Source: http://www.color-expert.eu/en/data-protection/
Timestamp: 2019-04-23 23:01:43+00:00

Document:
(1) As a matter of principle, personal data are processed only where this is necessary for providing an operable website including content and services. Usually, the processing only takes place after the data subject has given his or her consent. By way of exception, the processing may take place without the data subject's consent if this is not possible for actual reasons and the processing of the data is permitted by statutory regulations.
(2) Point (a) of Art. 6 (1) GDPR serves as the legal basis for the processing of personal data where the data subject's consent has been obtained for personal data processing operations.
Point (b) of Art. 6 (1) GDPR serves as the legal basis for the processing of personal data where this is necessary for the performance of a contract to which the data subject is party. This also applies to processing operations required for steps prior to entering into a contract.
Point (c) of Art. 6 (1) GDPR serves as the legal basis for the processing of personal data where the processing of personal data is necessary for compliance with a legal obligation to which the company is subject.
Point (f) of Art. 6 (1) GDPR serves as the basis for the processing of personal data where this is necessary for the purposes of the legitimate interests pursued by the company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
(3) The personal data of the data subject will be erased or blocked as soon as the purpose of the storage no longer applies. Moreover, personal data may be stored if this provided for by relevant national or European regulations. The data will also be blocked or erased when a storage period stipulated by the said standards ends, unless the data need to continue to be stored for the conclusion or performance of a contract.
The data are stored in the system's log files. These data are not stored together with other personal data of the user.
(2) The legal basis for this is point (f) of Art. 6 (1) GDPR.
(3) It is necessary to collect and temporarily store the IP address in order to enable the presentation of the web page on your device. For this, the IP address needs to be stored for the duration of the visit to the website. These data are not analysed for marketing purposes.
(4) The data are erased as soon as the respective session ends. Where these data are stored in log files, the erasure takes place after no more than seven days. The data may continue to be stored thereafter. In this case, the IP addresses of the users are deleted or anonymised so that they can no longer be mapped to the requesting client.
(5) The collection of data for the provision of the website and the storage of data in log files is mandatory for the provision of the web presence. Therefore, it is not possible to object to this.
(3) The purpose of the use of technically necessary cookies is to facilitate the use of websites by the users. Some functions of the website cannot be offered without using cookies. For these functions, the browser needs to be recognised even after changing pages.The user data collected by technically necessary cookies are not used to create user profiles.
The website only uses Google Analytics with activated IP anonymisation as described above. This means that Google will only process your IP address in truncated form. In this way, it cannot be associated with a specific person.
(2) The legal basis of the processing is the legitimate interest in the analysis, optimisation and economic operation of the website pursuant to point (f) of Art. 6 (1) GDPR.
(3) The website uses Google Analytics for the purpose of analysing the use of the website and continually improving individual functions and offers as well as the user experience. By means of the statistical analysis of the user behaviour, the offering can be improved and be made more interesting for the user. This also constitutes the legitimate interest in the processing of the aforesaid data by Google.
(3) The website uses DoubleClick Ad Exchange for marketing and optimisation purposes, especially in order to display relevant and interesting ads, to improve the reports concerning the campaign performance or to avoid the same ads from being viewed repeatedly. This also constitutes the legitimate interest in the processing of the aforesaid data.
http://www.aboutads.info/choices. Note: If the cookies are deleted, this setting will be deleted as well.
(2) Where the user has given his or her consent, the legal basis for this is point (a) of Art. 6 (1) GDPR. If the registration serves the performance of a contract to which the user is party or in order to take steps prior to entering into a contract, point (b) of Art. 6 (1) GDPR constitutes an additional legal basis for the processing of the data.
(3) The user needs to be registered in order to set up a customer account. The registration serves the identification of the user and the performance of the usage contract for the service.
(4) The data are erased as soon as they are no longer required for the achievement of the purpose for which they were collected. Where the registration serves the performance of a contract or in order to take steps prior to entering into a contract, this is the case when the data are no longer required for the performance of the contract. Even after the termination of the contract, it may be necessary to store the contracting partner's personal data in order to comply with contractual or statutory obligations.
