Source: https://www.torqeedo.com/us/en-us/customer-service/privacy-policy.html
Timestamp: 2019-04-20 19:07:33+00:00

Document:
We, TORQEEDO GMBH, take the protection of your personal data very serious and adhere strictly to data protection regulations. Personal data shall be collected on this website only to the extent technically necessary. In principle, however, it is also possible to use the TORQEEDO GMBH website without any personal data being provided. In no case will the data collected be sold or otherwise disclosed to third parties.
From the following statement you will get an overview of how we ensure such protection and what type of data is collected for which purposes. You will also be informed about your rights.
Data subject means any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing.
Controller or data controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
Consent of the user means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
The TORQEEDO GMBH website uses text files (referred to as cookies) which are placed and stored on a computer system via an internet browser.
Cookies are used by numerous websites and servers with many cookies comprising what is referred to as a cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string through which website pages and servers may be assigned to the specific Internet browser in which the cookie was stored. This allows website pages and servers visited to differentiate the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser may be recognised and identified using the unique cookie ID.
The data subject may, at any time, prevent the placement of cookies through our website by changing the setting of the Internet browser used accordingly, and the placement of cookies may thus be denied permanently. Furthermore, cookies already set may be deleted at any time via an Internet browser or other software programmes. All commonly used Internet browsers allow this. Where the data subject has disabled the placement of cookies by changing the settings in the Internet browser used accordingly, not all functions of our website may be entirely usable.
any other similar data and information that may be used in the event of attacks on our information technology system.
to provide law enforcement authorities with any information that may be required for criminal prosecution in case of a cyber attack.
TORQEEDO GMBH will therefore, on the one hand, analyse this data and information collected statistically and also with the aim of increasing data protection and data security in our company, to ultimately ensure an optimal level of protection of the personal data we process. Anonymous data from the server log files shall be stored separately from any personal data provided by a data subject.
As this data is required for compelling reasons for making the website available, it is not possible for the data subject to remove this privilege.
It is possible to register, stating personal data, on the website of the data controller. Which personal data is transmitted to the data controller is determined by the respective input mask used for registration purposes. Personal data entered is collected and stored exclusively for internal use by the data controller, and for own purposes . The data controller may arrange for transmission of data to one or more processors (e.g. parcel service) that will also exclusively use personal data for internal purposes attributable to the data controller.
When registering on the website of the controller, the IP address assigned by the Internet service provider (ISP) to the data subject, the date and the time of registration will also be stored. Such data is stored against the background of this being the only way to prevent inappropriate use of our services, and, if necessary, to make it possible to investigate any offences that may have been committed. This means it is necessary for the data controller to store this data in order to protect the business against risks. This data shall not be disclosed to third parties unless a statutory obligation to disclose data exists or unless data needs to be transferred for criminal prosecution purposes.
The purpose of registration of the data subject stating personal data voluntarily is for the controller to offer the data subject content or services that due to the nature inherent in the matter may only be offered to registered users. Registered persons may, at their discretion, modify the data indicated upon registration at any time or have it deleted completely from the data inventory of the controller.
Data subjects may withdraw their user registration and have their user registration deleted by sending an e-mail message subject to no specific formal requirements to info@torqeedo.com.
TORQEEDO GMBH shall upon request provide any data subject with information as to which personal data is stored about the specific data subject. In addition, the data controller shall correct or erase personal data at the data subject’s request or indication unless required otherwise with a view to statutory retention periods. In this context, all of the employees of the controller will be available for providing information to the data subject as point of contact.
In line with the applicable terms and conditions of the third party (with the third party being the party with which you contract in connection with acquisition of the app) from which you download apps developed by TORQEEDO (such as iTunes, Google Play, etc.), we will be processing data provided to us by the third party in order to perform our obligations (e.g. your device ID) so as to allow you to download the app to your mobile terminal device.
In particular, please take note of the separate privacy statements that apply with respect to the app developed by TORQEEDO and the applicable privacy statements of the third-party providers.
On the website of TORQEEDO GMBH, users are given the opportunity to subscribe to press releases about our company / our investor relations news. Which personal data is transmitted to the data controller depends on the respective input mask used.
