Source: https://www.bau-simulator.de/en/meta/data-privacy
Timestamp: 2019-04-26 03:54:04+00:00

Document:
Protecting your privacy is of utmost importance to us. Therefore, complying with the statutory data privacy regulations forms a natural foundation of our day-to-day work. It is, however, moreover paramount to us that you at all times know which personal data we gather, why we gather it, and how we process it. We will be happy to explain to you what rights you have and how to exercise them, as well.
To put it briefly, anything whereby you, as an individual, can be identified, whether due to the information itself or in connection with other information. Examples of this include your name, e-mail address, or also a customer ID, but even the point in time at which you visit our website if that is saved together with your IP address. We constantly endeavour to gather as little personal data as possible. Simultaneously, we are informing you in this document, in depth, on your personal data, if we gather any.
Why is this document so long?
which law or ordinance or regulation permits us to do so (= the legal basis).
We need to list all the steps individually. This is why this document is very extensive.
Consent pursuant to Art. 6(1)(a) General Data Protection Regulation (GDPR).
Consent is a declaration of intent. This can be given in writing in the form of a statement, or also by way of any other clearly affirmative action. In whatever way the consent is given, it needs to be given voluntarily, apply to a specific case, and unmistakably express that the data subject is in agreement with the processing of the personal data concerned. For that purpose, the data subject needs to be adequately informed and understand the consent.
This means: The data is necessary so that we can fulfil the contractual obligations towards you or we need the data to prepare for concluding an agreement with you.
This means: The processing of the data is, for example, mandatory for us based on a law or other regulation.
This means: The processing of the data is necessary in order to, on the one hand, preserve legitimate interests on our part or on the part of a third party, as long as your interests or basic rights and basic freedoms, which make the protection of personal data necessary, do not outweigh the latter.
Notwithstanding any other legal remedy under administrative or judicial law, you are entitled to file an appeal with a supervisory authority, in particular in the EU Member State that is your place of residence, your place of work or the place of the presumed infringement if you are of the opinion that the processing of the personal data concerned infringes the GDPR.
The personal data of the data subject is deleted or blocked once the purpose of the storage lapses. It may, moreover, be stored beyond that time if this has been stipulated by the European or national legislative authority in EU ordinances, laws or other regulations to which the Controller is subject. The data may also be blocked or deleted if a storage period stipulated by said standards expires, unless the necessity for further storage of the data for concluding an agreement or fulfilling an agreement exists.
The IP address or the host name are only available to us in the log files in anonymised form! The other data is saved in the log files of our system. This data is not saved together with other personal data of the user. Our web pages are hosted by our hosting service provider [INSERT NAME], which also processes this data for us.
The legal basis for the processing of the data is Art. 6(1)(1)(f) GDPR.
In that respect, the legitimate interest within the meaning of Art. 6(1)(f) GDPR lies in the functionality of our website and its availability. The processing by the hosting service provider is based on Art. 28 GDPR.
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s PC. For this purpose, the user’s IP address needs to be stored for the duration of the session.
The data is stored in order to ensure the functionality of the website. In addition, the data serves the purpose of enabling us to optimise the website and ensure that our IT systems are secure. The data is not evaluated for marketing purposes in this respect.
The log files are deleted in the system at the latest after six weeks. If it is necessary to retain the data for longer for the above-mentioned purpose, due to specific events, it is possible for it to be stored beyond that date. In any event, as already described, the user’s IP address is anonymised, so that it is no longer possible for it to be assigned to a specific user.
In order to operate the web site, it is absolutely necessary to gather the data to provide the website and store the data in log files. There is consequently no possibility for the user to object.
If you purchase goods or services on our website and, in this context, provide your e-mail address, it can consequently be used by us to send you a newsletter. In such a case, exclusively direct marketing for our own similar goods or services is sent via the newsletter.
You have the opportunity to subscribe to a free newsletter, which contains direct marketing for our products or products of our co-operation partners, on our website or in our app. In that respect, when you subscribe to the newsletter the data from the input mask is transmitted to us or the e-mail address which you have already given us used. In this case, the date and time when you subscribe to the newsletter, as well as the IP address, are stored in addition. In the course of the newsletter subscription being confirmed, the date and time when you click on the confirmation link to subscribe to the newsletter, and also the IP address, are saved as well.
When the newsletter is sent, your e-mail address is passed on to the external service provider “Cleverreach GmbH Inc.”, which takes on sending out the newsletter on our behalf. The service provider does not use your e-mail address for any other purpose. The service provider has its registered office within the European Union.
The legal basis for the processing of the data when you are sent the newsletter based on previously purchasing goods or services is Art. 6(1)(f) GDPR in conjunction with Sec. 7(3) German Act on Unfair Competition (UWG).
Therefore, the legitimate interest within the meaning of Art. 6(1)(f) GDPR lies in direct marketing and increasing the sales from our existing customers.
