Source: https://www.maha.de/proteccion-de-datos.htm
Timestamp: 2019-04-21 22:07:16+00:00

Document:
We attach a great deal of importance to protecting your personal data. Personal data processing therefore takes place in compliance with the applicable European and national legislation.
You may naturally revoke your declaration(s) of consent at any time with effect for the future. Please contact the controller according to § 1 to do so.
The following policy provides an overview of what type of data is collected, how it is used and disclosed, what security measures we take to protect your data, and how you can obtain information about the information we gather.
Insofar as we obtain the data subject’s consent to process their personal data, Art. 6, Para. 1, Clause 1, lit. a) of the EU General Data Protection Regulation (GDPR) shall apply as the legal basis.
In the event of personal data which is necessary to fulfilling a contract, the contracting party for which is the data subject, being processed, Art. 6, Para. 1, Clause 1, lit. b) of the GDPR shall apply as the legal basis. This also applies to processing which is required to carry out pre-contractual measures.
If personal data needs to be processed to fulfil a legal obligation to which we are subject, Art. 6, Para. 1, Clause 1, lit. c) of the GDPR shall apply as the legal basis.
If processing is necessary to protecting a legitimate interest on the part of our company or a third party, and if the data subject’s interests, fundamental rights and fundamental freedoms do not take precedence over the former interest, Art. 6, Para. 1, Clause 1, lit. f) of the GDPR shall apply as the legal basis for processing.
The data subject’s personal data shall be deleted or blocked as soon as the purpose of storage ceases to apply. Storage can also take place if this was stipulated by the European or national legislator in Union regulations, legislation or other specifications to which we are subject. Blocking or deletion of the data also takes place if a storage period stipulated by the aforementioned standards elapses, unless the data must be stored for longer to conclude or fulfil a contract.
a) Personal data means all information which relates to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified either directly or indirectly, particularly by means of assignment to an identifier such as a name, to an ID number, to location data, to an online ID or to one or several particular features which are an expression of this natural person’s physical, physiological, genetic, mental, economic, cultural or social identity.
b) Data subject means any identified or identifiable natural person whose personal data is processed by the controller responsible for processing.
c) Processing means any listed operation carried out with or without the help of automated methods or any such series of operations associated with personal data such as collection, recording, organisation, arrangement, storage, adaptation or modification, reading, querying, use, disclosure through transfer, dissemination or provision in another way, comparison or linking, restriction, deletion or destruction.
d) Profiling means any kind of automated personal data processing which is characterised by the fact that this personal data is used to evaluate certain personal aspects relating to a natural person, and particularly to analyse or predict aspects concerning job performance, economic situation, health, personal preferences, interests reliability, behaviour, location or movements.
e) Pseudonymisation means personal data processing in such a way that the personal data can no longer be assigned to a specific data subject without the help of additional information, provided that this additional information is stored separately and subject to technical and organisational measures which guarantee that the personal data cannot be assigned to an identified or identifiable natural person.
f) Controller, or controller responsible for processing means the natural or legal person, authority, establishment or other body which, either alone or together with others, decides on the purposes and means of personal data processing. If the purposes and means of such processing are stipulated by Union or member state law, the controller and the specific criteria of their appointment may be provided for under Union or member state law.
g) Processor means a natural or legal person, authority, establishment or other body which processes personal data on the controller’s behalf.
h) Recipient means a natural or legal person, authority, establishment or other body to whom personal data is disclosed, regardless of whether or not it is a third party. However, authorities which may receive personal data in the context of a specific investigation mandate under Union or member state law are not considered to be recipients.
i) Third party means a natural or legal person, authority, establishment or other body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process the personal data.
j) Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes in the form of a declaration or another clear and affirmative act, by which the data subject signifies agreement to the processing of the personal data concerning them.
The data is also stored in our system’s log files. This data is not stored together with other personal data belonging to the user.
(2) The legal basis for the temporary storage of the log files is Art. 6, Para. 1, Clause 1, lit. f) of the GDPR.
a) enable delivery of the website to the user’s computer. The user’s IP address must remain stored for the duration of the session for this purpose.
Storage in log files is carried out to guarantee the functionality of the website. Additionally, we also use the data to optimise the website and to ensure the security of our IT systems. Evaluation of data for marketing purposes does not take place in this regard.
In these purposes, we also have a legitimate interest in data processing according to Art. 6, Para. 1, Clause 1, lit. f) of the GDPR.
(4) The data shall be deleted as soon as it is no longer required to achieve the purpose for which it was collected – in this case, when the usage process ends.
If data is stored in log files, this is done seven days afterwards at the latest. Extended storage is possible. In this case, the IP addresses are deleted or anonymised so that they can no longer be allocated to the accessing client.