As a general rule, press releases of our company and the investor relations news may only be received by the data subject if (1) the data subject has a valid e-mail address and (2) the data subject has registered for the respective method of transmission. For legal reasons, a confirmation e-mail by double opt-in will be sent to the e-mail address registered by a data subject before a newsletter will be sent to the data subject for the first time. The purpose of this confirmation e-mail is to check whether the owner of the e-mail address as the data subject has authorised receipt of the information.
During registration for the service, we will also store the IP address of the computer system used by the data subject at the time of registration and assigned by the Internet Service Provider (ISP) as well as the date and time of registration. It is necessary to collect this data to make (potential) inappropriate use of the e-mail address of a data subject transparent at a later date, and therefore it serves the aim of protecting the controller against risks in terms of legal requirements.
Personal data collected as part of registration will exclusively be used for sending press releases / investor relations news. In addition, subscribers to the press releases/ investor relations news may be informed by e-mail, as long as this is necessary for the operation of the service or registration in question, as this could be the case in the event of modifications to the service, or in the event of a change in technical conditions. Personal data collected will not be transmitted to third parties. It is possible for a data subject to cancel subscription to our press releases / investor relations news at any time. Consent to storage of personal data provided to us by the data subject may be withdrawn at any time. You will find a link in every press release / all investor relations news with which you can withdraw your consent. It is also possible to unsubscribe from the press release / investor relations news at any time directly on the controller’s website or to communicate this wish to the data controller in a different way.
The press release/ investor relations news of TORQEEDO GMBH contain what is referred to as tracking pixels. A tracking pixel is a miniature graphic embedded in such e-mails which are sent in HTML format to enable log file recording and analysis. This allows for statistical analysis of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, TORQEEDO GMBH may see if and when an e-mail was opened by a data subject, and which links in the e-mail were clicked on by the data subject.
Such personal data collected in the tracking pixels contained in the press releases / investor relations news is stored and analysed by the data controller in order to optimise sending of the press release, as well as to adapt the content of future press releases / investor relations news even better to what the data subject is interested in. Such personal data will not be disclosed to third parties. Data subjects at all times have the right to withdraw the separate consent given by way of double-opt-in. After withdrawal of consent, this personal data will be deleted by the data controller. Unsubscription from press releases/ investor relations news shall automatically be interpreted by TORQEEDO GMBH as cancellation of consent.
Based on statutory requirements, the website of TORQEEDO GMBH contains information that make it possible to get in contact with our company fast by electronic means and to communicate directly with us. Where a data subject contacts the data controller by e-mail or by using the contact form, the personal data transmitted by the data subject shall be stored automatically. Such personal data transmitted on a voluntary basis by a data subject to a data controller shall be stored for the purpose of handling the inquiry or for contacting the data subject. Such personal data will not be transmitted to third parties.
For the purpose of establishment of contact, data will be processed in line with Art. 6 (1) a) GDPR based on the consent given by you.
The data controller shall process and store personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this privilege is granted by the European body issuing directives and regulations or any other legislators by virtue of laws or regulations to which the data controller is subject.
Where the purpose of storage no longer applies or where a storage period prescribed by the European body issuing directives and regulations or any other legislator competent has expired, personal data shall routinely be blocked or erased in accordance with legal requirements.
The data controller shall collect and process personal data of job applicants for the purpose of handling the job application procedure. Data may also be processed by electronic means. This would be the case, without limitation, where a job applicant submits the respective job application documents by e-mail or by means of a web form on the website to the data controller. Where the data controller concludes an employment contract with a job applicant, the data submitted will be stored for the purpose of managing the employment in compliance with statutory requirements. Where no employment contract is concluded with the applicant by the data controller, the application documents shall automatically be erased three (3) months upon notification of the decision to reject the applicant unless separate consent was given on the part of the applicant for longer-term storage of data, or provided that no legitimate interests of the data controller in non-erasure apply.
Art. 88 GDPR in conjunction with section 26 New German Data Protection and Privacy Act (Bundesdatenschutzgesetz neu, BDSG-neu).
Each data subject shall, at any time, have the right to request from the controller a confirmation as to weather or not personal data concerning the data subject is being processed. Where a data subject wishes to avail himself/herself of this right of confirmation, he or she may, at any time, contact any employee of the data controller.
the existence of automated decision taking processes, including profiling, referred to in Article 22(1) and (4) GDPR; and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
Furthermore, the data subject shall have a right to be given access to information as to whether personal data is transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of appropriate safeguards taken in relation to the transfer.
