Source: https://born2grow.de/privacy-policy/
Timestamp: 2019-04-24 08:01:23+00:00

Document:
With regard to the terms used, such as “personal data” or their “processing”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
We only process personal data of our users if this is necessary to provide a website as well as our contents and services. The processing of personal data of our users takes place regularly only after consent of the user. An exception applies in such cases in which prior consent actually cannot be obtained for and/or the processing of the data is permitted by statutory provisions (Art. 6 para. 1 lit. a) to d). GDPR).
The server log files are deleted as soon as they are no longer necessary to maintain the purpose of their collection. In the case of the collection of data with regard to providing the website, this is the case when the respective session has ended, at the latest, however, after 14 days.
Our legitimate interest is based on the purposes listed above for data collection. Under no circumstances do we use the data collected for the purpose of drawing conclusions about the user personally. An evaluation of the data for marketing purposes does not take place in this context. This data is not stored together with other personal data of the user.
We process inventory data (e.g. names and addresses as well as contact data) and contract data (e.g. services used, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to Art. 6 para. 1 lit b. GDPR.
When contacting us (via contact form or e-mail), the user’s details will be processed for processing the contact request and its handling in accordance with Art. 6 para. 1 lit. a) and f) GDPR. At the time the message is sent via the contact form, the following data is stored: The IP address of the user and the date and time of registration. The personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems. In this context, the data will not be passed on to third parties. The data is used exclusively for processing the request.
If we disclose data to other persons and companies (contract processors or third parties) within the scope of our processing, transfer it to them or otherwise grant them access to the data, this shall only take place as far as permitted by mandatory laws (e.g. if a transfer of the data to third parties pursuant to Art. 6 para. 1 lit. b GDPR is required for contract fulfilment), if you have agreed, if we are obliged to do so or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).
If we assign third parties with the processing of data on the basis of a so-called “order processing contract”, this is done on the basis of Art. 28 GDPR.
Data are only transferred to third countries if data processing and transfer to the respective country are permitted.
Users have the right to request information on the personal data that we have stored about them without any charge (Art. 15 GDPR). Users have the right to correct inaccurate data, to limit the processing and deletion of their personal data, if applicable, to assert their rights to data portability (Art. 15-20 GDPR) and, in the event of the assumption of unlawful data processing, to file a complaint with the competent supervisory authority (Art. 77 GDPR).
Users may also revoke their consent, in principle with effect for the future (Art. 7 para. 3 GDPR).
The data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no legal storage obligations preventing deletion. If the user’s data are not deleted because they are necessary for other and mandatory purposes, their processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to user data that must be retained for book-keeping or tax reasons. In accordance with legal requirements, the data is stored for 6 years in accordance with Sec. 257 para. 1 German Commercial Code and for 10 years in accordance with Sec. 147 para. 1 German Taxation Act.
For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective contact with the user is finished. The contact is terminated when it is obvious that the facts in question have been finally clarified. The additional personal data collected during the sending process will be deleted after a period of 14 days at the latest.
You may request the person responsible to delete personal data without delay and the person responsible is obliged to delete such data without delay if they were not required for their intended use or if there was no other legal basis for the processing of personal data.
If the person responsible has made the personal data concerning you public and is obliged to delete it pursuant to Art. 17 para. 1 GDPR, he shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform the person responsible who process the personal data that you as the data subject have requested the deletion of all links to this personal data or of copies or replications of this personal data.
If you have exercised your right of rectification, deletion or limitation of processing against the person responsible, the person responsible is obliged to notify all recipients to whom the personal data concerning you have been disclosed of such rectification or deletion of the data or restriction of processing, unless this proves impossible or involves unreasonable effort. The person responsible shall have the right to be informed of such recipients.
The security measures include in particular the encrypted transmission of data between your browser and our server using SSL (Secure Socket Layer) procedures. Usually this is a 256 bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. Whether a single page of our website is transmitted in encrypted form is indicated by the closed display of the key or lock symbol in the lower status bar of your browser.
Cookies are information that is transferred from our web server or third party web servers to the user’s web browser and stored there for later retrieval. The data processed by cookies is required for the aforementioned purposes in order to protect our legitimate interests and those of third parties pursuant to Art. 6 para. 1 lit. f) GDPR. The user data collected in this way is anonymized by technical precautions. Therefore, it is no longer possible to assign the data to the user. The data will not be stored together with other personal data of the users.
We use “session cookies” which are only stored on our website for the duration of your current visit (e.g. to store your login status). A randomly generated unique identification number, a so-called session ID, is stored in a session cookie. A cookie also contains information about its origin and the storage period. These cookies cannot store any other data. Session cookies are deleted when you have finished using our online session on our website and log out or close your browser, for example.
In addition, we also use temporary cookies that are stored on your end device for a specified period of time in order to optimize user-friendliness. If you visit our site again to use our services, it will automatically recognize that you have already been with us and what entries and settings you have made so that you do not have to enter them again. These cookies are automatically deleted after a defined period of time.
Google will use this information on our behalf to evaluate the use of our website by users, to compile reports on the activities within this website and to provide us with further services connected with the use of this website and the use of the Internet. Anonymous user profiles can be created from the processed data.
On the basis of our legitimate interests (within the meaning of Art. 6 para. 1 lit. f. GDPR), we use content or service offers of third-party providers within our website in order to integrate their content and services, e.g. videos or fonts (hereinafter uniformly referred to as “content”). This always presupposes that the third party providers of this content perceive the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is therefore required for the display of this content. We make every effort to use only those contents whose respective providers use the IP address only for the delivery of the contents.
Current status of the data privacy statement: May 2018.

References: Art. 4
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 17
 Art. 6
 Art. 6