Source: https://www.kittelberger.de/data-protection/
Timestamp: 2019-04-22 18:51:54+00:00

Document:
We essentially process personal data of our users only insofar as this is required to provide an operational website and to deliver our contents and services. Personal data of our users are processed regularly only after the user's consent has been obtained. An exception applies in such cases where the prior obtaining of consent is not possible for actual reasons and the processing of the data is permitted by legal regulations.
Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 Para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis.
With regard to the processing of personal data which is required to perform a contract the contracting party of which is the data subject, Art. 6 Para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations which are required to carry out precontractual measures.
Insofar as a processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 Para. 1 lit. c GDPR serves as the legal basis.
In the event that vital interests of the data subject or of another natural person render the processing of personal data necessary, Art. 6 Para. 1 lit. d GDPR serves as the legal basis.
If processing is required to protect a legitimate interest of our company or of a third party and the interests, fundamental rights and fundamental freedoms of the data subject do not override the first-mentioned interest, Art. 6 Para. 1 lit. f GDPR serves as the legal basis for processing.
The personal data of the data subject are erased or blocked as soon as the purpose of storage ceases to apply. Data can furthermore be stored if this was envisaged by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. Data are also blocked or erased when a storage period prescribed by the aforementioned standards expires unless a necessity exists to continue to store the data for the purpose of concluding or performing a contract.
Each time our website is visited, our system automatically retrieves data and information from the computer system of the calling computer.
The log files contain IP addresses or other data which facilitate an assignment to a user. This could be the case for example if the link to the website from which the user is directed to our website or the link to the website to which the user switches contains personal data.
The data are also stored in our system's log files. These data are not stored together with other personal data of the user.
The legal basis for the provisional storage of data and log files is Art. 6 Para. 1 lit. f GDPR.
The provisional storage of the IP address by the system is required to enable the website to be delivered to the user's computer. The user's IP address must remain stored for the duration of the session for this purpose.
Storage in log files occurs to ensure the functionality of the website. In addition, the data serve to optimise the website and to ensure the security if our IT systems. The data are not evaluated for marketing purposes in this connection.
Our legitimate interest in data processing pursuant to Art. 6 Para. 1 lit. f GDPR also rests in these purposes.
The data are erased as soon as they are no longer needed to achieve the purpose of their collection. In the event that the data are acquired to provide the website, this is the case when the respective session is ended.
In the event that the data are stored in log files, this is the case after no more than thirty days. Any storage extending above and beyond this does not take place.
The acquisition of the data to provide the website and the storage of the data in log files are absolutely necessary for the operation of the website. For this reason, no option of objection on the part of the user exists.
We furthermore use on our website cookies which enable the surfing behaviour of the users to be analysed (see Google Analytics and Matomo).
The data of the users collected in this way are pseudonymised by technical precautions. It is therefore no long possible to assign the data to the calling user. The data are not stored together with other personal data of the users.
The legal basis for the processing of personal data when cookies are used is Art. 6 Para. 1 lit. f GDPR.
Our legitimate interest in the processing of personal data pursuant to Art. 6 Para. 1 lit. f GDPR also rests in these purposes.
We use on our website the web analytics service Google Analytics provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). Data processing serves the purpose of analysing this website and its visitors. Google will, on behalf of the operator of this website, use the information acquired to evaluate your use of the website, to compile reports about the website activities for the website operators and to render other services associated with website use and internet use. The IP address that is transferred from your browser as part of Google Analytics will not be combined with other Google data.
On this website data is collected and stored using the web analysis service software Matomo (www.matomo.org), a service of the provider InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, ("Matomo") on the basis of our legitimate interest in statistical analysis of user behaviour for optimisation and marketing purposes in accordance with Art. 6 para. 1 lit. f DSGVO. From this data, pseudonymised user profiles can be created and evaluated for the same purpose. Cookies may be used for this purpose. Cookies are small text files that are stored locally in the cache of the Internet browser of the page visitor. The cookies enable, among other things, the recognition of the Internet browser. The data collected using Matomo technology (including your pseudonymised IP address) is processed on our servers.
The user's data are forwarded as an e-mail and stored at the moment when the message is sent.
Alternatively, contact can be made by means of provided e-mail addresses. In this case, the user's personal data communicated with the e-mail are also stored.
The data are not passed on to third parties in this connection. The data are used solely to process the conversation.
