Source: https://shop.vercella-vita.com/CommonNotice.action?actualFile=Privacy&actualId=privacy
Timestamp: 2019-04-26 02:39:39+00:00

Document:
We, MPS International GmbH & Co. KG, appreciate your interest in our website and the services we offer on www.vercella-vita.com.
Protecting your personal data is very important to us. In the following, we would like to provide you with comprehensive information on what data we collect when you visit our websites or use the services we provide on our website, and on how we process or use the data we collect. You will also receive information on what additional technical or organisational safeguards we have put in place to protect your privacy.
We process personal data such as your name, address, e-mail address or telephone number always in compliance with the applicable privacy regulations. This Privacy Notice provides you with information on the type, scope and purpose of the personal data we collect, use or process; and gives you an understanding of how you are affected by data processing.
Despite the fact that we as controllers of personal data processing implemented numerous technical and organisational measures, internet based data transmission may, as a matter of principle, still have security gaps. This means that protection cannot be absolute. Please keep that in mind when using our websites.
Our Privacy Notice aims to provide you in a clear and con-confusing manner with information on how your your personal data are processed on our website.
Unless provided otherwise in relation to processing personal data in specific cases as described in Chapter B of this Privacy Notice, we will erase the data we have stored as soon as they are no longer necessary in relation to the purposes for which they were collected or otherwise processed provided that there is no statutory obligation to retain these data. To the extent as to which the data of the data subject are not erased because they are required for other and legally permissible purposes, the processing of such data will be restricted. This means that the data are blocked and will not be processed for any other purpose. This applies, for instance, to such data of the data subject that have to be kept in compliance with trade or tax laws.
In compliance with statutory requirements, storage will end after either six years as set out in Section 257 (1) of the German Commercial Code (Handelsgesetzbuch (HGB)) (commercial books, inventories, opening balance sheets, financial statements, trade letters, book-keeping vouchers, etc.), or ten years as set out in Section 147 (1) of the German Fiscal Code (Abgabenordnung (AO)) (accounts, records, management reports, book-keeping vouchers, trade or business letters, etc.).
European regulators and legislators have furnished every data subject with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. If you would like to exercise your right to confirmation, you can contact us at any time.
- the existence of automated decision-making, including profiling, referred to in GDPR Art 22 (1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
The data subject has a right to information on whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to that transfer.
If you would like to exercise your right of access, you can contact us at any time.
Every data subject has the right to demand from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, every data subject has also the right to have incomplete personal data completed by means of providing a supplementary statement.
If you would like to exercise your right of rectification, you can contact us at any time.
- The data subject withdraws consent on which the processing is based according to point (a) of Art 6 (1) GDPR or point (a) of Art 9 (2) GDPR, and where there is no other legal ground for the processing.
- The data subject objects to the processing pursuant to Art 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art 21 (2) GDPR.
- The personal data have been collected in relation to the offer of information society services referred to in Art 8 (1) GDPR.
If any of the above conditions applies and a data subject desires the erasure of his or her personal data stored by MPS International GmbH & Co. KG, that person can contact us at any time. We will make sure that such request for erasure is met immediately.
If the personal data have been made public by MPS International GmbH & Co. KG and if our company, as controller, is obliged pursuant to Art 17 (1) to erase the personal data, MPS International GmbH & Co. KG, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform those controllers who are processing the published personal data that the data subject has requested the erasure by such controllers of any link to, or copy or replication of, those personal data to the extent as to which processing is not necessary. We will make arrangements that all steps as may be required on a case to case basis are taken.
- The accuracy of the personal data is contested by the data subject over a period that allows the controller to verify the accuracy of the personal data.
- The processing is unlawful but the data subject opposes the erasure of the personal data and requests instead the restriction of their use.
- The controller no longer needs the personal data for processing purposes but they are required by the data subject for the establishment, exercise or defence of legal claims.
- The data subject has objected to processing pursuant to Art 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
If any of the above conditions applies and a data subject desires the restriction of his or her personal data stored by MPS International GmbH & Co. KG, that person can contact us at any time. We will then make arrangements for restricting the processing of that person’s personal data.
Every data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. The data subject further has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent pursuant to point (a) of Art 6 (1) GDPR or point (a) of Art 9 (2) GDPR or on a contract pursuant to point (b) of Art 6 (1) GDPR and the processing is carried out by automated means, unless such processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In exercising his or her right to data portability pursuant to Art 20 (1) GDPR, the data subject also has the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.
For exercising your right of data portability, you can contact us at any time.
Every data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Art 6 (1). This also applies to any profiling that is based on those provisions.
In the event of objection, MPS International GmbH & Co. KG will no longer process the personal data unless we are able to demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is for the establishment, exercise or defence of legal claims.