(5) Data must be recorded under all circumstances to provide the website and store the data in log files for the purpose of operating the website, which is why there is no opportunity to object.
(1) This website uses “cookies”. Cookies are small text files which, as soon as you visit a website, are sent to your browser by a web server and are saved locally on your terminal device (PC, notebook, tablet, smartphone, etc.) and stored on your computer and allow the user (i.e. us) to receive certain information. Cookies are used to make the website more customer-friendly and secure, and particularly to collect usage-related information such as frequency of use and the number of page visitors, as well as website activity. Cookies do not damage the computer in any way and do not contain any viruses.
This cookie contains a characteristic character string (“cookie ID”), which enables unique identification of the browser the next time the website is called up.
The legal basis for personal data processing using cookies is Art. 6, Para. 1, Clause 1, lit. f) of the GDPR.
Alternatively, you can also contact us on the email address provided. In this case, the personal data which is transferred with the email is stored.
If this information relates to communication channels (e.g. your email address or telephone number), you are also consenting to the fact that we may, if necessary, contact you using these communication channels to respond to your request.
Your data shall not be disclosed to third parties in this regard. The data is only used for processing the conversation.
(2) The legal basis for data processing, provided that the user has given their consent to this effect, is Art. 6, Para. 1, Clause 1, lit. a) of the GDPR. The legal basis for processing data transferred in the course of sending an email is Art. 6, Para. 1, Clause 1, lit. f) of the GDPR. If you have contacted us by email with the aim of concluding a contract, Art. 6, Para. 1, Clause 1, lit. b) of the GDPR forms an additional legal basis.
(3) We only process personal data from the input screen to process the contact request. We shall naturally only use the data from your email enquiry for the purpose for which you are providing it during such contact. If the user makes contact by email, there is also a required legitimate interest in data processing when we reply. The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our IT systems.
(4) The data shall be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the contact form’s input screen and the data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when the circumstances indicate that the situation concerned has been conclusively clarified. The personal data also collected during the sending process is deleted after a period of seven days at the latest.
(5) You have the opportunity to revoke your consent to the processing of your personal data at any time. If you contact us by email, you can object to the storage of your personal data at any time. The conversation cannot be continued in a case such as this. With regard to revocation of consent / objection to storage, we ask that you contact the controller or the data protection officer according to § 1 by email or post. All personal data stored during the course of contact is deleted in this case.
The information generated by the cookie about the users’ use of this website shall generally be transmitted to and stored on a Google server in the USA.
This website uses Google Analytics with the “_anonymizeIp()” extension. The software is set so that the IP addresses are not stored in full, but rather in truncated form. It is therefore no longer possible to assign the truncated IP address to the accessing computer. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. However, the IP address transmitted by your browser in the context of Google Analytics is not associated with other data held by Google.
(2) The legal basis for personal data processing is Art. 6, Para. 1 Clause 1, lit. f) of the GDPR. For the exceptional situations where personal data is transmitted to the USA, Google has subjected itself to the EU/US Privacy Shield Agreement: https://www.privacyshield.gov/EU-US-Framework .
(3) Google shall use this information on our behalf to evaluate your use of the website and to compile reports on website activities. Evaluation of the obtained data allows us to compile information about the use of the individual components of our website. This helps us to constantly improve our website and its user-friendliness. In these purposes, we also have a legitimate interest in data processing according to Art. 6, Para. 1, lit. f) of the GDPR. Through IP address anonymisation, users’ interest in protecting their personal data is sufficiently taken into account.
(4) The data shall be deleted as soon as it is no longer required for the purposes for which it was collected. In our case, this is after 26 months.
Furthermore, you can prevent Google’s collection and processing of the data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser plugin available at the following link. The current link is: “ http://tools.google.com/dlpage/gaoptout?hl=de ”.
(1) Our website uses the services of Google Maps. This allows us to display interactive maps on our website and permits you convenient usage of the map function.
(2) When you visit the website, Google receives the information that you have accessed the respective sub page of our website. In addition, the data listed under § 7 of this statement is transmitted. This is the case irrespective of whether or not you have a Google user account and are logged into it. If you are logged into a Google account, your data is associated directly with your account. If you do not wish for your data to be associated with your Google profile, log out before activating the button. Google saves your data as usage profiles and uses it for the purposes of promotion, market research and/or tailoring its website to the users' needs. In particular, this evaluation is conducted (even for users not logged into a user account) to provide tailored advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, but in order to exercise this right, you will have to contact Google.
