Source: https://news.upday.com/fr/legal/
Timestamp: 2019-04-24 17:57:47+00:00

Document:
We process your data exclusively on the basis of one or more of the applicable legal regulations. Pursuant to GDPR, personal data can be processed on the basis of a contract or on the implementation of pre-contractual measures—subject to compliance—on the basis of legitimate interests or a law, and for the protection of essential or public interests. Registration is required in order for us to provide certain content or services on our website. Every user can register themselves for free at upday by specifying their first name, last name, email address, and a password, after which your registration data is sent to us. The collection and processing of this data is carried out in line with the licence agreement between us and the user, Art. 6, § 1 b GDPR. We’ll also use the email address we collected in the course of your registration or in the context of contract management, to inform you about similar products or services as well as previously existing subscriptions or general information on upday. In this case, email address processing is carried out on the basis of our legitimate interests in requests for our products and services (Art. 6, § 1 f GDPR). In addition, we use your email address to send you our newsletter, if you’ve clearly indicated your agreement to receiving newsletter content or, as the case may be, publicity. To this effect we process your email address in order to send you the newsletter, as requested (Art. 6, § 1 f GDPR). You can always object, either in writing or per email, to the usage of your email address for such purposes taking effect in the future: 65, Axel-Springer-Str., Berlin, 10888, privacy@upday.com. No costs will be charged other than the transmission costs according to the base rate. On the Internet, every device needs to have a clear address for the transferral of data. This is called the IP address. Preliminary storage of the IP address is technically required in order to transfer the website to the computer of the user. In doing so, we abridge IP addresses before processing, thus, any later processing will take place anonymised. Any further storage or processing related to the unabridged IP addresses will not take effect. In addition, our servers save your IP address for 14 days for the purpose of your safety. During processing operations, which are determined by one or several of the previously mentioned legislative bases, processing will take place when it’s necessary for the purpose of preserving legitimate interests, unless these legitimate interests are overridden on the basis of a comprehensive weighing of your interests, and your fundamental rights and freedoms (Art. 6, § 1 f GDPR). A legitimate interest can be assumed when the person concerned is a customer of the controller. The processing of personal data and our legitimate interest therein and, in particular, the execution of our business operations, shall be in favour of the welfare of our employees and our shareholders. Our legitimate interest in offering you custom products, informing you on our products, improvements, and quality features, as well as continuing to improve our services and products, through which we’re also able to increase our sales, is the legal basis for the purpose of Big Data processing, online behavioural advertising, web/app analysis, and advertisement ranking (gathering different selection criteria for suitable advertising). For more detail on web analytics services see section 8. You can object to data processing on the basis of legitimate interests at any time (see section 12). In case the data is processed for any other purpose than as determined by data collection, a compatibility assessment will be carried out (see Art. 6, § 4 GDPR). Subsequent processing is only permitted if the original purpose is compatible with the new purpose, or when allowed by reason of a special legal basis. Recognised compatible purposes are, among others, enforcement, exercising or defence of claims subject to civil law, insofar as no overriding interest of the person concerned exists. We will inform you in case of a change in purpose. A new data collection will take place on the grounds of a new legal basis if the new purpose is incompatible with the purpose as determined by data collection. We will inform you on the change in purpose, should this be the case.
We will not transfer your personal data to countries outside of the European Economic Area (“EEA”) except when, in certain cases, it is permitted by the GDPR. Whether or not third parties with whom you have a contractual relationship (e.g. Facebook, if you have a Facebook account) transfer data to countries outside of the European Economic Area is not something we have any knowledge of, nor something we’re able to influence. We also process data in countries outside of the European Economic Area. To guarantee the protection of your personal rights, also in the context of these particular data transfers, we make sure to handle the contractual relationships with recipients in third party countries in compliance with the arrangement of standard contract clauses of the EU commission, corresponding to Art. 46 § 2 C, GDPR. These are available at all times via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:31995L0046. Alternatively, you can request the documents using the contact information below. With the launch of the EU-U.S. Privacy Shield on 12/07/2016, the European Commission decided that, in view of these regulations, an appropriate level of personal data protection exists (adequacy decision, Art. 45, GDPR). Further information—also on certification of the service provider we deployed—you can find on https://www.privacyshield.gov. We only use US service providers who are certified according to the EU-U.S. Privacy Shield.