Where MPS International GmbH & Co. KG processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This also includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to MPS International GmbH & Co. KG’s processing for direct marketing purposes, MPS International GmbH & Co. KG will no longer process those personal data for such purposes.
Where MPS International GmbH & Co. KG processes personal data for scientific or historical research purposes or statistical purposes pursuant to Art 89 (1) GDPR, the data subject, on grounds relating to his or her particular situation, has also the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Any data subject who wants to exercise his or her right to object can contact us directly. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject is also free to exercise his or her right to object by automated means using technical specifications.
- is based on the data subject’s explicit consent.
- is based on the data subject’s explicit consent, MPS International GmbH & Co. KG shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the 7.controller, to express his or her point of view and to contest the decision.
If you want to exercise your rights in relation to automated decision-making, you can contact us at any time.
Every data subject has the right to withdraw at any time his or her consent to data processing.
If you wish to exercise your right to withdraw your consent, you can contact us at any time.
If you have any question or suggestion on data protection issues, please contact us directly at any time.
Every data subject has the right to lodge a complaint with a supervisory data protection authority about our processing of his or her personal data.
Processing that requires consent for a specific purpose is carried out by MPS International GmbH & Co. KG on the basis of point (a) of Art 6 (1) GDPR. If processing is necessary for the performance of a contract to which the data subject is party, processing is based on point (b) of Art 6 (1) GDPR. The same applies if processing is required in order to take steps prior to entering into a contract, such as in case of enquiries regarding our services or products. Where MPS International GmbH & Co. KG is subject to a statutory obligation that makes processing necessary, processing is based on point (c) of Art 6 (1) GDPR. In rare cases, processing may become necessary in order to protect the vital interests of the data subject or of another natural person. In such an event, processing is based on point (d) of Art 6 (1) GDPR. Processing may finally be carried out on the basis of point (f) of Art 6 (1) GDPR too. This refers to any processing that is not covered by any of the above legal bases but is necessary for the purposes of the legitimate interests pursued by MPS International GmbH & Co. KG or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. We are permitted to carry out such processing because the European legislator has made specific reference to such processing (compare Recital (47) 2nd Sentence GDPR).
Unless provided otherwise in the description of the respective data processing process as set out in Chapter B of this Privacy Notice and provided that the processing of personal data is based on point (f) of Art 6 (1) GDPR, our legitimate interest lies in the operation of our business and in the commercial interest that is related to such operation of business.
If you contact us by using our contact details as shown on our website (e.g. our e-mail address or fax number), we will use the personal data you submit in that process only for the purpose for which you have made the contact.
If the reason for you making contact is your interest in our services or products, or the performance of our contractual relationship with you, the legal basis is point (b) of Art 6 (1) GDPR. In all other cases of you making contact, we have a legitimate interest in processing as set out in point (f) of Art 6 (1) GDPR due to the communication you initiated.
We store the data required for implementing the contract until the end of the statutory warranty period or, if applicable, until the contractual warranty period rans out. The data necessary for compliance with statutory trade or fiscal requirements will usually be stored for a period of ten years (compare Section 257 of the German Commercial Code (Handelsgesetzbuch (HGB)); Section 147 of the German Fiscal Code (Abgabenordnung (AO)). Any data processed for pre-contractual steps are erased as soon as those steps have been taken and it has become obvious that no contract will be forthcoming.
The personal data we store because of our legitimate interest are stored until the purpose intended by making contact has been reached. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Art 6 (1) and has no direct marketing purpose. If the processing has direct marketing purposes however, you can object to it at any time without having to state reasons.
The recipients of any personal data processed in compliance with this regulation are IT service providers (especially hosting service providers) with whom we have concluded a processor agreement as set out in Art 28 GDPR.
We collect and process the personal data of applicants for conducting application procedures within the terms of pre-contractual activities within the meaning of point (b) of Art 6 (1) GDPR, and of our legitimate interest, as set out in point (f) of Art 6 (1) GDPR, in the employment of new staff.
Such processing may also be carried out by automated means if the applicant, for instance, is sending his or her application documents electronically, e.g. by e-mail or by using our contact form. If we conclude an employment agreement with an applicant, the data provided to us will be stored for employment purposes and in compliance with legal requirements. If the controller does not conclude any employment agreement with the applicant, the job application documents will be automatically erased two months after the applicant has been informed of the rejection decision provided there is no other conflicting legitimate interest on the controller’s side against such erasure. Other legitimate interest within this context means, for instance, an obligation to provide proof in proceedings conducted under the German Equal Opportunity Act (Allgemeines Gleichbehandlungsgesetz (AGG)).
