Source: https://www.crifbuergel.de/en/privacy
Timestamp: 2019-04-22 23:53:26+00:00

Document:
The company data protection officer of CRIF Bürgel GmbH can be contacted at the above address, FAO Data Protection department or by email to datenschutz@crifbuergel.de.
When you visit our website, we collect, process and use personal data to the extent permitted by law or necessary for processing or if you have given your consent for this.
The name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type along with version, the operating system of the user, referrer URL (the site previously visited), IP address and the requesting provider. This data is only used for statistical evaluations for the purpose of running, securing and optimising the offering.
The legal basis for the collection of data via log files is article 6 para. 1 clause 1 letter b GDPR (for the fulfilment of the contract for the use of the homepage) and article 6 para. 1 clause 1 letter c GDPR (for the security of data processing). Furthermore, we have a legitimate interest within the meaning of article 6 para. 1 clause 1 letter f GDPR to continually improve and optimise the offering on our homepage in the interests of the users.
The data collected and stored via server log files is deleted after 7 days at the latest or - in the case of IP addresses - made anonymous by truncation.
You can subscribe to our free newsletter on our website. To subscribe to the newsletter, simply enter your email address. You also have the option to enter your name and address. The actual registration takes place via a "double opt-in procedure". This means that after registration you will receive another email with a confirmation link. This validation is necessary to verify your email address.
The legal basis for sending the email is article 6 paragraph 1 letter a GDPR (consent).
You can unsubscribe from our newsletter at any time. You will find a link to unsubscribe at the end of each newsletter. Deregistration is also seen as revocation of your consent. In this case, the data you have provided will be deleted.
For further information about our services, please contact us via our online contact form. Your data will be stored in our Customer Relationship Management system ("CRM system") and forwarded internally for further processing. All personal data with which you provide us in connection with this contact request will be used only for the purposes of responding to your enquiry or making contact with you, and for the associated technical administration.
The legal basis for data processing is article 6 para. 1 clause 1 letter a GDPR (consent) or article 6 paragraph 1 clause 1 letter b GDPR (implementation of pre-contractual measures).
The enquiries will be deleted after two years at the latest. Legal retention periods shall be observed accordingly.
According to article 6 para. 1 clause 1 letter b GDPR, the disclosure is necessary for the processing of contractual relationships with you, e.g. to suppliers or recipients of goods or services named by you.
There is a legal obligation to pass on data in accordance with article 6 para. 1 clause 1 letter c GDPR, e.g. to financial or criminal prosecution authorities.
The disclosure is required under article 6 para. 1 clause 1 letter f GDPR to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data; such disclosure may take place to government institutions and law enforcement authorities, for example, in the event of attacks on our IT systems.
Our newsletter is sent by the dispatch service Newsletter2Go GmbH, Köpenicker Strasse 126, 10179 Berlin as a processor under article 28 GDPR. The data protection provisions of Newsletter2Go can be viewed at https://www.newsletter2go.de/datenschutz/.
We remain the controller for data protection even if processors are involved. We do not intend to transfer your personal data to a third country.
Cookies are used, among other things, for the purposes of enabling certain functions of the websites and for managing the session on a technical level. We use so-called session cookies to recognise that you have already visited individual webpages of our website within a session and to enable session control, e.g. to save form entries or shopping baskets during the session. Session cookies are deleted at the latest when you close your web browser.
In addition, we use temporary cookies that are stored in the web browser of your end device for a defined period of time to optimise and guarantee user-friendliness. If you visit our site again, it is automatically recognised that you have already visited our web pages and which settings you have stored so you do not need to deal with these again.
Furthermore, we use tracking cookies to statistically record the use of our website and to evaluate it for the purpose of optimising and advertising our offering. These cookies enable us to automatically recognise your end device the next time you visit our site and to localise it to a certain extent via IP addresses. These cookies are also automatically deleted after a defined time, at the latest after 365 days. More details can be found in the following chapter on web analysis.
The cookies necessary for the functioning of the website, the cookies for session control and the session cookies are processed in accordance with article 6 para. 1 clause 1 letter b GDPR (contract fulfilment). Data processing by means of cookies to optimise the websites and to ensure user-friendliness is carried out in accordance with article 6 para. 1 clause 1 letter f GDPR (legitimate interest) and for advertising purposes and web analysis of tracking cookies in accordance with article 6 para. 1 sentence 1 letter a GDPR (consent).
We use the web analysis service etracker, which is operated by etracker GmbH ("etracker") in Germany. This service collects and stores data for marketing and optimisation purposes. Usage profiles under a pseudonym can be created from this data. Cookies can be used to do this. Etracker's cookies do not contain any information that enables a user to be personally identified. More information can be found at www.etracker.com/de/datenschutz.html. Data collection and storage can be objected to at any time at www.etracker.de/privacy?et=ET_PARAMETER with effect for the future.
We use the web analysis service Google Analytics, which is provided by Google Inc. ("Google") in the USA.