Where a data subject wishes to avail himself or herself of this right of access, he or she may, at any time, contact any employee of the data controller.
Each data subject affected by processing of personal data shall have the right to request correction of inaccurate personal data relating to the data subject without undue delay. The data subject shall further have the right, taking into account the purposes of processing, to have any incomplete personal data completed, without limitation by provision of a supplementary statement. Where a data subject wishes to avail himself or herself of this right of correction, he or she may, at any time, contact any employee of the data controller.
The data subject has contested the accuracy of personal data; in this case processing shall be restricted for a period enabling the controller to verify the accuracy of the personal data.
It is unlawful to process such data and the data subject has objected to erasure of the personal data and instead requests restriction of use of such data.
The controller no longer needs the personal data for processing purposes but such data is needed by the data subject for the establishment, exercise or defence of legal claims.
The data subject has objected to processing in line with Article 21(1) GDPR pending the verification of whether the legitimate grounds or interests of the controller override those existing on the part of the data subject.
Where one of the aforementioned conditions is met, and a data subject wishes to request the restriction of processing of personal data stored by TORQEEDO GMBH, he or she may at any time contact any employee of the data controller. This employee of TORQEEDO GMBH will arrange for the restriction of processing.
Each data subject affected by processing of personal data shall have the right to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her, based on Article 6(1) (e) or (f) GDPR. This shall also apply with respect to profiling based on these provisions.
In the event of an objection, TORQEEDO GMBH shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Where TORQEEDO GMBH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing purposes. This shall also apply with respect to profiling to the extent that it is related to such direct marketing. Where the data subject has objected to TORQEEDO GMBH processing data for the purposes of direct marketing, TORQEEDO GMBH shall refrain from processing such personal data for such purposes in the future.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by TORQEEDO GMBH for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) GDPR, unless processing is necessary for the performance of a task carried out for reasons of public interest.
The data subject may contact any TORQEEDO GMBH employee directly or any other employee to exercise the right to prevent processing. In addition, the data subject shall be free in the context of use of information society services, and notwithstanding Directive 2002/58/EC, to exercise his or her right to object by automated means using technical specifications.
The data subject has withdrawn consent on which the processing is based according to Article 6(1) (a) GDPR or Article 9(2) (a) GDPR, and where there is no other legal ground for processing.
The data subject has objected to processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or the data subject has objected to processing pursuant to Article 21(2) GDPR.
Personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
Personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
Where one of the aforementioned reasons apply, and a data subject wishes to request the erasure of personal data stored by TORQEEDO GMBH, he or she may at any time contact any employee of the data controller. The employee of TORQEEDO GMBH shall ensure that the erasure request is complied with without undue delay.
Where the controller has made personal data public and the company as controller is obliged pursuant to Article 17(1) to erase the personal data, it shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, such personal data, as far as processing is not required. Such employee of TORQEEDO GMBH will arrange for the restriction of processing in a given case.
Each data subject shall have the right to receive the personal data concerning him or her, which the data subject has provided to a controller, in a structured, commonly used and machine-readable format. He or she shall also have the right to have this data transmitted from one controller to another without hindrance from the controller to which the personal data has been provided for as long as processing is based on consent given in line with Article 6(1) (a) GDPR or Article 9(2) (a) GDPR, or based on a contract pursuant to Article 6(1) (b) GDPR, and data is processed by automated means, for as long as processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The data subject may at any time contact any TORQEEDO GMBH employee to assert the right to data portability.
Each data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, as long as the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject rights and freedoms and legitimate interests, or (3) is not based on the data subject’s explicit consent.
Where a decision (1) is necessary for concluding, or the performance of, a contract between the data subject and the controller, or (2) is based on the data subject’s explicit consent, TORQEEDO GMBH shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, as a minimum including the right to obtain human intervention on the part of the controller, to express his or her point of view and contest the decision.
Where a data subject wishes to avail himself or herself of this rights in relation to decisions being taken by automated means, he or she may, at any time, contact any employee of the data controller.
Each data subject affected by processing of personal data shall at any time have the right to withdraw from the controller the consent to processing of personal data relating to the data subject.