(5) Data subjects can always modify user data in their user profile under "Settings". If the data are required for the performance of a contract or in order to take steps prior to entering into a contract, premature erasure of the data is possible only if contractual or statutory obligations do not prejudice the erasure.
(1) For orders in the online shop, we process master data (e.g. names and addresses as well as contact details of users, user names of the authorised users), contract data (e.g. services used, names of contacts, payment information) as well as the IP address and the time of the respective user action, the user ID and the accessed URLs. These data are stored in our system's log files. Moreover, the third-party data entered by the user are processed.
(2) Where the user has given his or her consent, the legal basis for the processing of data is point (a) of Art. 6 (1) GDPR. The consent is obtained at the conclusion of the contract.Point (b) of Art. 6 (1) GDPR constitutes an additional legal basis for the processing of the data, as the processing of the said data serves the performance of a contract to which the user is party or in order to take steps prior to entering into a contract.Moreover, the processing takes place for the analysis, optimisation and economic operation of our website in order to improve our services pursuant to point (f) of Art. 6 (1) GDPR.
(3) Purpose of the Processing1. Master data (e.g. names, addresses and contact details of users) and contract data (e.g. services uses, names of contact, payment information) are processed for the performance of the contract and billing purposes.2. The user name and the input of the respective user are processed in order to ensure the access authorisation of the service.3. The IP address, the time of the respective user action and the accessed URLs are processed for the optimisation of the services and the ongoing improvement of the user experience.4. The third-party data entered by the user are processed for the performance of the contract and the provision of the services promised in the contract.
(4) The data are erased as soon as they are no longer required for the achievement of the purpose for which they were collected.Where the registration serves the performance of a contract or in order to take steps prior to entering into a contract, this is the case when the collected data are no longer required for the performance of the contract. Even after the termination of the contract, it may be necessary to store the contracting partner's personal data in order to comply with contractual or statutory obligations (including but not limited to retention periods under tax law).
(5) Data subjects can modify or erase the stored data at any time.If the data are required for the performance of a contract or in order to take steps prior to entering into a contract, premature erasure of the data is possible only if contractual or statutory obligations do not prejudice the erasure. In particular, the notice periods of existing contracts remain unaffected.
In this connection, the data are not forwarded to any third parties. The data are used exclusively for processing the conversation.
(2) Where the user has given his or her consent, the legal basis for the processing of data is point (a) of Art. 6 (1) GDPR.The legal basis for the processing of the data that are transmitted when sending an e-mail is point (f) of Art. 6 (1) GDPR.If the contact by e-mail aims at the conclusion or performance of a contract, point (b) of Art. 6 (1) GDPR also constitutes the legal basis for the processing.
(3) The processing of personal data from the input screen only serves the handling of the contact. In the case of contact by e-mail, this also constitutes the required legitimate interest in the processing of the data.The other personal data processed during the submission process serve the prevention of abuse of the contact form as well as the protection of the IT systems.
(4) The data are erased as soon as they are no longer required for the achievement of the purpose for which they were collected. For the personal data from the input screen of the contact form and those sent by e-mail, this is the case when the respective conversation with the data subject ends. The conversation will be deemed ended if the circumstances reveal that the respective issue has been conclusively clarified.The additional personal data collected during the submission process are erased after a period of seven days, at the latest.
(5) The data subject may at any time withdraw his or her consent to the processing of personal data. In the event of a contact by e-mail, the storage of the personal data can at any time be objected to by sending an e-mail to info@storch.de. However, the conversation cannot be continued in this case.In this case, all personal data stored in connection with the contact will be erased.
(2) Where the user has given his or her consent, the legal basis for the processing of data is point (a) of Art. 6 (1) GDPR.If the contact by e-mail aims at the conclusion or performance of a contract, point (b) of Art. 6 (1) GDPR also constitutes the legal basis for the processing.
(3) The personal data processed during the submission process serve the prevention of abuse of the contact window as well as the protection of the IT systems.
