Source: https://www.markus-t.com/en/service/data-protection
Timestamp: 2019-04-19 18:14:06+00:00

Document:
We only process the personal data of our users insofar as this is required for the provision of a functional website and of our content and services. The processing of the personal data of our users only takes place regularly with the consent of the user. An exception is made in cases in which it is not possible to obtain prior consent for practical reasons and the data processing is permitted by legal provisions.
Insofar as we obtain consent from the person concerned for personal data processing operations, Art. 6 para. 1 letter a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. Art. 6 para. 1 letter b GDPR serves as the legal basis for personal data processing that is necessary for the fulfilment of a contract to which the person concerned is a contracting party. This also applies to processing operations that are required for the execution of pre-contractual measures. Insofar as personal data processing is necessary for the fulfilment of a legal obligation to which our company is subject, Art. 6 para. 1 letter c GDPR serves as the legal basis. In the event that the vital interests of the person concerned or another natural person require the processing of personal data, Art. 6 para. 1 letter d GDPR serves as the legal basis. If the processing is required to preserve the legitimate interests of our company or of a third party and the interests, basic rights and basic freedoms of the person concerned do not outweigh the interests of the former, then Art. 6 para. 1 letter f GDPR serves as the legal basis for processing.
The personal data of the person concerned is deleted or blocked as soon as the purpose for storage ceases to apply. The data may continue to be stored if this is provided for by European or national legislators through directives, laws or other provisions which apply to the responsible body. The data is also blocked or deleted upon the expiry of a retention period as stipulated by the standards mentioned, unless it is necessary to continue to store the data for the purpose of concluding or fulfilling a contract.
If we process data in a third-party country (i.e., outside of the European Union (EU) or the European Economic Area (EEA)), or if this occurs during the use of services provided by third parties or the disclosure or transmission of data to third parties, this shall only happen if it serves to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual agreements, we shall only process or allow data to be processed in a third-party country under the specific conditions stated in Art. 44 et seq. GDPR. This means that the processing is carried out, e.g., on the basis of special guarantees such as the officially recognised determination of a data protection level corresponding with that of the EU (e.g., the “Privacy Shield” for the USA) or to observe officially recognised special contractual obligations (so-called “standard contractual clauses”).
The data is stored in our system’s log files. This data is not stored with other pieces of the user's personal data.
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 letter f GDPR.
The temporary storage of the IP address by the system is necessary in order to deliver the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. The storage of data in log files takes place in order to ensure the functionality of the website. Furthermore, the data allows us to optimise the website and to ensure the security of our information technology system. The data is not evaluated for marketing purposes in this context. These purposes also constitute our legitimate interest in processing data in accordance with Art. 6 para. 1 letter f GDPR.
The data is deleted as soon as it is no longer required in order to fulfil the purpose for which it was collected. In the event of data collection in order to provide the website, the data is deleted when the session ends. In the event of data storage in log files, this data is deleted after seven days at the latest. It is possible that data may continue to be stored. In this case, the IP addresses of the users are deleted or distorted so that they can no longer be allocated to the client visiting.
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Therefore, the user does not have the option to object.
The legal basis for personal data processing using cookies is Art. 6 para. 1 letter f GDPR.
If you purchase goods or services on our website and thereby disclose your email address, we may subsequently use this for the purposes of sending a newsletter. In such a case, only direct advertising for similar goods or services is sent via the newsletter. Data is not transmitted to third parties in connection with data processing for the dispatch of newsletters. The data is used exclusively to send the newsletter. The newsletter is sent via the dispatch service “MailChimp”, a newsletter dispatch platform by the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. The data protection provisions of the dispatch service provider can be found here:https://mailchimp.com/legal/privacy/. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield Agreement and therefore provides a guarantee to observe the European level of data protection (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active). The dispatch service provider is engaged on the basis of our legitimate interests in accordance with Art. 6 para. 1 letter. f GDPR and a contract for data processing in accordance with Art. 28 para. 3 sentence 1 GDPR. The dispatch service provider may use the recipient’s data in a pseudonymous form, meaning that it cannot be assigned to a user, for the optimisation or improvement of their own services, e.g., to optimise the dispatch and display of the newsletter or for statistical purposes. However, the dispatch service provider shall not use the data of those receiving our newsletter to write to them themselves or to share the data with third parties.
The legal basis for sending the newsletter after the purchase of goods or services is Section 7 para. 3 of the Unfair Competition Act (UWG).
The collection of the user’s email address serves the purpose of delivering the newsletter.
The data is deleted as soon as it is no longer required in order to fulfil the purpose for which it was collected. The user’s email address is then stored for as long as the newsletter subscription remains active.