This service collects and stores data for marketing and optimisation purposes. Usage profiles under a pseudonym can be created from this data. Cookies can be used to do this. Information generated by the cookie about your use of the homepage is usually transmitted to and stored on a Google server in the USA. We have activated IP anonymisation on our homepage, i.e. Google will shorten your IP address within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases shall the full IP address be transferred to a Google server in the USA and truncated there. Based on our order, Google will use this information to evaluate your use of the offering, to compile reports on website activities and to provide the website operator with further services associated with website and Internet use. The IP address provided by your browser as part of Google Analytics will not be combined with other data from Google.
We wish to point out that, on this offering, Google Analytics has been extended with the code "gat._anonymizeIp();" in order to ensure the anonymous collection of IP addresses (IP masking).
You can also find more information on this at www.google.com/intl/de/analytics/privacyoverview.html. You can prevent Google from collecting data generated by the cookie and relating to your use of the offering (including your IP address) and processing this data by downloading and installing the browser plug-in available at the following link.
We use the online advertising program Google AdWords, which was developed by Google Inc. ("Google") in the USA, and in the context of this, conversion tracking.
Cookies can be used to do this. The cookie for conversion tracking is set when a user clicks on an ad placed by Google. These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages of our website when the cookie has not yet expired, we and Google can detect that the user clicked on the ad and proceeded to this website. Each Google AdWords customer has a different cookie. Thus, cookies cannot be tracked using the website of an Adwords advertiser. The information obtained using the conversion cookie is used to create conversion statistics for Adwords customers who have opted into conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a conversion tracking tag page. However, advertisers do not obtain any information that can be used to identify users personally. Users who do not wish to participate in tracking can easily disable the cookie of Google conversion tracking on their web browser under user settings. These users will not be included in the conversion tracking statistics.
For more information, see http://www.google.com/intl/de/policies/privacy.
This offering uses a plug-in from the social network Facebook (1601 South California Avenue, Palo Alto, CA 94304, USA). You can recognise this by the "like" button and the Facebook logo.
When you visit this website, the plug-in establishes a connection between the Facebook server and your browser. In doing so, Facebook is informed that the IP address you used was used to visit this website. You can link content from this website to your Facebook profile if you are logged into your Facebook account and click the "like" button. Facebook will then associate your visit to this site with your account. Only Facebook has knowledge of the content of the data transmitted as well as how it is used.
This offering uses a plug-in from the service Twitter. This service is provided by Twitter Inc. (1355 Market St, Suite 900, San Francisco, CA 94103, USA). Through the use of Twitter and the "re-tweet" function, the web pages which you visit will be linked to your Twitter account and made known to other users. In the process, data will also be transferred to Twitter. The provider has no knowledge of the content of the transmitted data and its use by Twitter.
Your privacy preferences on Twitter can be modified in your account settings at http://twitter.com/account/settings.
Each time one of our pages containing XING features is accessed, your browser establishes a direct connection to the XING servers. To the best of our knowledge, no personal data is stored in the process. In particular, no IP addresses are stored nor is usage behaviour evaluated.
Each time one of our pages containing LinkedIn features is accessed, your browser establishes a connection to the LinkedIn servers. LinkedIn is informed that you have visited our websites from your IP address. If you use the LinkedIn “Recommend” button and are logged into your LinkedIn account, it is possible for LinkedIn to associate your visit to our website to your user account. We would like to point out that, as the provider of these web pages, we have no knowledge of the content of the data transmitted or how it will be used by LinkedIn.
The LinkedIn plug-in is used on the basis of art. 6 para. 1 letter f GDPR. The website operator has a justified interest in the widest possible visibility on social media.
Our website uses plug-ins from the YouTube site, which is operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our pages featuring a YouTube plug-in, a connection to the YouTube servers is established. Here the YouTube server is informed about which of our pages you have visited.
to request information about your personal data processed by us in accordance with article 15 GDPR. In particular, you may obtain information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period as far as possible, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if this has not been collected from you, and requires the existence of automated decision-making including profiling and, where appropriate, meaningful information about its detail.
– the personal data must be erased for compliance with a legal obligation under European Union or Member State law to which the controller is subject.
– the personal data was collected relating to information society services provided pursuant to article 8 para. 1 GDPR (consent of a child).
– you have lodged an objection to the processing pursuant to article 21 GDPR.
to lodge a complaint with a supervisory authority according to article 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our headquarters.
If your personal data is processed on the basis of legitimate interests in accordance with article 6 para 1 clause 1 letter f GDPR, you have the right to object to the processing of your personal data in accordance with article 21 GDPR if there are reasons which arise from your particular situation, or if the objection is directed against direct advertisement. In the latter case, you have a general right of objection, which we will implement without specifying a particular situation.
If you would like to make use of your right of revocation or objection, you can contact us using the above contact details and send us an email, for example.
During the visit to our website, we use the most common SSL (Secure Socket Layer) method together with the highest level of encryption supported by your browser. Usually, this is 256-bit encryption. Whether an individual page of our website is transmitted in encrypted form can be seen from the key or lock symbol in the status bar of your web browser appearing in closed form.
In addition, we use suitable technical and organisational measures for security of data processing appropriate to the level of risk, in particular to protect your data against manipulation or unauthorised access. In doing so, we take latest technology into account. Our security measures are adapted to keep up with technological developments.