The legal basis for the processing of the data when directly subscribing to the newsletter is Art. 6(1)(1)(a) GDPR.
The legal basis for the passing on of the data to the e-mail marketing service provider is Art. 28(3) GDPR.
The purpose of storing the e-mail address is enabling us to make contact electronically for promotional purposes. The date of the registration and the IP address used for it, as well as the confirmation of the registration, are recorded in order to document the consent to the newsletter in a verifiable way and exclude abuse.
The e-mail address is passed on to the service provider for the purpose of the newsletter being sent via a mass e-mail service. The service provider is not entitled to use the data for its own purposes beyond that.
To the extent that we have received your e-mail address within the context of the purchase of goods or services, it is deleted in regard to the sending of advertisements, or blocked for the purpose of sending advertisements, once 18 months have passed since the last time you purchased goods or services, or upon your objection.
Should you have expressly consented to receiving the newsletter, we only delete or block the e-mail address for the purpose of sending you advertisements once you have revoked your consent. The data in regard to confirming that you are subscribing to the newsletter is stored for the same length of time.
You may object to the use of your e-mail address for promotional purposes, or revoke your consent, at any time, without any costs being incurred to you thereby extending beyond the fees of your telecommunications tariff. You may object to such use, with effect for the future, by clicking on a link provided for the purpose in any advertisement sent to you. You may also object to the use of advertising with effect for the future or revoke your consent by sending an e-mail to: datenschutz@astragon.de In the event of your filing an objection by e-mail it make take up to five working days for the deletion or blocking to be implemented. You may receive further advertising material during this period of time.
This website uses Google Analytics, a web analysis service of Google Inc. (“Google”). This software gathers information on how you use the website and creates various statistics from that. The usage data gathered in particular includes the specific selection of links, the time spent by you on individual pages and the sequence in which you used the pages on the website, as well as the frequency with which you accessed the pages. This data is gathered together with your IP address. The IP address transmitted by your browser within the context of Google Analytics is not merged with other data of Google.
We have activated the so-called IP anonymisation on this website, i.e. the IP address is first truncated by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area, prior to being transmitted on to the USA.
Only in exceptional cases is the full IP address transmitted to a server of Google in the USA and truncated there. Google itself describes its data processing activity here: https://www.google.com/policies/privacy/.
The legal basis for the processing of the data when using the website is Art. 6(1)(1)(f) GDPR.
The legitimate interest within the meaning of Art. 6(1)(f) GDPR lies in a customer-orientated design of the website, which does justice to the user’s requirements and takes the user’s usage preferences into consideration.
The legal basis for the passing on of the data to Google is Art. 28(3) and Art. 45(3) GDPR. The service provider is certified under the Privacy Shield Framework and is therefore subject to the adequacy decision (Implementing Decision 2016/1250) of the European Commission, i.e. the level of data protection with the service provider is recognised as being equivalent to that stipulated by the GDPR, even though the service provider has its registered office in the USA.
The processing serves the purpose of analysing this website and the usage pattern of its visitors.
The data is already anonymised directly after being gathered. Personal data is therefore only gathered in the course of the transmission, and not permanently.
You may prevent the cookies from being saved, including the generation and transmission of data to Google, by limiting or prohibiting cookies being placed in your browser software. This may lead to cookies that are not connected with Google possibly also being deactivated and your not being able to use all the functions of this website in their entirety.
As an alternative to the browser-plugin you can also click the following link to prevent Google Analytics from recording your data. By clicking this link an Opt-out-Cookie will be saved on your device. If you are manually deleting your cookies you need to click this link again.
A contact form is available on our website, which can be used for making contact with us electronically. If you enter data into the input mask, it is transmitted to us and saved. This data is: Your name, e-mail address, if applicable your telephone number, the nature of your concern and your individual message to us. In addition, the data and time of your message will be recorded automatically.
Alternatively, it is possible for you to contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be saved.
The legal basis for the processing of the data that is transmitted in the course of sending an e-mail is Art. 6(1)(f), and possibly also (a), GDPR. The aim of the e-mail contact is the conclusion of a contract, which means that the additional legal basis for the process is Art. 6(1)(b) GDPR.
The legitimate interest within the meaning of Art. 6(1)(f) GDPR lies in responding to a customer enquiry or a contact query on other topics.
The purpose of the data being stored is to make contact at the communication partner’s wish.
The data will be stored for as long as is necessary to deal with the enquiry. Should the latter concern commercial letters that it is obligatory to keep for a prescribed period of time in compliance with commercial and fiscal law, these will, furthermore, be stored for the statutory archival period.
The user has the opportunity to revoke his or her consent to the processing of the personal data or object to further use of it at any time. Should the user make contact with us by e-mail, he or she may oppose the storage of his or her personal data at any time. It can only be deleted if no statutory archival period exists. In this case, the data will, however, be blocked for any other type of use. In such a case, the correspondence cannot be continued.

References: Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 28
 Art. 45
 Art. 6
 Art. 6
 Art. 6