Source: https://www.needforseat.de/en/privacy-policy
Timestamp: 2019-04-23 14:56:28+00:00

Document:
- Contact Data (e.g. E-Mail, phone number).
- Content Data (e.g. text entries, pictures, videos).
- Usage Data (e.g. visited websites, interest in content, access time).
- Communication/Meta Data (z.B., device information, IP-address).
Visitors and users of online services (hereafter referred to as "user").
- Providing of online services, functions and content.
- Reply to contact requests and communictation with user.
"Personal data" means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be indetified, directly or indirectly, in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
"Pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
„Controller“ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
In accordance with the provisions of Article 13 GDPR we hereby provide the legal basis of data processing. If the legal basis isn't specified the following applies: The legal basis for obtaining consents is regarded to Article 6(1) lit.a and Article 7 GDPR, the legal basis for processing with regard to fulfilment and implementation of the existing contractual measures and services as well as replies to queries is regarded to Article 6(1) lit. b GDPR and the legal basis for processing and protection of our legitimate interests is regarded to Article 6, para. 1 lit. f GDPR.
In case that vital interests of affected persons or other natural entities make processing of personal data necessary, Article 6, paragraph 1 lit. d GDPR will be considered the legal basis.
In compliance with Article 32 GDPR we will take suitable technical and organisational measures to ensure a level of security appropriate to the risks, taking into account the current technical status, implementation costs and the type, extent, circumstances and purpose of processing as well as the different occurrence probabilities and the seriousness of risks to the rights and liberties of natural entities. These measures particularly include protecting the confidentiality and integrity and availability of data by monitoring the physical access to data as well as the access to this data, the entry, transmission, the proctection of availability and their separation.
Furthermore we have established processes that ensure to exercise the rights of persons concerned, the cancellation of data and reaction to endangerment of data. In addition, we respect the protection of personal data in the development or selection of hardware, software as well as processes according to the principle of data protection through forms of technology and privacy settings by default (Article 25 GDPR).
In case we disclose, forward data or grant access to other parties or companies (data processors or third parties) in connection with processing it will only happen on the basis of a legal permission (for example if the transmission of data to third parties, such as payment service providers, according to Article 6, paragraph 1 lit. b GDPR is required for the execution of a contract), you provide your consent, on the basis of a legal commitment or on the basis of our legitimate interests (for example when using commissioners, web hosters etc.). In case we will be commissioning third parties to process any data in the context of a so called "data processing agreement" it will happen on the basis of Article 28 GDPR.
In case we will be processing any data in a third party country (that means outside of the European Union (EU) or outside of the European Economic Area (EEA)) or if this happens in the context of laying claims to third party services or disclosure / transmission of data to third parties, it will only happen in the context of fulfilling our (pre-)contractual obligations on the basis of your consent, a legal commitment or on the basis of our legitimate interests.
Subject to legal or contractual permits, we will only process data or let data being processed in a third party country if special requirements according to Article 44 ff. DGPR apply. That means the processing will be based on e.g. special guarantees, such as the officially acknowledged detection of an EU level of protection of personal data (e.g. through the "privacy shield" for the USA) or on consideration of officially ackknowledged contractual obligations (so called "standard contractual clauses").
You have the right to claim a confirmation whether specific data will be processed as well as information and a copy of your data according to Article 15 GDPR. According to Article 16 GDPR you have the right to claim the completion of data that is related to you or the correction of the data that is related to you. As stated in Article 17 GDPR you have the right to demand that related data will be deleted right away or to demand reduction of processing data according to Article 18 GDPR. You are entitled to receive respective data you have provided us with and to demand transmission to other authorities according to Article 20 GDPR. Also, you are entitled to file a complaint at the resposible controlling institution according to Article 77 GDPR.
You can revoke any declarations of consent with future effect according to Article 7, paragraph 3 GDPR.
You can object to future processing of data related to you according to Article 21 GDPR any time. Objection can particularly be carried out against processing of data for the purpose of direct mail.
„Cookies“ are small data that are being saved on the user's computer. Cookies can save different types of information. A cookie is being used primarily to save information about a user (or rather the device on which the cookie is being saved) during or after their visit within an online offer. Temporary cookies, "session" - or "transient" cookies are cookies that are being deleted after a user has left an online offer and has closed his browser. Such a cookie can contain for example the content of a shopping cart within an online shop or a login status. "Permanent" or "persistent" cookies remain saved after closing the browser. That's how, for example, a login status can be saved when user's are coming back to it after a few days. Also, a permanent / persistent cookie can contain the interests of a user that will be used for reach measures or marketing purposes. "Third party cookies" are being offered by other provider than the responsible provider of the online offer (alternatively, if it's just their cookies it is referred to as "first party cookies"). We can use temporary and permanent cookies and will explain this in our data privacy statement.