(4) The data are erased as soon as they are no longer required for the achievement of the purpose for which they were collected. This is the case when the respective conversation with the data subject ends. The conversation will be deemed ended if the circumstances reveal that the respective issue has been conclusively clarified.
(2) The legal basis for the processing of data after the user's subscription to the newsletter with the user's consent is point (a) of Art. 6 (1) GDPR.
(3) The collection of the user's e-mail address serves the delivery of the newsletter.The collection of other personal data during the subscription process serves the prevention of abuse of the services or of the e-mail address used.
(4) The data are erased as soon as they are no longer required for the achievement of the purpose for which they were collected. Accordingly, the user's e-mail address is stored as long as the newsletter subscription is active.The other personal data collected during the subscription process is usually erased after a period of seven days.
(5) The data subject may terminate the newsletter subscription at any time. For this purpose, every newsletter contains a special link.This also enables the withdrawal of the consent to the storage of the personal data collection during the subscription procedure.
Within the scope of a login or contact, all data are transmitted over an SSL/TLS-encrypted connection. The SSL certificate required for this, which is installed on the servers, has been issued by an independent organisation.An encrypted connection can be recognised from the "https://" that appears in the address bar of the browser instead of "http://".As soon as the encrypted SSL/TLS connection has been established, your input that you submit to the shop can no longer be intercepted by any third parties.
(1) The data required for the delivery are forwarded to the shipping service providers. In this case, the data need to be forwarded for the performance of the contract.
(2) Therefore, the legal basis is point (b) of Art. 6 (1) sentence 1 GDPR.
(3) During the order process, the data subject can give his or her consent to the forwarding of other data required for the delivery, especially of the e-mail address and telephone number, to the shipping service provider. The purpose of the collection is the announcement of the delivery and the communication of the respective shipping status to the data subject. The legal basis is the consent pursuant to point (a) of Art. 6 (1) sentence 1 GDPR.
1. Erasure of Personal DataYour data are usually automatically erased three months after the application procedure is finished. Moreover, you can at any time send an e-mail to karriere@storch-ciret.com to request us to erase your data. However, please note that this also means withdrawing from all ongoing application procedures.
2. Talent PoolBy invitation of our recruiting team, you can agree to the storage of your data in our talent pool following the completion of your application procedure. If you make use of this option, we will store your application data for 12 months. Following the end of these 12 months, your application data will be erased automatically. Of course, you can at any time send an e-mail to jobs@[…].de to request us to erase your data.
3. Forwarding of Your Application Data to Other Companies of the Storch-Ciret GroupTechnical and organisational measures have been implemented to ensure that only the companies of the Storch-Ciret Group that you applied to or that your application has been forwarded to can view and use your data.By confirming the consent at the end of the application process, you agree to the forwarding of your application documents, application or applicant data to other companies of the Storch-Ciret Group. You can withdraw this content by sending an e-mail to jobs@[…].de whenever you wish.
(8) the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.The data subject may request information on whether the personal data are transmitted to a third country or an international organisation. The data subject can request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transmission.
The data subject has the right to obtain from the controller without undue delay the rectification and/or completion of inaccurate or incomplete personal data concerning him or her. The controller shall perform the rectification without delay.
(4) the data subject has objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
Where the right to rectification or erasure of personal data or restriction of processing has been asserted against the controller, the controller shall communicate this rectification or erasure or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
The data subject has the right vis-à-vis the controller to be informed about those recipients.
In exercising this right, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others.The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Art. 6 (1) GDPR, including profiling based on those provisions.
The controller will no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
If the processing for direct marketing purposes is objected to, the personal data will no longer be processed for such purposes.
The data subject has the right to withdraw his or her consent pursuant to data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
However, these decisions shall not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless point (a) or (g) of Art. 9 (2) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
10. Right to File a Complaint with a Supervisory AuthorityWithout prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.The supervisory authority with which the complaint has been lodged will inform the party lodging the complaint about the status and outcome of the complaints including the possibility of judicial remedy pursuant to Art. 78 GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 9
 Art. 78