(3) For further information on the purpose and extent of data collection and processing thereof by the plug-in provider, refer to the provider's data privacy statement. It also contains information on your associated rights and setting options to protect your privacy: https://www.google.de/intl/en/policies/privacy . Google also processes your personal data in the USA and has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework .
h) The existence of automated decision-making, including profiling according to Art. 22, Paras. 1 and 4 of the GDPR, and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
(2) You are entitled to the right to request information about whether the personal data concerning you is transferred to a third country or an international organisation. In this context, you can request to be informed of the appropriate safeguards according to Art. 46 of the GDPR in connection with such transfer.
You have a right to immediate correction and/or completion vis-à-vis the controller, provided that the processed personal data concerning you is incorrect or incomplete.
d) If you have objected to processing according to Art. 21, Para. 1 of the GDPR and it has not yet been determined whether the controller’s legitimate grounds take precedence over your grounds.
(2) If processing of the personal data concerning you is restricted, such data may – with the exception of storage – only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state. If restriction of processing was not carried out according to the aforementioned conditions, you shall be informed by the controller before the restriction is removed.
a) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
b) You revoke your consent on which processing according to Art. 6, Para. 1, lit. a) or Art. 9, Para. 2, lit. a) of the GDPR was based, and there are no other legal grounds for processing.
c) You object to processing according to Art. 21, Para. 1 of the GDPR and there are no other overriding legitimate grounds for processing, or you object to processing according to Art. 21, Para. 2 of the GDPR.
d) The personal data concerning you was processed unlawfully.
e) Deletion of the personal data concerning you is required to fulfil a legal obligation under Union law or the law of the member states to which the controller is subject.
f) The personal data concerning you was collected in relation to the offer of information society services according to Art. 8, Para. 1 of the GDPR.
(2) If the controller has made the personal data concerning you public and is obligated to delete the same according to Art. 17, Para. 1 of the GDPR, taking account of the available technology and the associated implementation costs the controller shall take appropriate measures, including those of a technical nature, to inform other controllers processing the personal data that you as the data subject have requested the deletion of all links to this personal data or to copies or replications of the same.
If you have asserted your right to correction, deletion or restriction of processing vis-à-vis the controller, the controller is obligated to inform all the recipients to whom the personal data concerning you was disclosed of this correction or deletion of data or of the restriction of processing, unless doing so proves to be impossible or would involve a disproportionate effort. You are entitled to receive information about these recipients from the controller.
b) processing is carried out by automated means.
(2) In exercising this right, you further have the right to have the personal data concerning you transferred directly from one controller to another, where technically feasible. The rights and freedoms of others must not be adversely affected by the exercising of this right.
(3) The right to data portability does not apply to the processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
(4) With regard to asserting the right to data portability, the data subject can contact the controller responsible for processing at any time.
(1) You have the right, on grounds relating to your particular situation, to object at any time to processing of the personal data concerning you based on Art. 6, Para. 1, lit. e) or f) of the GDPR; this also applies to profiling based on these provisions.
(2) The controller shall no longer process the personal data concerning you unless they can demonstrate compelling and legitimate grounds for processing which outweigh your interests, rights and freedoms, or if processing serves to establish, exercise or defend legal claims.
(3) If the personal data concerning you is processed for the purpose of carrying out direct advertising, you have the right at any time to object to processing of the personal data concerning you for the purposes of such advertising; this also applies to profiling if it is in conjunction with such direct advertising. If you object to processing for the purposes of direct advertising, the personal data concerning you shall no longer be processed for these purposes.
(4) In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you can exercise your right of objection by automated means where technical specifications are used.
(5) To exercise the right of objection, the data subject can contact the controller responsible for processing.
You have the right to revoke your declaration of consent under data protection legislation at any time. Revocation of consent does not affect the lawfulness of processing carried out based on consent up until the same is revoked. You can contact the controller for this purpose.
(2) However, these decisions may not be based on specific categories of personal data according to Art. 9, Para. 1 of the GDPR, insofar as Art. 9, Para. 2, lit. a) or g) of the GDPR does not apply and appropriate measures were taken to protect rights and freedoms as well as your legitimate interests.
(3) With regard to the cases mentioned in (1) and (3), the controller shall take appropriate measures to protect rights and freedoms as well as your legitimate interests, which at least includes the controller’s right to request someone’s intervention, present their own point of view and contest the decision.
(4) If the data subject would like to assert rights in relation to automated decision-making, they can contact the controller for data processing concerning this matter at any time.
Regardless of another administrative or judicial legal remedy, you have the right to lodge complaints with a supervisory authority, particularly in the member state where your place of residence, your workplace or the place of the suspected violation is located if you believe that the processing of the personal data concerning you is in violation of the GDPR. The supervisory authority with whom the complaint was lodged informs the complainant of the status and results of the complaint, including the possibility to appeal according to Art. 78 of the GDPR.

References: § 1
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 § 1
 Art. 6
 Art. 6
 § 7
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78