Source: https://www.haribo.com/enGB/meta/privacy.html
Timestamp: 2019-04-20 12:50:16+00:00

Document:
Personal data comprises individual information on the personal or material circumstances of a certain or an identifiable natural person. This information includes the real name, the address, the telephone number and the date of birth.
You may visit our website without stating any personal information. If you merely use our website for informational purposes, without logging in, registering or otherwise transmitting us any personal information, then we shall not process any personal data with the exception of data transmitted by your browser in order to facilitate your visit to the website and information which is transmitted within the scope of cookies for the statistical analysis of the use of our website.
The cookies for the control of the Loadbalancer ensure that a user who initially calls up www.haribo.com and is transferred by the Loadbalancer to a certain backend service also receives their pages from this backend server during the entire session. They contain a key using which the assigned backend service can be unambiguously identified, e.g. ‘EINFEAAK’ or ‘FJNFEAAK’.
If the user accepts the cookie information, i.e. clicks on “CONSENT”, then this fact is stored in the cookies. This ensures that the user is no longer shown the information layer. The cookie privacy_agreed is placed when the user clicks on the brand platform, and contains the value ‘true’; on the corporate website it is the accept cookie which is also saved with the value ‘true’.
In this cookie, the language or country selection of the user is stored in the form of the ISO code for the country and language, meaning that the correct country version will be loaded immediately if the user visits the website again.
The cookie fe_typo_user is placed by the Content Management System used, and contains a unique hash value, e.g. ‘11ee05f2869497562817be4ad4322cfd’. The cookie may be used during a frontend login for users.
Your information which we have collected through the abovementioned cookies shall not be used by us to create user profiles or to evaluate your surfing behaviour.
For the preservation of our legitimate interests in accordance with Art. 6 Section 1 lit. f GDPR, so that we can ensure technical provision of the website. Our legitimate interest consists of being able to provide you with an appealing, technically functional and user-friendly website and to take measures for the protection of our website against cyber risks, and to prevent cyber risks being generated through our website for third parties.
For the purpose of the statistical analysis of the use of our website, we use analysis tools. In this way, we can improve the quality of our website and its contents. We learn about how the website is used and can thus consistently optimise our range of offers.
The information received within the scope of the statistical analysis shall not be merged with your other data collected within the scope of the website.
For the preservation of our legitimate interests in accordance with Art. 6 Section 1 lit. f GDPR in connection with § 15 Section 3 TMG (German Telemedia Act); our justified interest shall consist of the design of our website in line with requirements.
If you have issued your consent, then based on this consent, Art. 6 Section 1 lit. a GDPR.
On our website, we use Google Analytics, a web analysis service by Google Inc. Google Analytics uses so-called “cookies”, text files which are stored on your computer and which facilitate analysis of your use of the website. The information generated through cookies on your use of our website is generally transmitted to a Google server in the USA and stored there. In case the IP anonymisation on our website is activated, however, your IP address will be abbreviated in advance within member states of the European Union or in other contracting states of the Eureopean Economic Area agreement. Only in exceptional cases shall the full IP address be transmitted to a Google server in the USA and abbreviated there. As commissioned by us, Google shall use this information to evaluate your use of the website, to create reports on website activities and in order to provide further services for the website provider related to the use of the website and the services related to the use of the Internet. The IP address transmitted by your browser within the scope of Google Analytics shall not be merged with other Google data.
On our website, we use Google Analytics with the extension “_anonymizeIp()”. In this way, IP addresses are further processed in abbreviated form; direct identification of an individual can thus be excluded.
You can prevent the storage of the cookies by adjusting the appropriate settings in your browser software; however we hereby wish to point out that in this case you may not be able to use all of our website functions to their full extent.
in order to prevent the collection of data through Google Analytics from our website in the future. Here an opt-out cookie is filed on your end device. Please observe that you must activate the opt-out cookie in every browser you use on all your end devices and must also if applicable reactivate it if you ever delete all the cookies in a browser.
On our website, we use the Google Tag Manager by Google. The Google Tag Manager is a solution using which the marketer can manage website tags via an interface. The service Google Tag Manager itself (which implements the tags) is a domain without cookies and does not collect personal data. The service Google Tag Manager ensures the triggering of other tags which may under certain circumstances collect data themselves. Google Tag Manager does not access this data. If a deactivation is undertaken at domain or cookie level, this shall apply for all tracking tags implemented with Google Tag Manager.
In addition to the purely informational use of our website, you can also use our website actively in order to get in contact with us or to register for the Newsletter. In addition to the abovementioned processing of your personal data for purely informational use, we then also process further personal data which we require to process and respond to your request.
To be able to process and respond to your requests to us, for example via the different contact forms, we process the personal data of which you have informed us accordingly. This data always includes your name and your email address so that we can send you a reply, as well as the other information which you send to us within the scope of your notification.
For the preservation of our legitimate interests in accordance with Art. 6 Section 1 lit. f GDPR; our legitimate interest consists of the proper reponse to customer requests.
