Source: https://mybilou.com/privacy-policy.html
Timestamp: 2019-04-21 16:02:50+00:00

Document:
This document was prepared by nuwena GmbH, Postfach 120641, 69067 Heidelberg, Phone: +49 (0) 6221 65 66 420, Email: privacy@bilou.de (shortened to “nuwena” below) – acting as the responsible party in the sense of the General Data Protection Regulation (GDPR), national data protection laws by member states, and other national data protection legislation – to inform you about the collection of your personal data conducted as you browse any of the web pages accessible under www.bilou.de (collectively referred to as the “website” below). The term “personal data” includes any data that can be associated with a data subject, e.g. name, address, email address, user behaviour.
This section provides general information about our data processing. More detailed information about each of the features offered on the website and any technologies relevant to data protection used by these features can be found in Section B.
We only collect and use personal data to the extent required to ensure that our website remains functional and to provide our content and services. Your personal data are collected and used at regular intervals, but only after you have given your consent. Exceptions only exist when obtaining prior consent is not possible for practical reasons and the relevant data processing steps have been established as legally admissible.
Whenever the consent of a data subject is requested for the processing of personal data, the legal basis for our processing of these data is given by Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR). Whenever the processing of personal data is necessary to fulfil a contract with a data subject, the legal basis for data processing is given by Art. 6(1)(b) GDPR. This also applies to any processing steps towards pre-contract activities. Whenever the processing of personal data is necessary to fulfil a legal obligation imposed upon our company, the legal basis for this processing is given by Art. 6(1)(c) GDPR. If the processing of personal data is necessary for the vital interests of the data subject or another natural person, the legal basis for this processing is given by Art. 6(1)(d) GDPR. If the processing of personal data is necessary to safeguard the legitimate interests of our company or a third party, and provided that the interests, fundamental rights, and freedoms of the data subject do not overrule these interests, the legal basis for this processing is given by Art. 6(1)(f) GDPR.
The personal data of data subjects are deleted or blocked as soon as the purposes for which these data were stored expire. Data may be stored for longer if subject to any EU regulations, laws, or other legislation by European or national legislative authorities imposed upon the responsible party. Personal data are also blocked or deleted after the relevant storage periods specified by these regulations expire, unless continued storage of the data is necessary to conclude or fulfil a contract.
Any transactions involving third-party service providers, or instances in which your data may be used for advertising purposes in connection with specific aspects or features of our services, are presented in detail below. Your consent will be requested separately at a suitable moment wherever necessary. The criteria that determine the storage duration are specified in each case.
You also have the right to submit a complaint to the data protection authorities regarding our processing of your personal data.
(8) information about the use of automated decision-making processes including profiling in accordance with Art. 22(1,4) GDPR and – at least in cases where this provision applies – meaningful insight into the logic involved and the scope and intended impact of this processing from the perspective of the data subject.
You may also request information about whether your personal data were disclosed to any third countries or international organizations, as well as information about any guarantees provided by Art. 46 GDPR in connection with this disclosure.
You have the right to rectify and/or complete your personal data whenever the data we process are incomplete or inaccurate. We have an obligation to implement this rectification immediately.
(4) if you submit an objection to the processing in accordance with Art. 21(1) GDPR and it has not yet been established whether our legitimate interests override your own interests.
Once the processing of your personal data has been restricted, we may only process your personal data – excluding the storage of these data – either (i) with your consent; (ii) in order to assert, exercise, or defend legal claims or protect the rights of another natural or legal person; (iii) if there exist important public interests for the EU or a member state. If the processing of your personal data has been restricted as outlined above, we will notify you before the restrictions are lifted.
(6) if your personal data were collected for information society services in accordance with Art. 8(1) GDPR.
If we disclosed your personal data publicly and are subsequently required to delete the data in accordance with Art. 17(1) GDPR, we will take reasonable measures subject to available technological means and implementation costs, including any relevant technical measures, to inform the parties responsible for processing your personal data that you, in your capacity as the data subject, have requested the deletion of all links to your personal data, as well as any copies or replications of these data.