The subscription to the newsletter can be terminated by the user concerned at any time. In this respect, a link can be found in each newsletter.
On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and cost-effective operation of our website within the meaning of Art. 6 para. 1 letter f GDPR), we use third-party content or service products within our website in order to integrate their content and services, e.g. videos or fonts (hereinafter referred to jointly as “content”). This always requires that the third-party content provider be able to detect the user’s IP address, as they cannot send the content to the browser without the IP address. The IP address is required for the display of this content. We endeavour to only use content for which the respective provider only uses the IP address in order to deliver such content. Third-party providers may also use so-called pixel tags (invisible graphics also known as “web beacons”) for statistical or marketing purposes. Information, e.g. visitor traffic on the pages of this website, can be evaluated through the “pixel tags”. The pseudonymous information can also be stored in cookies on the user’s devices and contains, among other things, technical information on the browser and operating system, referral websites, the time of the visit and other information on the use of our website, as well as being linked with such information from other sources.
On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and cost-effective operation of our website within the meaning of Art. 6 para. 1 letter f GDPR), we use social plug-ins (”plug-ins”) provided by the social network facebook.com, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"). The plug-ins can display interactive elements or content (e.g., videos, graphics or text posts) and can be recognised by one of the Facebook logos (white “f” on a blue tile, the terms, “Like”, “You like this” or a “thumbs up” symbol) or are labelled with the phrase “Facebook social plug-in”. The list and appearance of Facebook social plug-ins can be viewed here: https://developers.facebook.com/docs/plugins?locale=en_US. Facebook is certified under the Privacy Shield Agreement and thereby offers a guarantee to observe European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active). If a user requests a function of this website that contains such a plug-in, their device shall establish a direct connection with the Facebook servers. The content of the plug-in is directly transmitted from Facebook to the user’s device and integrated by the device into the website. A usage profile for the user can be generated using the data processed. We have no influence on the scope of data that Facebook collects using this plug-in and therefore provide information to the user in accordance with our level of knowledge. Through the connection provided by the plug-in, Facebook receives information that a user has opened the corresponding page of the website. If the user is logged into Facebook, Facebook can assign the visit to their Facebook account. If the user interacts with the plug-ins, for example, pressing the Like button or leaving a comment, the corresponding information is directly transmitted from their device to Facebook and stored there. If a user is not a member of Facebook, it is still possible that Facebook may find out and store their IP address. According to Facebook, in Germany, only anonymous IP addresses are stored. The purpose and scope of data collection and the further processing and use of data by Facebook, as well as the associated rights and possibilities for changing the settings to protect the user’s private life, can be found in the Facebook data protection notice: https://www.facebook.com/about/privacy/. If a user is a Facebook member and does not want Facebook to collect data about them via this website and link this with their member data that is stored with Facebook, they must log out of Facebook and delete their cookies before using our website. It is possible to make more adjustments to settings and object to the use of data for advertising purposes within your Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the American (US) website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. The settings can be changed regardless of the platform, meaning that they are applied across all devices, such as your desktop computer or mobile devices.
At the point of sending the message, the data and time of entry is also stored. Your consent will be obtained for the processing of data within the dispatch process and you will be referred to this data privacy statement in this context. Alternatively, you may contact us via the email address provided. In this case, the user’s personal data that is transmitted with the email is stored. The data is not transmitted to third parties in this context. The data is used exclusively to process the conversation.
The legal basis for data processing with the user’s consent is Art. 6 para.1 letter a GDPR. The legal basis for the processing of data that is transmitted in the course of sending an email is Art. 6 para. 1 letter f GDPR. If contact is made by email contact for the purposes of concluding a contract, the additional legal basis for processing is Art. 6 para. 1 letter b GDPR.
The processing of personal data from an input screen serves only to process the type of contact that has been made. In the case of contact being made by email, this also constitutes the required legitimate interest in data processing. The other personal data processed during the dispatch process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
The data is deleted as soon as it is no longer required in order to fulfil the purpose for which it was collected. For personal data from the contact form input screen and data which is transmitted via email, this applies when the conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved. The additional personal data collected during the dispatch process is deleted after a period of seven days at the latest.
The user has the option to revoke their consent to processing personal data at any time. If the user contacts us via email, they may object to the storage of their personal data at any time. In such a case, the conversation may not be pursued. All personal data that was stored in the course of making contact is deleted in this case.
(8) The existence of an automatic decision-making processing, including profiling, in accordance with Art. 22 paras. 1 and 4 GDPR and - at least in these cases - details regarding the logic applied as well as the implications and desired effects of such processing on the person concerned.