We only transfer your personal data to third parties when this transfer is required in order to fulfil our contractual obligations to you, and when this takes place with or in collaboration with another provider (e.g. in case of co-operations), when we are otherwise legally entitled or required to transfer your data, or when you have given us your consent. In order to provide our services, certain departments within our organisation can be informed of selected pieces of personal data. This includes employees working in bookkeeping, product management, marketing, and IT. In certain cases we also commission and deploy external service providers or connected companies in order to process data as instructed by us. We employ service providers for the purpose of processing. They are bound by strict contractual stipulations which are in compliance with the GDPR. They are not permitted to use your data for any other purposes. The processors provide the following services to us: registration service(s), content recommendation, hosting, customer service, survey and commentary service(s), maintenance and support service(s), and web/app analysis. The data transferral to processors takes place in accordance with Art. 28, § 1 GDPR, and alternatively on the basis of our legitimate interests in economic and technical gain with the deployment of specialised contractual processors, Art. 6 § 1 f GDPR. We will transfer data to public authorities provided that we’re obliged by law or when this is allowed for reasons of data protection, for instance the police or the department of public prosecution (Art. 6, § 1 c GDPR). This data transferral is for the purpose of our legitimate interests in fighting abuse, the prosecution of criminal offence, and the protection, enforcement, and execution of claims, as long as these are not overridden by your interest in, and fundamental right to, protection of your personal data, Art. 6 § 1 f GDPR.
We only store personal data for as long as we are legally entitled to, and provided that the processing purpose is still applicable. A statutory retention period is applied to the respective storage duration of personal data. After this period has ended, the respective data is routinely deleted, as long as the data isn’t required any more for contractual fulfilment or contract initiations.
Please contact our Data Security Officer in case of questions or comments on data protection, as well as the implementation of your rights as a person concerned: upday GmbH & Co. KG Datenschutz 65, Axel-Springer-Str. 10888 Berlin privacy@upday.com. Right to information and rectification We can send you information on which, if any, personal data belonging to you is being processed by us, in addition to which of your personal data is stored. You may request a copy of this information. Furthermore, you can request to rectify discrepancies and add missing information. Right to Erasure, right to restriction, and the right to be forgotten You can request the erasure and the restriction of your personal data. However, please note that, in some cases, we’re not able to erase all of your data. For instance, in case of legal storage obligations for contracts relating to the purchase of an upday subscription. In this case, your data will be marked with a restriction for future processing. Right to data portability You also have the right, insofar as applicable, to the transferral of your personal data to you or another responsible party in a structured, commonly used, and machine-readable format, insofar as the processing is based on consent or on a contract, and the processing is carried out by automated means. However, this right does not apply in case the processing is not necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller. In addition, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and insofar as the rights and freedoms of another person are not affected. Right to Object You can retract your consent at any time by contacting the abovementioned address to take effect in the future. Furthermore, you have the right to object to the processing of personal data concerning you, which is taking place on the basis of a legitimate or public interest, on grounds relating to your particular situation. Including profiling based on these provisions. We will no longer process the personal data in case of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the person concerned or the processing is for the purpose of the establishment, exercise or defence of legal claims. In case we process personal data for direct marketing purposes, you will have the right to object at any time to the processing of your personal data for such marketing by contacting the abovementioned address. This also includes profiling, to the extent that it is related to such direct marketing. In addition, you have the right object to processing of your personal data on grounds relating to your particular situation, for scientific or historical research purposes or statistical purposes, unless the processing is necessary for the performance of a task carried out for reasons of public interest. Right to Lodge a Complaint Moreover, you have the right to legal remedy from your supervising authority as well as the possibility to lodge a complaint. The supervision authority with which the complaint has been lodged, shall inform the complainant on the progress and the outcome of the complaint including the possibility of legal remedy. Automated decision-making We do not use any form of automated decision-making or profiling.
This app uses photos of the German Press Agency dpa and Getty Images International.

References: Art. 6
 § 1
 § 1
 § 1
 § 1
 Art. 6
 § 4
 Art. 46
 § 2
 Art. 45
 Art. 28
 § 1
 Art. 6
 § 1
 § 1
 Art. 6
 § 1