CRIF Bürgel GmbH processes personal data in order to provide authorised recipients with information for assessing the creditworthiness of natural and legal persons. Score values are also calculated and transmitted for this purpose. It shall only make the information available if a justified interest in this has been substantiated in individual cases and processing is permissible, after consideration of all interests. The legitimate interest exists, in particular, before entering into transactions with a risk of financial default. The creditworthiness check serves to protect recipients from losses in the lending business and at the same time opens up the possibility of protecting borrowers from excessive indebtedness by providing advice. The data is also processed for fraud prevention, money laundering prevention, identity verification, address identification, customer services, direct marketing or risk management. CRIF Bürgel GmbH will provide information about any changes to the purposes of data processing in accordance with article 14 para. 4 GDPR.
CRIF Bürgel GmbH processes personal data on the basis of the provisions of the General Data Protection Regulation. Processing is carried out on the basis of consents and on the basis of art. 6 para. 1 letter f GDPR, insofar as the processing is necessary to safeguard the legitimate interests of the controller or a third party and does not outweigh the interests or fundamental rights and freedoms of the data subject which require that personal data be protected. The legitimate interest exists, in particular, before entering into transactions with a risk of financial default.
Consents may be revoked at any time vis-à-vis the contracting party concerned. This also applies to consents granted before the GDPR came into force. The revocation of consent does not affect the legality of the personal data processed prior to revocation.
CRIF Bürgel GmbH receives its data from its contractual partners. These are companies based in the European Economic Area or Switzerland in the fields of trade, services, leasing, energy supply, telecommunications, insurance or debt collection as well as banks, financial and payment service providers and other contractual partners who use CRIF Bürgel GmbH products for the purposes mentioned under 2.1. In addition, CRIF Bürgel GmbH processes information from generally accessible sources such as public registers and official announcements (commercial registers, debtor registers, insolvency announcements).
Recipients are contractual partners of the sectors mentioned under 2.3. When data is transferred to countries outside the European Economic Area, the requirements of the European Commission apply. Further recipients may be contractors of CRIF Bürgel GmbH according to art. 28 GDPR.
Data from the debtor registers of the central enforcement courts after three years to the day, but earlier than this if CRIF Bürgel GmbH substantiates erasure with the central enforcement court.
Information on consumer/insolvency proceedings or residual debt exemption proceedings exactly three years after the end of insolvency proceedings or the granting of the residual debt exemption. Earlier erasure may also take place for individual cases stored separately.
Information on the rejection of an insolvency application due to lack of assets, the lifting of the security measures or the rejection of the residual debt exemption after three years to the day.
Previous addresses are stored for three years to the day, after which the necessity of ongoing storage is checked for a further three years. After that, they will be deleted to the day, unless a longer period of storage is required for identification purposes.
Regarding CRIF Bürgel GmbH, every data subject has the right of access pursuant to art. 15 GDPR, the right of rectification pursuant to art. 16 GDPR, the right of erasure pursuant to art. 17 GDPR and the right of limitation of processing pursuant to art. 18 GDPR. In addition, it is possible to contact the supervisory authority responsible for CRIF Bürgel GmbH: the Bavarian State Office for Data Protection Supervision. Consents may be revoked at any time vis-à-vis the contracting party concerned.
Pursuant to art. 21 para. 1 GDPR, data processing may be objected to for reasons arising from the particular situation of the data subject. The objection can be made in any form and is to be addressed to CRIF Bürgel GmbH, Data Protection, Radlkoferstraße 2, 81373 Munich.
Before entering into transactions with an economic risk, business partners want to be able to assess as well as possible whether the payment obligations entered into can be met. By providing information and using probability values, CRIF Bürgel GmbH supports companies in making decisions and helps them to process day-to-day (commodity) credit transactions quickly.
A forecast of future events is made on the basis of the information collected and previous experience. The calculation of the probability values at CRIF Bürgel GmbH is primarily based on the information stored at CRIF Bürgel GmbH about a data subject, which is also disclosed in the information pursuant to art. 15 GDPR. Address data is also used. Based on the entries stored for a person and other data, they are assigned to statistical groups of persons who have had similar payment patterns in the past. The method used is called "logistic regression" and is a well-founded, mathematical and statistical method for predicting risk probabilities that has been tried and tested in practice for many years.
CRIF Bürgel GmbH uses the following data to calculate scores, although not every type of data is included in every individual score calculation: date of birth, gender, shopping basket value, address data and duration of residence, payment problems to date, public negative features such as non-delivery of asset information, creditors' satisfaction excluded, creditors' satisfaction not proven, collection procedure and debt collection monitoring procedure. CRIF Bürgel GmbH itself does not make any decisions; it merely supports its affiliated contractual partners by providing its information in the decision-making process. The direct business partner alone is responsible for assessing and assessing creditworthiness, as only he/she/it has access to a great deal of additional information. This also applies if he/she/it relies solely on the information and probability values from CRIF Bürgel GmbH.

References: art. 6
 art. 6
 art. 28
 art. 15
 art. 16
 art. 17
 art. 18
 art. 21
 art. 15