The data that is being processed by us will be deleted according to Article 17 and 18 GDPR or limited in their processing. Except otherwise stated in this data privacy statement, the data we have saved will be deleted as soon as it's not needed for its specific purpose anymore and if it doesn't conflict with any legal retention requirements. In case data will not be deleted because it's still necessary for other and legally permitted purposes, their processing will be limited, that means data will be blocked and not used for other purposes. This refers to data that must be stored because of commercial or tax-based reasons. According to legal requirements in Germany, the storage will particularly take place for 10 years according to §§ 147, para. 1 AO, 257 para. 1 no. 1 and 4, para. 4 German Commercial Code (books, notes, reports, accounting records, commercial books, for taxation of relevant papers etc.) and 6 years according to $ 257 para. 1 no. 2 and 3, para. 4 German Commercial Code (business letters).
According to legal requirements in Austria, the storage will particularly take place for 7 years based on § 132 para. 1 BAO (accounting records, receipts / bills, accounts, records, business papers, records of earnings and expenses etc.), for 22 years in the context of property and for 10 years in context with papers for electronically rendered services, telecommunication-, broadcasting- and tv services that are provided to nonentrepreneurs in EU member states and for whom the Mini One Stop Shop (MOSS) will be used.
of our customers, potential buyers and business partners for the purpose of fulfilling contractual services, customer support and care, marketing, advertisement and market research.
We are processing our customer's data in line with the order processes in our online shop to enable the selection and order of selected products and services as well as their payment and delivery or fulfilment. Processed data include stock data, communication data, contractual data, payment data and the persons affected by this data handling are our customers, potential buyers and other business partners. Data processing happens on the basis of fulfilling contractual services in line with operating an online shop, accounting, delivery and customer support. We use session cookies for saving the shopping cart content and permanent cookies for saving the log-in status. Processing happens on the basis of Article 6 para. 1 lit. b (procedure of order transactions) and c (legally required storage) GDPR. In the process, all information marked as mandatory for justifying and fulfilling the contract are necessary. These data will only be disclosed to third parties in line with delivery, payment or on the basis of legal permits and obligations towards counsellors and public authorities. These data will only be processed in third party countries in case this is necessary for the fulfillment of the agreement (for example in line with a customer request at delivery or payment).
Users can optionally create a customer account that enables them to see their orders. In line with the registration, the customer will be informed about the mandatory information. Customer accounts are not visible to the public and cannot be indexed by search engines. In case a customer account is deleted, the data that is connected to that account will be deleted except the storage is necessary based on commercial or tax-based reasons in line with Article 6, para. 1 lit. c GDPR. Customer account information remain until the account is being deleted with following storage in case of a legal obligation. It is the customer's choicer to save their data in case of a cancellation before expiration of the contract. In the process of registration and following log-ins as well as using our online services, we will save the IP address and the time of respective user activity. Storage will happen on the basis of our respective interests as well as of the users protection of abuse and unauthorized use. A transmission of these data to third parties will not happen except when it is necessary to pursue our claims or when there is a legal obligation based on Article 6 para. 1 lit. c GDPR. Deletion of data will happen after expiration of legal warranty obligations (and similar), the necessity of data storage will be checked every three years; in case of legal archiving obligations the deletion of data will happen after their expiration (after 6 years relating to commercial law archving obligations and after ten years relating to law of taxation archiving obligations).
We work with external payment service providers who enable the users and us to make payment transactions (for example, each with a link to the data privacy declaration, Paypal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full), Klarna (https://www.klarna.com/de/datenschutz/), Visa (https://www.visa.de/datenschutz), Mastercard (https://www.mastercard.de/de-de/datenschutz.html), American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html). In line with fulfilling contracts, we use external payment service providers on the basis of Article 6, para. 1 lit. b GDPR. Also we do use external payment service providers on the basis of our legitimate interests according to Art. 6 Para. 1 lit. b GDPR to provide our users with effective and safe payment methods.