The legal basis for the processing of data is, where the user's consent has been given, Art. 6 Para. 1 lit. a GDPR.
The legal basis for the processing of data which are communicated in the course of an e-mail being sent is Art. 6 Para. 1 lit. f GDPR. If the purpose of the e-mail contact is to conclude a contract, the additional legal basis for process is Art. 6 Para. 1 lit. b GDPR.
We use the processing of the personal data from the input screen solely to process the contact approach. In the event of a contact approach by e-mail, the necessary legitimate interest in the processing of data rests therein.
The other personal data processed during the sending operation serve to prevent the contact form from being misused and to ensure the security of our IT systems.
The data are erased as soon as they are no longer needed to achieve the purpose of their collection. For the personal data from the input screen of the contact form and those which were sent by e-mail this is the case when the relevant conversation with the user is ended. The conversation is ended when it can be inferred from the circumstances that the issue in question is conclusively clarified.
The personal data additionally collected during the sending operation are erased no later than after a period of thirty days.
The user is able at any time to withdraw their consent to their personal data being processed. By contacting us by e-mail, the user can at any time cancel the storage of their personal data. In such a case, the conversation cannot be continued.
To cancel, please send an e-mail to the data protection officer.
All the personal data which were stored in the course of the contact approach are erased in this case.
the existence of a right to lodge a complaint with a supervisory authority.
You have the right to request information as to whether or not the personal data concerning you are transferred to a third country or to an international organisation. In this connection, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
You have a right to have your data corrected and/or completed by the controller if the processed personal data concerning you are incorrect or incomplete. The controller must carry out the rectification without undue delay.
if you have objected to the processing pursuant to Art. 21 Para. 1 GDPR pending verification whether the legitimate grounds of the controller override your grounds.
Where the processing of the data concerning you has been restricted, these data may – with the exception of their storage – only be processed with your consent or for the advancement, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If restriction of the processing has been obtained in accordance with the aforementioned preconditions, you shall be informed by the controller before the restriction is lifted.
You withdraw your consent on which the processing was based in accordance with Art. 6 Para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR and there is no other legal basis for the processing.
The erasure of the personal data concerning you is required to comply with a legal obligation according to Union law or the law of the Member State to which the controller is subject.
The personal data concerning you have been collected in relation to offered services of the information society in accordance with Art. 8 Para. 1 GDPR.
Where the controller has made the personal data concerning you public and is obligated pursuant to Art. 17 Para. 1 GDPR to erase the personal data, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copies or replications of, those personal data.
to advance, exercise or defend legal claims.
If you have asserted against the controller the right to rectification, erasure or restriction of processing, the latter is obligated to notify all recipients to whom the personal data concerning you were disclosed of this rectification or erasure of the data or restriction of processing unless this proves to be impossible or involves a disproportionate effort.
In exercising this right, you furthermore have the right to have the personal data concerning you transmitted directly from one controller to another, where this is technically feasible. Freedoms and rights of other persons must not be adversely affected by this.
You have the right for reasons deriving from you particular situation at any time to lodge an objection against the processing of the personal data concerning you that occurs on the basis of Art. 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you unless it can demonstrate compelling reasons worthy of protection for the processing which override your interests, rights and freedoms or if the processing serves to advance, exercise or defend legal claims.
If the personal data concerning you are processed for the purpose of direct advertising, you have the right at any time to lodge an objection against the processing of the personal data concerning you for such promotional purposes; this also applies to profiling where this is connected with such direct advertising.
If you object to the processing for direct-marketing purposes, the personal data concerning you shall no longer be processed for such purposes.
You have the opportunity, in the context of the use of information-society services – and notwithstanding Directive 2002/58/EC – to exercise your right of objection by automated means using technical specifications.
You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawal of consent shall not affect the lawfulness of the processing conducted on the basis of the consent up to the point of withdrawal.
However, these decisions may not be based on special categories of personal data referred to in Art. 9 Para. 1 GDPR unless Art. 9 Para. 2 lit. a or g GDPR applies and suitable measures to safeguard your rights, freedoms and legitimate interests are in place.
With regard to the cases referred to in (1) and (3) the controller shall take suitable measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express their own point of view and to contest the decision.
Without prejudice to any other administrative or legal remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement if you consider that the processing of the personal data concerning you infringes the GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9