Due to the digitalised collection of received applications, the recipients of the processed personal data are our IT service providers (especially hosting service providers) with whom we have concluded processor agreements as set out in Art 28 GDPR.
MPS International GmbH & Co. KG reserves the right to change or amend this Privacy Notice with future effect at any time. A version as amended and applicable at the time is available on our website. Please visit that website frequently for information on the data protection provisions as are applicable at the time.
The scope and type of how we collect and use your data differs dependent on whether you visit our websites for acquiring information only or whether you use the services we provide, such as by concluding a contract via our website.
- Providing law enforcement authorities with the information necessary for enforcement in the event of a cyber-attack.
(2) The data processed as set out in point (1) of these provisions are stored for the purposes stated above for a period of no more than 30 days and will then be erased.
(3) In addition to the data specified above, cookies will be stored on your computer when you use our website. This is done because we have a legitimate interest in optimising and commercially operating our online services within the meaning of point (f) of Art 6 (1) GDPR. Cookies are small text files that are stored on your hard drive by the browser you are using and which provide the party placing the cookie (in this case: us) with certain information. Cookies cannot execute programmes or transmit viruses to your computer. They are used to make the web more user-friendly and more efficient.
b) Transient cookies are automatically deleted when you close your browser. In particular, they include session cookies which store a so-called session ID that can be used to assign different requests from your browser to the same session. This means that your computer can be recognised when you return to our website. Session cookies are deleted when you log off or close the browser.
c) Persistent cookies are automatically deleted after a defined period, which varies depending on the cookie and may amount to several years. You can delete the cookies in your browser’s security settings at any time.
d) You can configure your browser settings as desired and, for instance, deny acceptance of third-party cookies or all cookies generally. However, we would like to point out that, if you do this, you may not be able to use all functions of our website.
(5) The recipients of the personal data that are processed as described above are IT service providers (especially hosting service providers) with whom we have concluded processing agreements as set out in Art 28 GDPR.
Google is certified under the Privacy Shield framework and therefore warrants to comply with EU data protection law.
For web analysis with “Google Analytics”, our website uses the "_gat._anonymizeIp" method. This means that Google shortens and anonymizes a data subject’s IP address if our websites are accessed from within any member state of the European Union or from other countries that are party to the Agreement on the European Economic Area.
The purpose of the Google Analytics component is the analysis of traffic on our website. Google will use the collected data and information amongst other purposes for evaluating use of our website, compiling online reports on website activities for us and providing services relating to website activity and Internet usage.
Google Analytics places a cookie on the data subject’s end device. Placement of the cookie enables Google to analyse the use of our website. Every time that any of our website’s individual pages in which a Google Analytics component has been integrated is accessed, that Google Analytics component automatically causes the web browser on the data subject’s end device to transmit data to Google for online analysis. Within the course of this technical procedure, Google acquires knowledge about personal data, such as the data subject’s IP address, which Google uses among other things to trace the origin of the visitors and clicks, allowing subsequent calculation and invoicing of commissions.
Through that cookie, personal data such as the time of access, the place from which the access was made and the number of visits to our website made by the data subject are stored. At every visit to our website, these personal data, including the IP address of the Internet connection used by the data subject, are transmitted to Google, Inc. in the U.S.A. These personal data are probably permanently stored by Google, Inc. in the U.S. Google, Inc. might disclose these technically acquired personal data to third parties.
By adjusting the setting of the browser they use, data subjects can at any time prevent that our website places cookies and, by doing so, permanently object to the placement of cookies. This web browser setting would also prevent Google from placing a cookie on the data subject’s IT system. Moreover, any cookie that Google Analytics has already placed can be erased at any time through the web browser or other software programmes.
For more detailed information on Google Analytics, see https://www.google.com/intl/de_de/analytics/.
When visiting our website, information about your visit is transmitted to YouTube. This information includes the name of the specific subpage of our website as well as the data specified in B. Section 2 par. 1 of this Privacy Notice. Data are transmitted regardless of whether you are signed in to a YouTube user account or not. If you are signed in with Google, data are associated with the signed-in account. If you do not want this data to be associated with your YouTube account, you need to sign out before the button is activated. YouTube stores personal data in user profiles for the purposes of advertising, market research or tailoring its website to customer requirements. In particular, data (including those of anonymous users) are processed for the purpose of customer-specific advertising and to inform other users of the social network of your activities on our website. You have the right to object to the creation of such user profiles. To exercise this right, you will need to address your objection to YouTube.
For further information on the purpose and extent of data collection and processing by YouTube, please see the relevant Privacy Notice. There, you may find further information on your rights as well as configuration options for the protection of your privacy: https://www.google.de/intl/en/policies/privacy.