With your consent, we use your data for advertising and market research purposes, such as for example the transmission of our Newsletter or your participation in the fan pool. We always process your first name and surname and your email address as mandatory information, Within the scope of the fan pool, we process the following data: form of address, place of residence, street, house number, postcode and date of birth.
You can cancel the Newsletter at any time by clicking on the link provided in the Newsletter and carrying out the cancellation.
You can deregister from the fan pool at any time on our website under Copmany/Service/Fan pool.
Your consent in accordance with Art. 6 Section 1 lit. a GDPR.
Some sections of our website contain links to third party websites. These websites are subject to their own data protection principles. We are not responsible for their operation, including the handling of data. Should you send information to or via such third party websites, then you should inspect the Data Protection Declarations for these websites before you send them information which can be assigned to you.
Initially, only our employees receive information on your personal data. In addition, we inform other recipients who provide services to us connected with our website, inasmuch as this is lawful or prescribed by law. Here we limit the forwarding of your personal data to the essentials. In part, our service providers receive your personal data in their function as order processors, and are then strictly bound to our instructions with regard to the handling of your personal data. In part, the recipients handle your data independently as it is transmitted to them by us.
Within the scope of the application of Google tools, we transmit your abbreviated IP address into the USA. The data transfer is based on the implementation decision (EU) 2016/1250 made by the EU Commission from 12th July 2016 in accordance with the Directive 95/46/EC of the European Parliament and the Council on the appropriateness of the protection offered by the EU-US data security shield.
In addition, we shall not transmit your personal data into countries outside the EU or the EEA or to international organisations.
Server logs are stored for up to 3 months.
The cookies for the selection of language or country shall be stored for three months.
The cookies placed by Google Analytics shall be stored as follows: The _ga cookie shall be stored for up to 2 years, the _gid cookie shall be stored for 1 day; all other Google Analytics Cookies shall be deleted at the latest 1 hour after you leave the website.
The Loadbalancer cookies shall be stored for up to 10 years.
Otherwise, your personal data shall be deleted without delay once you have left our website.
In addition, you have the possibility to delete installed cookies yourself at any time.
The data transmitted by you within the scope of requests shall initially be stored for the duration of the response to your request. If applicable, we shall continue to save your personal data up until the statute of limitation for any legal claims from the relationship with you, so that we can if applicable use these as evidence. The statue of limitation shall in general total between 12 and 36 months, but can also total up to 30 years. At the begining of the statute of limitation, we shall delete your personal data unless we are subject to a statutory storage obligation. These storage obligations may total from two to ten years.
In case of registrations to the fan pool, your data is stored until you deregister from the fan pool.
In case of competitions, your data shall be deleted at the latest 4 weeks after determination of the winner.
Right of information: You are authorised at any time within the scope of Art. 15 GDPR to request a confirmation as to whether we process appropriate personal data; if this is the case, you shall furthermore be authorised within the scope of Art. 15 GDPR to receive information on this personal data and certain other information (amongst other things the processing purposes, categories of personal data, categories of recipients, the planned storage duration, the origin of the data, the use of automated decision-making and, in case of the transfer of data to a non-member state, the appropriate guarantees) and a copy of your data.
Right of rectification: You are authorised to request acc. Art. 16 GDPR a rectification of the personal data we have stored if this is incorrect or erroneous.
Right of deletion: You are authorised subject to the prerequisites laid down in Art. 17 GDPR to request that we delete personal data concerning you without delay. The right of deletion shall not, amongst other things, exist if the processing of the personal data is required for (i) the exercising of the right to freedom of opinion and information, (ii) the fulfilment of a legal obligation to which we are obligated (e.g. statutory storage obligations) or (iii) the assertion or exercising of legal claims or the defence against legal claims.
Right of limitation of processing: You are authorised subject to the prerequisites laid down in Art. 18 GDPR to request that we limit the processing of your personal data.
Right of data portability: You are authorised subject to the prerequisites laid down in Art. 20 GDPR to request that we hand over to you the personal data concerning you and which you have provided to us, in a structured, conventional and machine-readable format.
Right of objection: You are authorised subject to the prerequisites laid down in Art. 21 GDPR to file an objection against the processing of your personal data, meaning that we must terminate the processing of your personal data. The right of objection only exists within the limits provided for in Art. 21 GDPR. In addition, our interests may contradict termination of the processing, meaning that we may remain authorised to process your personal data in spite of your objection.
Right of appeal to a supervisory authority: You are authorised subject to the prerequisites laid down in Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your workplace or the location of the suspected infringement, if you are of the opinion that the processing of the personal data concerning you violates the GDPR. The right of appeal shall exist irrespective of any other administrative or judicial rights of appeal.

References: Art. 6
 Art. 6
 § 15
 Art. 6
 Art. 6
 Art. 6
 Art. 15
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 21
 Art. 21
 Art. 77