Where a data subject wishes to avail himself or herself of this rights in relation to withdrawal of consent, he or she may, at any time, contact any employee of the controller.
Google, Inc (“Google”) web fonts.
At the TORQEEDO GMBH website we use what is referred to as web fonts provided by Google Inc. for uniform presentation of fonts. When a page is loaded, the browser will load the web font required into the browser cache to display texts and fonts correctly.
The browser used must connect to the servers of Google for this purpose. As a result, Google will gain knowledge of access to our website via the visitor’s IP address. Use of web fonts serves the purpose of ensuring that our online offering is displayed in a consistent and attractive way. This purpose constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR.
Where the visitor’s browser does not support web fonts, a default font will be used by the computer concerned.
The controller has added the Google Analytics component (with the anonymiser function) to this website. Google Analytics is a web analytics service. Web analytics is the process of collection, gathering and analysis of data relating to the behaviour of website visitors. A web analysis service collects, inter alia, data about the website from which a person was referred (referred to as “referrer”), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics is mainly used for the purpose of optimising a website and to carry out a cost-benefit analysis of Internet marketing.
Google, Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States of America is the operator of the Google Analytics component.
The controller uses the “_gat._anonymizeIP” feature for web analytics through Google Analytics. With this feature, the last octet of the IP address of the Internet connection used by the data subject is set to zeros and anonymised by Google when a data subject accesses our website from a Member State of the European Union or another Contracting State to the Agreement on the European Economic Area.
The purpose of adding the Google Analytics component to our website is to analyse the traffic on our website. Google uses the data and information collected, inter alia, to analyse use of our website and to provide online reports, which show the activities on our website, and to provide other services concerning the use of our website for us.
Google Analytics places a cookie on the information technology system of the data subject. For definition of the term “cookies” see above. By placing a cookie, Google is placed in a position to analyse use of our website. Each time one of the individual pages part of this website operated by the controller to which the Google Analytics component was added is loaded, the Internet browser used on the information technology system of the data subject will automatically submit data through the Google Analytics component for the purpose of online analysis. In the context of this technical process, Google will gain knowledge of personal data such as the IP address of Internet access used by the data subject, and Google will use this information, inter alia, for understanding where visitors have been referred from and have clicked the website and consequently allow for commission payment accounting.
A cookie is used to store personal data, such as time of access, location from which the website was accessed, and the frequency of visits of our website by the data subject. Every time you visit our website, this personal data including the IP address of the Internet connection used by the data subject, will be transmitted to Google in the United States of America. This personal data will be stored by Google in the United States of America. It is possible that Google may disclose this personal data collected through the technical process to third parties.
You can prevent cookies from being stored by changing your browser software settings accordingly; we would, however, like to point out to you that in this case it may not be possible for you to use the full scope of the functionalities of this website.
Furthermore, it is possible for you to prevent the collection and transmission of the data generated through the cookie and relating to the use of the website made by you (incl. your IP address) as well as processing of this data by Google by downloading a browser plug-in for disabling Google Analytics from: tools.google.com and installing such plug-in.
The data controller has added YouTube component to this website.
YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States of America.
Each time an individual page part of this website operated by the data controller and to which a YouTube component (YouTube video) was added is loaded, the Internet browser on the information technology system used by the data subject will automatically be prompted by the YouTube component to download a representation of the corresponding YouTube component. For more information on YouTube see https://www.youtube.com/yt/about/. In the course of this technical procedure, YouTube and Google will gain knowledge of which specific sub-page of our website has been visited by the data subject.
Where the data subject is logged in on YouTube at the same time, YouTube will recognise each time a sub-page that contains a YouTube video is loaded which specific sub-page of our website the data subject visited. This information will be collected by YouTube and Google and attributed to the respective YouTube account of the data subject.
Through the YouTube component, YouTube and Google will receive information that the data subject has visited our website when the data subject was logged in on his or her YouTube account at the time when he or she loaded our website; such transfer of information will happen regardless of whether the data subject has clicked on a YouTube video or not. Where the data subject does not wish such information to be transmitted to YouTube and Google, such transfer of information may be prevented by the user logging off from his or her own YouTube account before loading our website.
Google+, Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States of America.
These social media buttons only provide links to the respective providers. For as long as you do not click on any of these buttons, no data will be transmitted to any of these providers.