The data that is being processed by our external payment service providers contains information such as the name and address, payment information such as account number or credit card number, passwords, TAN's and check sums as well as contractual information, sums and recipient-related data. These information are necessary to fulfill the transactions. Provided data will be processed and saved by the payment service providers. That means we will not receive any account- or credit card related information but only confirmation or negative information in regard to the payment. Possibly data can be forwarded to credit agencies by the payment service provider. This transmission purposes the identity- and solvency check. In this context, we refer to the payment providers' terms and conditions and data policies. The payment transactions are subject to the payment poviders' terms and conditions and data policies that can be accessed through the specific web pages or transaction applications. We refer to these in terms of additional information and claim of withdrawal rights, rights to information and other rights of the persons affected.
We process data in line with administrative tasks and organisations within our company, accounting and in compliance with legal obligations such as archival storage. We process the same data that will be processed in line with the performance of our contractual services. The processing bases are Article 6, paragraph 1 lit. c GDPR, Article 6, paragraph 1 lit. f GDPR. Customers, interested parties, business partners and website visitors will be affected. The purpose and our interest in processing data lies in the administration, accounting, office organisation, archival storage of data, thus tasks that provide the preservation of our business activities, carrying out our responsibilities and our service deliveries. Deleting data regarding to contractual services and contractual communication corresponds to the tasks mentioned for the processing operations. We will disclose or transmit data to the financial administration, consultants such as tax accountants or auditors as well as other tollgates and payment providers. Also we will save information about distributors, organisers and other business partners for the purpose of contact at a later date, for example. These data, that are mostly company related, will be saved permanently.
To run our business economically and recognize market tendencies, requests of our contractual partners and users, we are analyzing the data that is provided during business processes, contracts, requests etc. We are processing inventory data, communication data, contractual data, payment data, usage data, metadata on the basis of Article 6, paragraph 1 lit. f GDPR, whereas contractual partners, interested parties, customers, visitors and users of our online service belong to the persons affected. Data analyses will be used for economic analyses, for marketing and marketing research. During this process, profiles of registered users with information about, for example, the services used can be taken into account. The analyses help us to improve user user-friendliness, optimization of our offers and business economics. The analyses are only used by ourselves and will not be disclosed externally unless they are being anonymised and summarized. In case these analyses and profiles are individual-related, they will be deleted with the cancellation of the customer or anonymised, otherwise this will happen two years after the contract has been made. Also, all economic analyses and general tendency identifications will be created anonymously.
Users can create a customer account. In the context of registration, the users will be informed about necessary mandatory information which will be processed on the basis of Article 6, paragraph 1 lit. b GDPR for the purpose of providing the customer account. The processed data include especially the login information (name, password and e-mail address). The entered data given in the process of registration will be used for the purpose of using the customer account and its purpose. Users can be informed about information that are relevant for the customer account, for example technical changes via e-mail. If a user cancels his customer account, the data referring to that account will be deleted (subject to legal storage obligations). It is up to the users to save their data before the end of the contract. We are authorised to delete all data saved during the contract period permanently.
In line with claiming our registration and sign up functions as well as using the customer account we will save the IP address and time of the specific user action. Saving will be based on our legitimate interests as well as protecting the user from abuse and other unauthorised use. Data will not be transferred or disclosed to third parties unless this is necessary to pursue our claims or if there is a legal obligation based on Article 6 paragraph 1 lit. c GDPR. The IP address will be anonymised or deleted after 7 days at the latest.
If users leave comments or other posts, their IP addresses can be saved on the basis of our legitimate rights based on Article 6 paragraph 1 lit. f GDPR for 7 days. This happens at our safety in case someone leaves comments or posts with illegal contents (insults, prohibited political propaganda etc.). In this case we can be sued for such a comment or post and therefore we are interested in the identity of the author. Also we reserve the right to process the user's information for spam detection based on Article 6, paragraph 1 lit. f GDPR. Data provided in the process of commenting or posting will be saved permanently until the user enters an objection.
When contacting us (for example by using our contact form, email, phone or social media) the user's information will be processed to handle the contact request and its execution according to Article 6 paragraph 1 lit. b) GDPR. The user's information can be saved in a customer-relationship-management system (CRM system) or similar request organisations. We will delete requests in case they are not needed anymore. We will check the necessity every two years; additionally legal archival storage obligations apply.
The following notes will inform you about the contents of our newsletters as well as the processes of signing up, delivery and statistical analyses as well as your rights of objection. When signing up for our newsletter you express your consent to receiving and the described procedures. Content of the newsletter: We will send newsletters, emails and other electronical notifications that contain promotional information (hereafter referred to as 'newsletter') only with consent of the recipient or with legal permission. In case the contents of the newsletter will be concretely described upon signing up, they are significant for the user's permission. Additionally, our newsletters contain information about our services and us.