(5) in order to assert, exercise, or defend legal claims.
Whenever you exercise your right to rectify, erase, or restrict our processing of your personal data, we have an obligation to notify any recipients to whom your personal data were disclosed of the rectification, erasure, or restriction, unless this proves impossible or would involve unreasonable effort. You have the right to request information about these recipients from us.
(2) the processing is performed by automatic systems.
When exercising this right, you may furthermore request that your personal data be transmitted directly by us to another responsible party whenever this is technically possible. This may not infringe upon the freedoms and rights of other persons. The right to data portability does not apply to any processing of personal data necessary to perform tasks in the public interest or to exercise any official authority delegated to the party responsible for your data.
You have the right to object at any time to any processing of your personal data conducted on the legal basis of Art. 6(1)(e-f) GDPR for personal reasons; this also applies to any profiling conducted on the basis of these provisions.
If you object, we will no longer process your personal information, unless either (i) we can establish compelling legitimate reasons for this processing that override your own interests, rights, and freedoms; (ii) the purpose of processing is to assert, exercise, or defend legal claims. If your personal data are processed for purposes associated with direct marketing, you have the right to object at any time; this also applies to any profiling associated with direct marketing activities. If you object to processing for purposes associated with direct marketing, your personal data will no longer be processed in connection with any such purposes. For information society services – independently from Directive 2002/58/EC – you may exercise your right to objection via an automated procedure that implements the relevant technical specifications.
You have the right to revoke consent regarding matters of data protection at any time. Revoking your consent does not retroactively affect the legality of any processing conducted on the basis of this consent before the moment of revocation.
(3) if you have given express consent for the automated processing of these decisions.
However, these decisions may not be based on special categories of personal data in accordance with Art. 9(1) GDPR unless appropriate measures have been taken to safeguard your rights, freedoms, and legitimate interests in accordance with Art. 9(2)(a,g) GDPR. In the cases outlined in (1) and (3), we shall undertake appropriate measures to safeguard your rights, freedoms, and legitimate interests, including implementing your right to request human involvement from us, the right to submit arguments to support your position, and the right to challenge the decision.
Without affecting any of your other administrative or judicial rights, you have the right to submit a complaint to the supervisory authorities – in particular the authorities in the member state of your place of residence, your place of work, or the place of the alleged infringement – if you believe that our processing of your personal data is in violation of the GDPR. The authority to which the complaint is submitted will keep the complainant informed of the status and results of the complaint, including any options of judicial remedy in accordance with Art. 78 GDPR.
If you give consent for processing your personal data, you may revoke this consent at any time. Any such revocation only affects the admissibility of processing your personal data after you have communicated it to us.
If a balance of interests serves as the legal basis for our processing of your personal data, you may submit an objection to this processing. In particular, this applies whenever the processing is not necessary to fulfil a contract with you, as described below for each of the specific features of our website services. If you wish to submit this type of objection, please give reasons justifying why we should stop processing your personal data. After receiving your objection and arguments, we will examine the situation and either (i) discontinue the data processing; (ii) respond to you with a statement of compelling legitimate reasons for the continuation of data processing.
The log files contain IP addresses and other data that may be associable with specific users. For example, the referring link used to access our website or any links followed by the user from our website may contain personal data.
These data are stored in our system log files. They are never stored together with any other personal data associated with the user.
The legal basis for the temporary storage of these data and log files is given by Art. 6(1)(f) GDPR.
The system needs to temporarily store IP addresses in order to deliver the website to the user’s device. This requires the user’s IP address to be stored for the duration of their session.
The purpose of storing these data in log files is to ensure the proper functionality of the website. The data are also used to optimize our website and secure our IT systems. These data are never analysed for marketing purposes.
We therefore have a legitimate interest in processing these data in accordance with Art. 6(1)(f) GDPR.
The data are deleted as soon as they are no longer necessary for the purpose for which they were originally stored. For the data collected in order to deliver the website, this occurs at the end of each user session.
