Source: https://www.schauspielfabrik.de/en/datenschutzzentrum/datenschutzerklaerung/
Timestamp: 2019-04-20 11:10:58+00:00

Document:
This data protection declaration clarifies the type, scope and purpose of the processing of personal data (hereinafter referred to as “data”) in the context of the provision of our services and within our online offering and the websites, functions and content associated with it as well as external online presences, such as our Social Media Profile (hereinafter jointly referred to as “online offering”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the Basic Data Protection Regulation (DSGVO).
If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA) or the Swiss Confederation) or if this is done in the context of the use of third party services or disclosure or transfer of data to other persons or companies, this only occurs if it is done to fulfil our (pre)contractual obligations, on the basis of your consent, a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or leave the data in a third country only if the legal requirements are met. This means that the processing takes place, for example, on the basis of special guarantees, such as the officially recognised determination of a data protection level corresponding to the EU (e.g. for the USA through the “Privacy Shield”) or the observance of officially recognised special contractual obligations.
We process the data of our customers within the scope of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design development / consulting or maintenance, implementation of campaigns and processes / handling, server administration, data analysis / consulting services and training services.
We process inventory data (e.g., customer master data, such as names or addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), contract data (e.g., subject matter of contract, term), payment data (e.g., bank details, payment history), usage and metadata (e.g., within the scope of evaluating and measuring the success of marketing measures). We do not process special categories of personal data in principle, unless these are components of a commissioned processing. Affected parties include our customers, interested parties and their customers, users, website visitors or employees as well as third parties. The purpose of the processing is the provision of contractual services, billing and our customer service. The legal basis for the processing results from Art. 6 para. 1 lit. b DSGVO (contractual services), Art. 6 para. 1 lit. f DSGVO (analysis, statistics, optimisation, security measures). We process data which are necessary for the justification and fulfilment of the contractual services and point out the necessity of their specification. Disclosure to external parties only takes place if it is required within the framework of an order. When processing the data provided to us within the framework of an order, we shall act in accordance with the instructions of the customer and the statutory requirements for order processing pursuant to Art. 28 DSGVO and shall not process the data for any purposes other than those specified in the order.
We delete the data after expiration of legal warranty and comparable obligations. the necessity of the storage of the data is reviewed every three years; in the case of legal archiving obligations the deletion takes place after their expiration (6 J, according to § 257 Abs. 1 HGB, 10 J, according to § 147 Abs. 1 AO). In the case of data disclosed to us by the client within the scope of an order, we delete the data in accordance with the specifications of the order, in principle after the end of the order.
We process the data of our clients and interested parties and other clients or contractual partners (uniformly referred to as “clients”) in accordance with Art. 6 para. 1 lit. b) DSGVO in order to provide them with our contractual or pre-contractual services. The data processed, the type, scope and purpose of their processing and the necessity of their processing are determined by the underlying contractual relationship. The processed data basically includes inventory and master data of the clients (e.g., name, address, etc.), as well as contact data (e.g., e-mail address, telephone, etc.), contract data (e.g., services used, fees, names of contact persons, etc.) and payment data (e.g., bank details, payment history, etc.).
Within the scope of our services, we may also process special categories of data in accordance with Art. 9 Para. 1 DSGVO, in particular information on the health of clients, possibly with reference to their sexual life or sexual orientation, ethnic origin or religious or ideological convictions. For this purpose, we call, if necessary, pursuant to Art. 6 para. 1 lit. a., Art. 7, Art. 9 para. 2 lit. a. DSGVO and otherwise process the special categories of data for health care purposes on the basis of Art. 9 para. 2 lit h. DSGVO, § 22 para. 1 no. 1 b. BDSG.
If required by law or for the performance of the contract, we disclose or transmit client data within the scope of communication with other specialists, third parties involved in the performance of the contract, such as accounting offices or comparable service providers, if this is necessary or typical for the provision of our services pursuant to Art. 6 Para. 1 lit. b. of the German Data Protection Act. DSGVO serves, legally according to Art. 6 para. 1 lit c. DSGVO, our interests or those of our clients in efficient and cost-effective health care are deemed to be legitimate interests in accordance with Art. 6 para. 1 lit. f. of the German Medicines Act. DSGVO or is necessary pursuant to Art. 6 para. 1 lit. d. DSGVO. to protect the vital interests of clients or another natural person or within the framework of a consent pursuant to Art. 6 para. 1 lit. a., Art. 7 DSGVO.