Double-Opt-In and logging: Signing up for our newsletters happens through a so-called Double-Opt-In process. That means after signing up you'll receive an email that requests you to confirm your login. This confirmation is necessary to prevent others from signing up using your email address. Registrations for the newsletter will be logged to provide proof about the sign up process according to legal obligations. This includes saving of the sign up- and order time as well as the IP address. Also, changes to the information saved by the delivery service will be logged.
Login details: To sign up for our newsletter it is enough to provide your email address. Optionally we request a name to address you personally in our newsletter. The distribution of the newsletter and the connected performance measurement happen on the basis of the recipient's permission according to Art. 6, Paragraph 1 lit. a, Art. 7 GDPR in conjunction with § 7 Para. 2 No. 3 Law Against Unfair Competition or in case a permission is not necessary, on the basis of our legitimate interests in direct marketing according to Art. 6 Para. 1 lit. f GDPR in conjunction with § 7 Para. 3 Law Against Unfair Competition. Logging of the sign up process happens on the basis of our legitimate rights according to Art. 6 Para. 1 lit. f GDPR. Our interest is focused on providing a user-friendly and safe newsletter system that serves our company's interests, corresponds with the user's expectations and enables us to prove permissions.
Cancellation/Withdrawal - You can cancel the receiving of our newsletter at any time, that means you can revoke your permission. You can find a link to cancel the newsletter at the end of every newsletter. We can save email address for up to three years on the basis of our legitimate interests before deleting them to prove permissions given in the past. Processing these data is limited to the purpose of putting down claims. An individual deletion request is possible at all times if the former existence of a permission is confirmed.
The hosting services used by us serve the provision of the following services: Infrastructure- and platform services, calculating capacity, storage space and data base services, email dispatch, safety services as well as technical maintenance services that we use to run this online service. We or rather our hosting provider are processing stock data, contact data, content data, contract data, usage data, meta- and communication data of customers, interested persons and visitors of our online service on the basis of our legitimate interests to an efficient and safe provision of this online service according to Article 6, Para. 1 lit f. GDPR in conjunction with Art. 28 GDPR (Conclusion Job Processing Contract).
We or rather our hosting provider collects data about every access to the server that contains this service (so-called logfiles) on the basis of their legitimate interests according to Art. 6, Para. 1 lit. f GDPR. Access data contain name of the website, data, date and time of access, transmitted amount of data, notification about successful access, browser type and version, operation system and version, referrer URL (page visited before), IP address and requested provider. Logfile information will be stored for safety reasons for a maximum of 7 days (for example to clear up abuse or fraud) and will be deleted afterwards. Data that needs to be stored for evidence will not be deleted until the final clarification of the specific incident.
Additional information about data use through Google, settings and withdrawal possibilities can be found in Google's data privacy statement (https://policies.google.com/technologies/ads) as well as in the settings for advertising inserts through Google (https://adssettings.google.com/authenticated).
Individual related data will be deleted or anonymized after 14 months.
Diese Website nutzt die Funktion "demografische Merkmale" von Google Analytics. Dadurch können Berichte erstellt werden, die Aussagen zu Alter, Geschlecht und Interessen der Seitenbesucher enthalten. Diese Daten stammen aus interessenbezogener Werbung von Google sowie aus Besucherdaten von Drittanbietern. Diese Daten können keiner bestimmten Person zugeordnet werden. Sie können diese Funktion jederzeit über die Anzeigeeinstellung in ihrem Google-Konto deaktivieren oder die Erfassung Ihrer Daten durch Google Analytics wie im Punkt "Google Analytics" dargestellt generell untersagen.
Diese Funktion ermöglicht es die mit Google Analytics Remarketing erstellten Werbe-Zielgruppen mit den geräteübergreifenden Funktionen von Google AdWords und Google DoubleClick zu verknüpfen. Auf diese Weise können interessenbezogene, personalisierte Werbebotschaften, die in Abhängigkeit Ihres früheren Nutzungs- und Surfverhaltensauf einem Endgerät (z.B. Handy) an Sie angepasst wurden auch auf einem anderen Ihrer Endgeräte (z.B. Tablet oder PC) angezeigt werden. Haben Sie eine entsprechende Einwilligung erteilt, verknüpft Google zu diesem Zweck Ihren Web- und App-Browserverlauf mit Ihrem Google-Konto. Auf diese Weise können auf jedem Endgerät auf dem Sie sich mit Ihrem Google-Konto anmelden, dieselben personalisierten Werbebotschaften geschaltet werden.