Where it does not find your approval that these companies collect data about you, please do not click any of these buttons.
Customer inquiries are processed by us using the Zendesk ticket system, a customer inquiry platform of Zendesk Inc., 989 Market Street #300, San Francisco, CA 94102. Data required such as first name, last name, post address, telephone number, e-mail address will be collected via our website to this end. Zendesk has been certified to be part of what is referred to as “Privacy Shield Framework” and is thus deemed to satisfy the minimum requirements for contract data processing in conformity with the law.
Data entered into the contact form shall be processed on the basis of your consent (Art. 6 (1) a) GDPR).
We have concluded a contract data processing contract with Zendesk and fully comply with the requirements of German data protection authorities when using Zendesk.
Data is collected for statistic analysis purposes and to improve the website only. However, the website operator reserve the right to retrospectively review the server log files where specific indicators exist that point to unlawful use having been made.
As this data is necessary for compelling reasons for making the website available, it is not possible for the data subject to remove this privilege.
Art. 6(1) (a) GDPR serves as legal grounds for processing operations for the purpose of which we obtain consent from the data subject for implementing a specific purpose of processing. Where processing of personal data is necessary for performing a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the delivery of goods or to render any other service, processing shall be based on Article 6(1) b) GDPR. The same applies to such processing operations which are necessary for implementing pre-contractual measures, for example in the case of inquiries concerning our products or services. Where our company is subject to a legal obligation by which processing of personal data is required, such as for the compliance with tax obligations, processing shall be based on Art. 6(1) c) GDPR. In rare cases, processing of personal data may be necessary in order to protect the vital interests of the data subject or of other natural persons. This would be the case, for instance, if a visitor were injured in our company and his or her name, age, health insurance data or other vital information would have to be disclosed to a doctor, hospital or other third party. In this case processing would be based on Art. 6(1) d) GDPR. Ultimately, processing operations could be based on Art. 6(1) f) GDPR. These legal grounds shall be used for processing operations which are not covered by any of the above-mentioned legal grounds, if processing is necessary on the grounds of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data. Such processing operations are permitted in particular because they have been specifically mentioned by the European legislator. The legislator consequently believed that a legitimate interest may be assumed to exist if the data subject is a customer of the controller (recital 47 sentence 2 GDPR).
Where processing of personal data is based on Article 6(1) f) GDPR, our legitimate interest is to do business in a way that promotes the well-being of all of our employees and the shareholders.
The criterion used to determine the period of storage of personal data is the applicable statutory retention period. After that period has expired, the data concerned will routinely be deleted when it is no longer needed for the purpose of performance of the contract or for contract initiation purposes.
We would herewith like to inform you about the fact that in part it is required by law (e.g. tax regulations) that personal data is provided and such a duty may also arise from contractual arrangements (e.g. information on contracting parties). Sometimes it is necessary for a data subject to provide us with personal data for the purpose of formation of contract and this information will subsequently have to be processed by us. The data subject, for instance, has the duty to provide us with personal data when concluding a contract with TORQEEDO GMBH. Where personal data is not provided, no contract may be concluded with the data subject. The data subject will have to contact one of our employees before providing personal data. Our employee will then inform the data subject on a case by case basis whether provision of personal data is prescribed by law or contract or whether it is necessary for concluding the contract or whether an obligation exists to provide personal data and which consequences the failure to provide personal details would have.
We are a responsible company and as such we do not make use of any automated decision taking or profiling processes.
We take all the technical and organisational security measures necessary for protecting your personal data from loss and inappropriate use. Your data, for instance, will be stored in a safe operating environment which may not be accessed by the public. We ensure that payment data transmitted is encrypted (128 bit SSL).
In the event that you wish to contact us by e-mail, please note that e-mail transmission is not a secure method of transmission where confidentiality may be ensured. It may be possible for third parties to get access to e-mail messages. This is why we recommend that you exclusively send us confidential information by letter.
Your trust is important to us. Therefore, we are always willing to answer any questions or queries you may have regarding the processing of your data. In the event that you have any questions or queries that this privacy statement did not answer or if you wish to receive more detailed information on any related issue, please do not hesitate to contact the data protection officer of TORQEEDO GMBH.

References: Art. 6

Art. 88
 Art. 6

Art. 6
 Art. 6
 Art. 6
 Art. 6