Source: https://www.winter.de/en/privacy-policy/
Timestamp: 2019-04-23 09:02:35+00:00

Document:
IMPORTANT: Please note that the German version of this privacy statement is legally binding – the English translation on hand is only for your convenience and in no way modifies the German version. For the German version, please simply switch the language of this website.
As a matter of principle, we only process our users’ personal data as far as it is necessary in order to provide a functional website and to present our contents and services. We process our users’ personal data regularly only if the respective users have given their consent. The only exception to this is where it is actually impossible for us to obtain prior consent and processing of the data is lawful.
Where we obtain the corresponding data subject’s consent for processing personal data, Art. 6(1) lit. a of the EU General Data Protection Regulation (hereinafter referred to as “GDPR“) serves as the legal basis.
Where we need to process personal data for the purposes of fulfilling a contract, and the data subject is party to that contract, Art. 6(1) lit. b of the GDPR serves as the legal basis. The same applies to such processing operations, which are necessary for carrying out pre-contractual measures.
Where processing of personal data is necessary for our company to fulfil a legal obligation, Art. 6(1) lit. c of the GDPR serves as the legal basis.
Where processing of personal data is necessary for protecting the vital interests of the data subject, or those of another natural person, Art. 6(1) lit. d of the GDPR serves as the legal basis.
Where processing is necessary to protect our company’s legitimate interests, or those of a third party, and such interests are not overridden by the interests, fundamental rights and freedoms of the data subject, Art. 6(1) lit. f of the GDPR serves as the legal basis.
The data subject’s personal data will be deleted or blocked as soon as the purpose for which it has been collected has been fulfilled. Data may remain on record beyond this period if specified in European or national legislation from European Union Regulations, laws or other provisions to which the data controller is subject. Data will also be blocked or deleted if a storage period specified in the above standards expires, unless conclusion or fulfilment of a contract requires the data remain on record further.
Every time our website is accessed, our system automatically records data and information concerning the accessing computer.
The data is also recorded in our system’s log files. This data is not stored together with any of the user’s other personal data.
The legal basis for temporary recording of data in our log files is Art. 6(1) lit. f of the GDPR.
The abovementioned purposes also constitute our legitimate interests in data processing within the meaning of Art. 6(1) lit. f of the GDPR.
With respect to data being recorded in log files, the data is no longer required after seven days at the latest. Data may remain on record for longer. In those cases, the users’ IP addresses are deleted or rendered untraceable to make identification of the accessing client impossible.
The website cannot be provided without recording the data and the operation of the site in the Internet is impossible without storing the data in log files. Correspondingly, there is no option for the user to object.
Our website further employs cookies that facilitate the analysis of the users’ web-surfing behaviour.
The legal basis for using technically necessary cookies to process personal data is Art. 6(1) lit. f of the GDPR.
If consent concerning this matter has been obtained, the legal basis for the processing of personal data by using cookies for analysis purposes is Art. 6(1) lit. a of the GDPR.
The purpose of using technically necessary cookies is to make using our website easier for users. Several of our website’s functions cannot be offered without using cookies. These functions require the browser be recognized after a page change.
We use analysis cookies to improve the quality of our website and its contents. The analysis cookies enable us to gain knowledge of how the website is being used and this way allow us to keep optimizing our offer. The abovementioned purposes also constitute our legitimate interests in processing personal data within the meaning of Art. 6(1) lit. f of the GDPR.
During the sending process, we will ask you to give your consent to processing the data and will refer you to this privacy statement.
You also have the option to contact us at the email address provided. In this case, we will store the personal user data transmitted in the email. The data will not be disclosed to third parties. The data will solely be used for handling our conversation.
The legal basis for processing data with the user’s consent is Art. 6(1) lit. a of the GDPR.
The legal basis for processing data received as part of email communication is Art. 6(1) lit. f of the GDPR. If email communication pursues the conclusion of a contract, Art. 6(1) lit. b of the GDPR also serves as the legal basis.
We process the personal data obtained from the input screen solely for the purposes of handling communication. Where users contact us via email, this also constitutes the legitimate interest in processing the data.
Other personal data processed during transmission serve to prevent abuse of the contact form and to ensure that our IT systems remain secure.
The data are deleted as soon as they are no longer required for achieving the purpose for which it was recorded. In terms of the personal data from the contact form’s input screen and the data received by email, this applies when the respective conversation with the user has concluded. The conversation has concluded when the circumstances indicate that the respective subject has been fully resolved.
Additional personal data collected during transmission will be deleted after seven days at the latest.
All users can withdraw their consent to the processing of their personal data at any time. If users contact us by email, they can object to our storing of their personal data at any time. If they do so, the conversation cannot be pursued further and all personal data recorded as part of our contact will thus be deleted.
7.1 We only disclose data to third parties to the extent permitted by law. We only disclose user data to third parties if it is necessary for contractual purposes pursuant to Art. 6(1) lit. b of the GDPR or if it is based on our legitimate interest in the economic and effective operation of our business pursuant to Art. 6(1) lit. f of the GDPR.
7.2 Within our online offer, we make use of content or service offers of third-party providers, embedding their contents and services, as for example videos or fonts (hereinafter referred to as “contents“). We do so on the basis of our legitimate interests in the analysis, optimisation and economic operation of our online offer pursuant to Art. 6(1) lit. f of the GDPR. This always presupposes that the third-party providers of such content perceive the IP address of the users, as they could not send the content to the users’ browser without knowing the IP address. The IP address is therefore required for the display of such content. We make every effort to only use content from providers who use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, time spent on the website, and further information on the use of our online offer. Furthermore, they may be linked to such information from other sources.
This website uses the services of Google Maps, a service of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”) in order to conveniently present our location and give directions.