Diese Zusammenfassung der erfassten Daten in Ihrem Google-Konto erfolgt ausschließlich auf Grundlage Ihrer Einwilligung, die Sie bei Google abgeben oder wiederrufen können (Art. 6 Abs. 1 lit. a DSGVO9. Bei Datenerfassungsvorgängen, die nicht ih Ihrem Google-Konto zusammengeführt werden (z.B. weil Sie kein Google-Konto haben oder der Zusammenführung widersprochen haben) beruht die Erfassung der Daten auf Art.6 Abs. 1lit. f DSGVO. Das berechtigte Interesse ergibt sich daraus, dass der Websitebetreiber ein Interesse an der anonymisierten Analyse der Websitebesucher zu Werbezwecken hat.
Diese Website verwendet Google AdWords. AdWords ist ein Online-Werbeprogramm der Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, Unitred States ("Google").
Im Rahmen von Google AdWords nutzen wir das so genannte Coversion-Tracking. Wenn Sie auf eine von Google geschaltete Anzeige klicken wird ein Cookie für das Conversion-Tracking gesetzt. Bei Coockies handelt es sich um kleine Textdateien, die der Internet-Browser auf dem Computer des Nutzers ablegt. Diese Cookies verlieren nach 30 Tagen ihre Gültigkeit und dienen nicht der persönlichen Indentifizierung der Nutzer. Besucht der Nutzer bestimmte Seiten dieser Website und das Cookie ist noch nicht abgelaufen, können Google und wir erkennen, dass der Nutzer auf die Anzeige geklickt hat und zu dieser Seite weitergeleitet wurde.
Jeder Google AdWords-Kunde erhält ein anderes Cookie. Die Cookies können nicht über die Websites von AdWords-Kunden nachverfolgt werden. Die mithilfe der Conversion-Cookies eingeholten Informationen dienen dazu, Conversion-Statistiken für AdWords-Kunden zu erstellen, die sich für Conversion-Tracking entschieden haben. Die Kunden erfahren die Gesamtanzahl der Nutzer, die auf ihre Anzeige geklickt haben und zu einer mit einem Conversion-Tracking-Tag versehenen Seite weitergeleitet wurden. Sie erhalten jedoch keine Informationen, mit denen sich Nutzer persönlich indentifizieren lassen. Wenn Sie nicht am Tracking teilnehmen möchten, können Sie dieser Nutzung wiedersprechen, indem Sie das Cookie des Google Conversion-Trackings über ihren Internet-Browser unter Nutzereinstellungen leicht deaktivieren. Sie werden sodann nicht in die Conversion-Tracking Statistik aufgenommen.
Die Speicherung von "Conversion-Cookies" und die Nutzung dieses Tracking-Tools erfolgen auf Grundlage von Art. 6 Abs.1 lit. f DSGVO. Der Websitebetreiber hat ein berechtigtes Interesse an der Analyse des Nutzverhaltens, um sowohl sein Webangebot als auch seine Werbung zu optimieren.
Sie können Ihren Browser so einstellen, dass Sie über das Setzen von Cookies informiert werden und Cookies nur im Einzelfall erlauben, die Annahme von Cookies für bestimmte Fälle oder generell ausschließen sowie das automatische Löschen der Cookies beim Schlißen des Browsers aktivieren. Bei der Deaktivierung von Cookies kann die Funktionalität dieser Website eingeschränkt sein.
Within our online service we will use the so-called "Facebook Pixel" by the social network Facebook that is being operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA or if you are located within the EU Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook") on the basis of our legitimate interests to analyze, optimize and run our online service economically.
We do run several online presences within our social networks and platforms to communicate with active customers, interested persons and users to inform them about our services.
Beim Aufruf der jeweiligen Netzwerke und Plattformen gelten die Geschäftsbedingungen und die Datenverarbeitungsrichtlinien deren jeweiligen Betreiber. Soweit nicht anders im Rahmen unserer Datenschutzerklärung angegeben, verarbeiten wir die Daten der Nutzer sofern diese mit uns innerhalb der sozialen Netzwerke und Plattformen kommunizieren, z.B. Beiträge auf unseren Onlinepräsenzen verfassen oder uns Nachrichten zusenden.

References: § 132
 Art. 6
 Art. 6
 Art. 7
 § 7
 Art. 6
 § 7
 Art. 6
 Art. 28
 Art. 6
 Art.6
 Art. 6