You have the right to request information as to whether the personal data concerning you is being transmitted to a third-party country or to an international organisation. In this context, you may request information on the suitable guarantees in place in accordance with Art. 46 GDPR in connection with the transmission.
You have a right against the person responsible to the amendment and/or completion of data if the personal data processed that concerns you is incorrect or incomplete. The responsible body must make the amendment promptly.
(4) If you have filed an objection against the processing in accordance with Art. 21 para. 1 GDPR and it is not yet certain whether the legitimate grounds of the responsible body outweigh your grounds.
If the processing of the personal data concerning you has been restricted, this data may only be processed - other than for storage - with your consent or for the assertion, exercise or defence of legal claims or to protect the rights of another natural or legal person or for reasons of significant public interest of the European Union or a Member State. If the restriction of processing has been repealed due to the aforementioned conditions, you shall be informed by the responsible body before the restriction is lifted.
(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or processed in any other way.
(2) You revoke the consent on which the processing was based in accordance with Art. 6 para. 1 letter a or Art. 9 para. 2 letter a GDPR and there is no other legal basis for the processing.
(3) You file an objection against the processing in accordance with Art. 21 para. 1 GDPR and there are no overriding legitimate reasons for the processing, or if you file an objection against the processing in accordance with Art 21 para. 2 GDPR.
(5) The deletion of the personal data concerning you is required in order to fulfil a legal obligation in accordance with European Union law or the law of the Member States which apply to the responsible body.
(6) The personal data concerning you has been collected with regard to information society services offered in accordance with Art. 8 para. 1 GDPR.
If the responsible body has made personal data concerning you public and is obliged to ensure its deletion in accordance with Art. 17 para. 1 GDPR, they shall take appropriate measures, under consideration of the technology available and the costs of implementation, including measures of a technical nature, to inform the body responsible for processing the personal data that you, as the person concerned, have requested that they delete all links to this personal data and copies or replications of this personal data.
(3) For reasons of public interest in the area of public health in accordance with Art. 9 para. 2 letter h and i as well as Art. 9 para. 3 GDPR.
If you have asserted the right to amendment, deletion or restriction of processing against the responsible body, they are obligated to inform all recipients of the personal data concerning you of this amendment or deletion of data or the restriction of processing unless this proves impossible or implies a disproportionate amount of effort. You have the right to be informed of these recipients by the responsible body.
(2) The processing takes place using automatic processes.
In exercising this right, you also have the right to have the personal data concerning you directly transmitted from one responsible body to another responsible body, provided that this is technically feasible. The freedoms and rights of other persons may not be impaired by this. The right to data portability does not apply to personal data processing that is necessary in order to carry out a task, that is in the public interest or is connected with the exercise of official authority which has been assigned to the responsible body.
You have the right, for reasons which arise from your particular situation, to file an objection against the processing of personal data concerning you that occurs on the basis of Art. 6 para. 1 letter e or f DGPR at any time; this also applies to profiling based on these provisions. The responsible body shall no longer process the personal data concerning you unless they can prove compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms or if the processing is required for the assertion, exercise or defence of legal claims. If the personal data concerning you is processed in order to carry out direct advertising, you have the right to file an objection against the processing of personal data concerning you for the purposes of such advertising at any time; this also applies to profiling if this is in connection with such direct advertising. If you object to processing for purposes of direct advertising, the personal data concerning you shall no longer be processed for these purposes. In connection with the use of information society services, irrespective of Directive 2002/58/EC, you have the option to exercise your right to object using automatic processes, for which technical specifications are used.
You have the right to revoke your consent that had been given in accordance with data protection law at any time. By revoking consent, the legality of the processing carried out until the point of revocation remains unaffected.
(3) Made with your express consent.
Nevertheless, these decisions may not be based on specific categories of personal data in accordance with Art. 9 para. 1 GDPR, provided that Art. 9 para. 2 letter a or g GDPR do not apply and suitable measures have been taken to protect rights and freedoms as well as your legitimate interests. Regarding the cases mentioned in (1) and (3), the responsible body shall take suitable measures to safeguard your rights and freedoms as well as your legitimate interests, including the right to have someone intervene on the part of the responsible body, the right to present your opinion and the right to contest the decision as a minimum.
Regardless of any other administrative or judicial remedy, you have the right to file a complaint with a regulatory authority, particularly in the Member State in which you reside or work or in the Member State in which the suspected breach occurred if you believe that the processing of personal data concerning you breaches GDPR. The regulatory authority to which the complaint has been filed shall inform the complainant of the status and the results of the complaint, including the possibility of judicial remedy in accordance with Art. 78 GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 44
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art 21
 Art. 8
 Art. 17
 Art. 9
 Art. 9
 Art. 6
 Art. 9
 Art. 9
 Art. 78