Google is certified under the EU-US Privacy Shield framework which offers a guarantee of compliance with European data protection legislation, even if the data are processed in the USA (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
When calling up our website, a connection to the Google server in the USA will be established in order to enable the correct display of certain fonts used on our website.
Provided that you use the component Google Maps featured on our website, Google will save a cookie on your device via your Internet browser. Your user settings and data are processed in order to display our location and create directions. In this context, we cannot exclude that Google uses servers in the USA.
Art. 6(1) lit. f of the GDPR serves as the legal basis for this. Our legitimate interest is justified by the optimisation of the functionality our website.
Such a connection to Google enables Google to identify the website from which the request has been sent and to which IP address the directions are to be transmitted.
In case you do not agree to such processing, you have the possibility to prevent the installation of cookies by changing the corresponding settings in your Internet browser. Please refer to the “cookies“ section for further details.
Moreover, the use of Google Maps as well as the information retrieved from Google Maps is subject to the terms and conditions of Google https://policies.google.com/terms?gl=DE&hl=de and Google Maps https://www.google.com/intl/de_de/help/terms_maps.html.
Please refer to https://adssettings.google.com/authenticated and https://policies.google.com/privacy for additional information.
This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses so-called “cookies”, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website will usually be transmitted to, and stored by, Google on servers in the United States. IP anonymisation is activated on this website. Thus, on this website, your IP address will previously be abridged by Google within the member states of the European Union or in other contracting states that were party to the agreement on the European Economic Area.
Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will make use this information on behalf of the provider of this website for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and Internet usage. In the context of Google Analytics, Google does not combine the IP address transmitted by your browser with other personal data. You can prevent the saving of the cookies through an appropriate setting in your browser software. However, we must point out that, in such cases, you may not be able to use the full scope of all the functions of this website.
You are entitled to request information from the data protection officer on whether we are processing any personal data relating to yourself.
(8) The existence of automated decision-making and profiling as per Art. 22(1) and (4) of the GDPR and – at least where such is the case – useful information on the underlying logic and the consequences and pursued effects of this processing on the data subject.
You are entitled to request information on whether the personal data relating to yourself will be transmitted to a non-EU Member State or international organization. In this context, you are entitled to request information relating to the transmission on suitable safeguards pursuant to Art. 46 of the GDPR.
You are entitled to request that the controller correct and/or complete your personal data if this data is incorrect or incomplete. The controller is obliged to do so without delay.
(4) You have objected to processing in accordance with Art. 21(1) of the GDPR pending the verification whether the data controller’s legitimate interests override your own.
If the processing of your personal data has been restricted, this personal data shall (with the exception of storage) only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If the restriction of processing is restricted under the above conditions you will be notified by the data controller before the restriction is lifted.
(1) Your personal data are no longer required to achieve the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent, under which processing became legitimate as per Art. 6(1) lit. a or Art. 9(2) lit. a of the GDPR, and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Art. 21(1) of the GDPR and your objection is not overridden by legitimate reasons for processing, or you object to the processing pursuant to Art. 21(2) of the GDPR.
(5) The deletion of your personal data is necessary for the data controller to fulfil a legal obligation in European Union or Member State law to which the data controller is subject.
(6) Your personal data have been collected in relation with the offer of information society services pursuant to Art. 8(1) of the GDPR.
Where the data controller has made your personal data public and is obliged to delete it as per Art. 17(1) of the GDPR, the data controller, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform data controllers which are processing your personal data, that you have requested the deletion of any links to your personal data or of copies or replications thereof.
(5) The establishment, exercise or defence of legal claims.
If you have asserted your right to rectification, erasure or restriction of processing against the data controller, the data controller is obliged to notify all recipients to whom your personal data have been disclosed of the corresponding rectification or erasure of data or of the restriction of their processing, unless it proves to be impossible or involves a disproportionate effort.
(2) The processing occurs using automated methods.
When exercising this right, you can further request your personal data be transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other people must not be affected.
The right to data portability does not extend to the processing of personal data where such processing is necessary for fulfilling a duty in the public interest or for exercising executive duties appointed to the data controller.
You have the right to object for reasons arising from your own personal situation at any time to the processing of your personal data where processing is legitimized by Art. 6(1) lit. e or f of the GDPR, including profiling based on those provisions.
The data controller will cease to process your personal data unless the data controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
If your personal data are processed for the purpose of direct advertising, you are entitled to object at any time to the processing of your personal data for this purpose; which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct advertising, your personal data will no longer be processed for this purpose.
You have the right to withdraw your consent under data protection law at any time. Your withdrawing consent does not affect legitimacy of any processing that has occurred with your consent prior to withdrawal.
However, such decisions shall not be based on special categories of personal data as referred to in Art. 9(1) of the GDPR, unless Art. 9(2) lit. a or g applies and suitable measures to protect your rights and liberties and legitimate personal interests have been taken.
With respect to cases (1) and (3), the data controller shall take appropriate precautions to protect your rights, liberties and legitimate personal interests; such precautions will include at least the right to enforce intervention by a human individual at the controller’s, to put forward your own opinion and to contest the decision.
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work or the place of the alleged infringement. This does not affect your recourse to other administrative or judicial remedies.
The supervisory authority receiving the complaint will keep the appellant up-to-date on status and results of the complaint, including on recourse to judicial remedies pursuant to Art. 78 of the GDPR.
This privacy statement will be adjusted to the development of data protection and safety technology at irregular intervals. We reserve the right to change this privacy statement in order to ensure its compliance with the current legal requirements or to reflect changes with regard to our offers, e.g. following the launch of new services. The new privacy statement will apply for your new visit.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6

Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78