your right of revocation or right to object, an e-mail is sufficient to info@thueringer-kraeuterhof.de.
For reasons of security our website uses an SSL (Secure Socket Layer) encryption. Whether an individual site of our internet presence is transmitted encrypted, you can recognise by the fact that the address line of the browser changes from "http://" to "https://" and by the closed presentation of the key or lock symbol in the status bar of your browser.
We furthermore use suitable technical and organisational security measures in order to protect your data against accidental or wilful manipulations, partial or full loss, destruction or against the unauthorised access of third parties. Our security measures are continuously improved in line with the technological development.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 77
 Art. 6
 Art. 21