For the data stored in the log files, this occurs after seven days at the latest. In some cases, the data may be stored for longer. If so, the user IP addresses are deleted or anonymized so that they can no longer be associated with the clients that requested each web page.
The data collected in order to deliver the website and the data stored in the log files are essential for the proper operation of the website. As a result, it is not possible to object to this data collection.
In addition to the data mentioned above, cookies are stored on your device while you browse our website. Cookies are small text files saved on your hard drive and associated with your browser. They are created by websites or similar services (in this case, us) to manage certain types of information. Our cookies contain a characteristic string that uniquely identifies your browser when you return to our website. Cookies are not capable of running programs or transmitting viruses to your device.
The legal basis for the processing of personal data via cookies is given by Art. 6(1)(f) GDPR.
The user data collected by the technically necessary cookies are not used to establish user profiles.
The purpose of the analytic cookies is to improve the quality of our website and its content. The analytic cookies provide us with information about how the website is used, which allows us to continuously optimize the content and services provided.
We therefore have a legitimate interest in processing these personal data in accordance with Art. 6(1)(f) GDPR.
Cookies are stored on the user’s device, which forwards them to our web page. Accordingly, users have full control over the usage of cookies. By changing your internet browser settings, you can disable or restrict the transmission of cookies. Any previously stored cookies can be deleted at any time. This can also be configured to occur automatically. If you choose to deactivate cookies for our website, some of the features of the website may not function as intended.
Flash cookies are not managed directly by your browser but instead by your Flash plugin. The transmission of Flash cookies cannot be prevented by changing your browser settings and must be configured in the Flash player settings. We also use HTML5 storage objects, which are stored on your device. These objects store data independently from your browser and do not have an automatic expiration date. If you wish to prevent the processing of Flash cookies, you need to install an add-on, e.g. “Better Privacy” for Mozilla Firefox (https://addons.mozilla.org/de/firefox/addon/betterprivacy/), or the Adobe Flash Cookie Killer for Google Chrome. You can prevent the storage of HTML5 objects by using your browser’s private navigation mode. We also recommend regularly deleting your cookies and browser history manually.
Other than the regular browsing content hosted on our website, we offer various optional services. To take advantages of these services, you typically need to provide additional personal data. We require these data in order to provide the relevant services. The general principles of data processing outlined above apply.
In some cases, we use third-party service providers in order to process your data. These service providers are carefully selected and have contractual relationships with us; they have an obligation to follow our instructions and are regularly inspected.
We may also disclosure your personal data to third parties whenever campaign participations, competitions, contracts, or similar services are offered collaboratively with our partners. More detailed information about these disclosures are provided in the description of each specific service either when you enter your personal data or in the paragraphs below.
If any of our service providers or partners are based in a country from outside the European Economic Area (EEA), you will be informed about any relevant ramifications in the description of each specific service.
Our website lists an email address that you can use to contact us. If you contact us by email, any personal data transmitted with the email will be stored. These data will not be disclosed to any third parties. They are exclusively used to respond to and process the subject matter of the email.
The legal basis for processing data with the consent of the user is given by Art. 6(1)(a) GDPR. The legal basis for processing the data associated with emails is given by Art. 6(1)(f) GDPR. If the purpose of the email is to conclude a contract, then Art. 6(1)(b) GDPR serves as an additional legal basis for data processing.
In the event of contact by email, this contact itself represents our legitimate interest for processing the data.
The data are deleted as soon as they are no longer necessary for the purpose for which they were originally stored. For any personal data transmitted by email, this occurs when the conversation with the user has been concluded. The conversation is considered concluded once the specific circumstances of the conversation imply that any relevant matters have been definitively resolved.
Users may revoke their consent for the processing of personal data at any time. If the user initiates email contact with us, he/she may object to the storage of his/her personal data at any time. In this case, the conversation must be terminated and cannot be continued.
Any personal data stored over the course of this contact will then be deleted.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6