Source: https://www.prooffice.com/shop/privacy
Timestamp: 2019-04-25 22:21:29+00:00

Document:
In the area of ​​card payment (direct debit / giro card / credit cards) we work together with Concardis GmbH (Concardis), Helfmann Park 7, D-65760 Eschborn, represented by their managing directors Mark Freese, Jens Mahlke and Luca Zanotti.
In this context, in addition to the purchase amount and date, card data is also transmitted to the above-mentioned company.
All payment data and data on any chargebacks that may occur are only stored as long as they are needed for the processing of payments (including the processing of possible chargebacks and collection of receivables) and for the fight against abuse. As a rule, the data are deleted no later than 13 months after their collection.
In addition, further storage may take place if and as long as this is necessary to comply with a statutory retention period or to prosecute a specific case of abuse. The legal basis for data processing is Art. 6 para. 1 f) General Data Protection Regulation.
You may request information and, if necessary, rectification or deletion, as well as the limitation of the processing of your data and / or possibly object to the processing of your data. If you have any questions about data processing by Concardis or to assert your rights, you can contact the Data Protection Officer, who can be reached at the address given or by email at Datenschutzbeauftragter@concardis.com.
Furthermore, you have the right to complain to a supervisory authority (in Germany at the State Data Protection Commissioner). Please note that the provision of payment data is neither legally nor contractually required. If you do not want to provide your payment details, you can use a different payment method.
We utilise the services of BS PAYONE GmbH (hereinafter: BS PAYONE) as a service provider for processing cashless payment transactions. The informati- on required by law pursuant to GDPR Art. 14 on data processing by BS PAYONE is provided below.
BS PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt am Main/Germany, www.bspayone.com; Managing Directors: Niklaus Santschi, Jan Kanieß, Dr. Götz Möller, Carl Frederic Zitscher; Chairman of the Super- visory Board: Ottmar Bloching.
BS PAYONE’s data protection officer can be contacted at the aforementioned address, c/o the data protec- tion officer, or by e-mail to privacy@bspayone.com.
BS PAYONE as a payment institution is licensed and supervised by the German Federal Financial Super- visory Authority, Graurheindorfer Straße 108, 53117 Bonn/Germany.
The main reason for data processing is to process cashless payment transactions (transaction proces- sing) in stationary shops and online commerce.
Aggregated micromanagement: Aggregation/ compilation of receivables in specific billing cycles to simplify payment processes and optimize costs.
Within the context of processing payment transac- tions, data processing is required to fulfil the purcha- se contract or other main contract (e.g. service or works contract) between the contractual partner/ merchant and cardholder/user and is thus justified for contract execution in accordance with GDPR Art. 6 (1) Sentence 1 b). In all other cases, data processing is based on the legitimate interests of BS PAYONE or its contractual partners, GDPR Art. 6 (1) Sentence 1 f). Legitimate interests particularly include the avoidance of payment default (protection against financial risk), the simplification of payment processes and cost optimization in the mutual interest of the parties (cardholder/user and contractual partner/merchant).
BS PAYONE retains and processes personal data only if necessary for the performance of the respective service. Depending on the payment procedure, the IBAN, card number, verification digits and other transaction data (e.g. date/time of the transaction, payment amount) are processed during payment processing. Fraud prevention is also primarily based on processed transaction data. For receivables ma- nagement/debt collection, information processed includes the invoice/payment amount, due date and invoice recipient. The credit check is carried out, for example, on the basis of address, account and card data, which are transmitted to the credit agencies commissioned for this purpose. Information on the invoice recipient, the bank details and the payment amount is also required to create invoices. In addi- tion to the invoice recipient and payment amount data, subscription processing also requires informa- tion on the contract term and agreed billing cycles. Aggregated micromanagement performs data pro- cessing, for example, as related to the billing period, the number of transactions, the invoice recipient and the bank details/card number.
The cardholder/user’s personal data is collected by the contractual partner/merchant - depending on the method, via the POS terminal in the stationary shop or via online-shop/website - and transmitted by the latter to BS PAYONE for execution of the afore- mentioned services.
Authorities (particularly investigative authorities such as the police and the public prosecutor‘s office) in the event of justified requests for infor- mation.
Some of the data recipients are located in third countries, i.e. countries not in the European Union (EU) or the European Economic Area (EEA), where the level of data protection may be lower than within the EU/EEA. BS PAYONE only transfers personal data to third countries if this is necessary to fulfil contrac- tual obligations, to safeguard legitimate interests or if otherwise required by law.
To ensure an adequate level of data protection in third countries, there exists either a valid adequacy decision by the EU Commission or adequate and appropriate guarantees in the form of EU standard contractual clauses or privacy shield certifications, or a legal exception is applicable (GDPR Art. 49) which justifies data transfers without the existence of an adequacy decision or suitable guarantees.
Preservation of evidence within the framework of the statutory limitation period.
Creditreform Boniversum GmbH, Hellersbergstras- se 11, 41460 Neuss/Germany.
If relevant, BS PAYONE receives probability and sco- ring values from credit agencies and BS PAYONE then uses these as a basis for making recommenda- tions on payment methods offered.
Information on the activities of infoscore Consu- mer Data GmbH as required by GDPR Art. 14 is available at: https://finance.arvato.com/icdinfoblatt. Information pursuant to GDPR Art. 14 on Creditre- form Boniversum GmbH is available at: https://www. boniversum.de/wp-content/uploads/2018/04/Boni- versum_information_sheet_on_issuance_to_custo- mers_bank_credit_institutions.pdf.
Each data subject has the right of access according to GDPR Article 15, the right to rectification accor- ding to GDPR Article 16, the right to erasure accor- ding to GDPR Article 17, the right to restriction of processing according to GDPR Article 18, the right to object according to GDPR Article 21 and the right to data portability according to GDPR Article 20, each subject to the relevant legal conditions. In the case of the right of access and the right of erasure, the re- strictions pursuant to the new German Federal Data Protection Act (BDSG) §§ 34 and 35 also apply.
§ 19). This right can be exercised, for example, at the supervisory authority responsible for BS PAYO- NE, i.e. the Hessian Data Protection Commissioner, Gustav-Stresemann-Ring 1, 65189 Wiesbaden/Ger- many, https://datenschutz.hessen.de/.
Using of social plugins of Facebook, Google, Twitter, Pinterest, Xing using the Shariff solution.

References: Art. 6
 Art. 14
 Art. 6
 Art. 6
 Art. 49
 Art. 14
 Art. 14

§ 19