We use external payment service providers, through whose platforms the users and we can carry out payment transactions (e.g., in each case with link to the data protection declaration, Paypal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full), Klarna (https://www.klarna.com/de/datenschutz/), Skrill (https://www.skrill.com/de/fusszeile/datenschutzrichtlinie/), Giropay (https://www.giropay.de/rechtliches/datenschutz-agb/), Visa (https://www.visa.de/datenschutz), Mastercard (https://www.mastercard.de/de-de/datenschutz.html), American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html).
Within the framework of the performance of contracts, we shall appoint payment service providers on the basis of Art. 6 para. 1 lit. b. DSGVO. We also use external payment service providers on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f. DSGVO in order to offer our users effective and secure payment options.
The data processed by the payment service providers includes inventory data such as name and address, bank data such as account or credit card numbers, passwords, TANs and checksums, as well as contract, sum and recipient details. The information is required to complete the transactions. However, the data entered will only be processed and stored by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information with confirmation or negative information about the payment. The data may be transmitted by payment service providers to credit reference agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard we refer to the General Terms and Conditions and data protection notices of the payment service providers.
We process data in the context of administrative tasks as well as the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. Here we process the same data that we process within the framework of the provision of our contractual services. The processing bases are Art. 6 para. 1 lit. c. DSGVO, Art. 6 para. 1 lit. f. DSGVO. Customers, interested parties, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, i.e. tasks which serve the maintenance of our business activities, performance of our tasks and provision of our services. The cancellation of the data with regard to contractual services and contractual communication corresponds to the data specified in these processing activities.
We process the data of our members, supporters, interested parties, customers or other persons in accordance with Art. 6 para. 1 lit. b. DSGVO, insofar as we offer them contractual services or act within the framework of an existing business relationship, e.g. with members, or ourselves are recipients of services and benefits. We also process the data of data subjects in accordance with Art. 6 Para. 1 lit. f. DSGVO on the basis of our legitimate interests, e.g. when it comes to administrative tasks or public relations.
The data processed, the type, scope and purpose of the processing and the necessity of its processing are determined by the underlying contractual relationship. This basically includes the inventory and master data of the persons (e.g., name, address, etc.), as well as the contact data (e.g., e-mail address, telephone, etc.), the contract data (e.g., services used, contents and information communicated, names of contact persons) and, if we offer payable services or products, payment data (e.g., bank details, payment history, etc.).
We delete data that is no longer required for the performance of our statutory and business purposes. This is determined according to the respective tasks and contractual relationships. In the event of business processing, we shall retain the data for as long as it is relevant to the business transaction and also with regard to any warranty or liability obligations. The necessity of storing the data is reviewed every three years; otherwise the statutory storage obligations apply.
With the help of server monitoring and error tracking, we ensure the availability and integrity of our online service and use the data processed in this process to technically optimise our online service.
For these purposes we use the service New Relic, Inc. Attn: Legal Department 188 Spear Street, Suite 1200 San Francisco, CA 94105, USA. New Relic is certified under the Privacy Shield Agreement and thus offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TNPiAAO&status=Active).
New Relic processes aggregated performance data, i.e. performance, utilization and comparable technical values, which provide information about the stability and possible peculiarities of our online offer. In the event of errors and conspicuousness, individual requests from users of our online service are recorded pseudonymously in order to identify and eliminate sources of problems. In this case, pseudonym means in particular that the IP addresses of the users are shortened by the last two digits (so-called IP masking). The aggregated data are deleted after three months, the pseudonymised data after seven days.
We use New Relic on the basis of our legitimate interests in the security, accuracy and optimisation of our online services pursuant to Art. 6 para. 1 lit. f DSGVO.

References: Art. 4
 Art. 6
 Art. 6
 Art. 28
 § 257
 § 147
 Art. 6
 Art. 9
 Art. 6
 Art. 7
 Art. 9
 Art. 9
 § 22
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 7
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6