If you would like to use the services we provide on our website, such as ordering products from our online store or using the contact form, you may need to provide further personal data compared to purely informational use. For further details, see the following provisions.
(1) Personal data you provide to us during the order process are necessary for the conclusion of a contract (such as information on the contracting party) or required for legal purposes (such as tax regulations). Failure to provide personal data could lead to non-conclusion of the contract. Certain payment methods may require the payment details to be transmitted to a payment service provider contracted by us for that purpose.
If you conclude a contract using our website or send an enquiry by e-mail or contact form prior to the conclusion of contract, data received as part of this are processed for the purposes of pre-contractual measures or, for instance, to respond to questions about our products or services.
You may choose to create a customer account to help us store your data for future purchases. Data entered when creating an account in the “My account” area is stored until revoked. Further data, including the customer account itself, can at any time be deleted from within the customer area.
Any entered data are therefore processed for the performance of a contract or taking of pre-contractual measures pursuant to point (b) of Art 6 (1) GDPR and for the conclusion of legal obligations pursuant to point (c) of Art 6 (1) GDPR.
(2) The recipients of personal data processed according to this provision are payment service providers, shipping providers, IT service providers (especially hosting service providers), and possibly merchandise management systems or suppliers (dropshipping) with whom we have concluded processing agreements as set out in Art 28 GDPR.
(1) If you choose to use our contact form, you will be asked to provide your first name, surname, e-mail address, possibly your telephone number, address and the reason for your enquiry or message. Your e-mail address is the only mandatory information for your enquiry. Any information will be collected and stored for responding to your enquiry only.
(2) We use the double opt-in procedure to respond to your enquiry. It works as follows: After you have submitted your enquiry, we will send an e-mail to the e-mail address you have provided containing a request for confirmation that you agree with the processing of your personal data for the purpose of responding to your enquiry. If you do not confirm your registration within 24 hours, your data will be blocked and, after one month automatically deleted. In addition, we store your IP addresses and times of login and confirmation. The purpose of this procedure is to verify your enquiry and resolve a possible misuse of your personal data, if necessary.
(3) Legal basis for the processing of your personal data is your expressly given consent pursuant to point (a) of Art 6 (1) GDPR and our legitimate interest pursuant to point (a) of Art 6 (1) GDPR in responding to your enquiry concerning our services or offers and in proving a possible misuse of the e-mail address used for this purpose.
(4) After your confirmation, we will store your data provided with the contact form until fulfilment of your enquiry’s purpose. Any personal data stored beyond that according to paragraph 2 will be stored for a maximum of one month after receipt of the confirmation.
thank you for using our contact form. Please confirm your enquiry by clicking the following link: (link).
We will process your enquiry after your confirmation. However, if you have not sent us any enquiry, please excuse the mistake and simply ignore this e-mail. In this case, your e-mail address will be deleted automatically after 24 hours.
Service provider: Facebook Inc., 1601 S. California Ave, Palo Alto, CA 96304, U.S.A.
Service provider: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A.
Service Provider: Twitter Inc., 795 Folsom St, Suite 600, San Francisco, CA 94107, U.S.A.
Service Provider: Instagram LLC, 1601 Willow Rd, Menlo Park, CA 9402, U.S.A.
Corresponding to the state of the art, we implement organisational, contractual and technical security measures in order to ensure compliance with the data protection requirements and for protecting the data we process against accidental or intentional manipulation, loss, destruction, or against unauthorised access.
These security measures include but are not limited to the encrypted transmission of data between your browser and our server.
e)            How long are access and error logs stored on the server?
The access logs of the web server are stored only anonymously. For this, the last three digits are removed, i. 127.0.0.1 becomes 127.0.0. *.
Pageview error logs errors are deleted after seven days.
_gid: This cookie is used to distinguish between users. The cookie expires after 24 hours.
_ga: This cookie is used to distinguish between users. The cookie expires after 24 hours.
_gat: This cookie is used to throttle the request rate. The cookie expires after ten minutes.
The session cookie fe_typo_user set by default by the content management system TYPO3 expires at the end of the session on our website.
_ga: This cookie is used to distinguish between users. The cookie expires after two years.

References: Art 22
 Art 6
 Art 9
 Art 21
 Art 21
 Art 8
 Art 17
 Art 21
 Art 6
 Art 9
 Art 6
 Art 20
 Art 6
 Art 89
 Art 6
 Art 6
 Art 6
 Art 6
 Art 6
 Art 6
 Art 6
 Art 6
 Art 6
 Art 28
 Art 6
 Art 6
 Art 28
 Art 6
 Art 28
 Art 6
 Art 6
 Art 28
 Art 6
 Art 6