Source: https://www.woodandmore.de/eng-data-privacy-statement.htm
Timestamp: 2019-04-20 08:42:50+00:00

Document:
Privacy has a high priority for woodandmore. The use of our website is basically possible without providing personal data. However, if a user wishes to make use of special offers via our website, processing of personal data may be necessary. If the processing of personal data is required and there is no legal basis for such processing, we generally seek the consent of the data subject.
The Internet user can prevent the setting of cookies by our (and any other) website at any time by means of a corresponding setting of the browser used and thus permanently contradict the setting of cookies. Furthermore, already set cookies can be deleted at any time via the browser or other software programs. This is possible in all common browsers. If the user deactivates the setting of cookies in the Internet browser used, not all functions of the website may be usable.
Our website captures a range of general data and information with each invocation (by a person or an automated system such as a crawler). This general data and information is stored in the log files of the server. The data can include (a) browser types and versions used, (b) the operating system used by the accessing system, (c) the website from which an accessing system accesses our website (so-called referrers), (d) the sub-web pages which are accessed (e) the date and time of access to the website, (f) an Internet Protocol address (IP address), (g) the Internet service provider of the accessing system and (h) other similar data and information need to prevent danger in the event of attacks on our information technology systems.
When using this general data and information, woodandmore does not draw conclusions about the person concerned. Rather, this information is required to (a) properly deliver the contents of our website, (b) to optimize the content of our website and to promote it, (c) to ensure the continued functioning of our information technology systems and the technology of our website, and (d) to provide law enforcement authorities with the information necessary for law enforcement in the event of a cyberattack. This anonymously collected data and information is evaluated by woodandmore on the one hand statistically and further with the aim to increase the data protection and data security in our company, in order to ensure an optimal level of protection for the personal data processed by us. The anonymous data of the server log files are stored separately from all personal data provided by an affected person.
When you place an order with us or request a free sample or information about our products, we collect, process and use a range of personal information. These are required to carry out your order and are therefore collected, recorded, processed and stored on the basis of Article 6 GDPR Para. 1 b) "Performance of Contracts".
In doing so, we limit ourselves to the data necessary for the fulfillment of the contract, that is to say in particular names, first names, street, house number, postal code, city, e-mail address. In addition, it is possible to provide the telephone number for any queries regarding delivery.
The data will be forwarded to the shipping service provider and, if applicable, the shipping service broker for order fulfillment. If the payment is processed by an external provider (eg Paypal), the data will be forwarded to this service provider (see section "Payment service providers").
The data are kept for at least 10 years in accordance with tax regulations, then checked and possibly deleted.
Visitors to woodandmore's website are given the opportunity to subscribe to a newsletter that informs irregularly about news, new products, promotions and offers from woodandmore.
The newsletter can in principle only be received if (a) the user has a valid e-mail address and (b) the user registers for the newsletter. For legal reasons, a confirmation e-mail will be sent to the e-mail address entered by an affected person for the first time using the double-opt-in procedure. This confirmation email is used to check whether the owner of the e-mail address has authorized the receipt of the newsletter. Registration for the newsletter is not complete until the link in the confirmation email has been clicked.
When registering for the newsletter, we store the IP address of the computer system used by the person concerned at the time of registration, as well as the date and time of registration, as assigned by the Internet Service Provider (ISP). The collection of this data is necessary in order to be able to trace a (possible) misuse of the e-mail address of a data subject at a later date and therefore provide the legal safeguards for the data controller.
The personal data (email address, name) collected in the course of registering for the newsletter are used exclusively to send our newsletter. It will not be passed on to third parties.
The newsletter subscription can be stopped at any time. The consent to the storage of personal data that the data subject has given us for the newsletter dispatch can be revoked at any time. It is also possible to unsubscribe directly from our newsletter at any time or to inform us in any other way.
The newsletter delivery data is stored for the period in which the woodandmore newsletter is offered.
Due to legal regulations, our website contains information that allows us to contact our company quickly and to communicate with us directly, which also includes a general e-mail address.
If the user is not an active customer with a customer account and contacts us via e-mail or via a contact form, the personal data will not be recorded centrally and only the e-mail correspondence will be stored and archived, provided it contains relevant information, such as prices, delivery times, warranty information, informed consent or similar. There is no aggregation of the data or inclusion in the customer file.
If the customer has an active account (for example, based on a previous order) and this account can be assigned on the basis data of the contact (for example based on customer number or email address), the relevant correspondence is linked to this account and stored.
There will be no disclosure of the personal data transmitted to third parties during the course of establishing contact.
The saved, relevant e-mail correspondence will be checked after 2 years at the latest and deleted if not relevant any more.
Users / customers can provide woodandmore self-created customer pictures (pictures of our furniture and accessories). The copyrights and rights of use for these images must lie with the sender. By submitting the pictures / image, the submitter grants woodandmore the right to use the image(s) on social media, on its own website and for other marketing purposes (newsletter, RSS feed, offline, print). The images are used only in direct relation with woodandmore and the presentation of the company or products. No personal data will be published about the imagesetter with the images.
The images are published for the purpose of marketing on external providers (flickr, facebook, google + and others) under the company profile. When used in the offline print, the images may be forwarded to a printing company. A transfer to third parties without a marketing context is not made.
The images are stored internally together with the declaration of consent and the declaration of copyright and rights of use. Deletion after publication is not planned.
Users / customers have the opportunity to submit feedback to us at any time - either via the feedback form or informally by email. By using the feedback form, the sender gives the consent that the review will be published anonymously or pseudonymously on the website or other marketing channels. Feedback can be provided without providing personal information. If the customer number is entered, the feedback is supplemented by the information contained in the customer account for gender (Mr/Mrs) and location (from example city XY) and date (month / year) of the feedback submission.
The survey is based on the legitimate interest to improve the offer of woodandmore and communicate feedback transparently. A deletion is not planned.
Each user has the right granted by the European Directives and Regulators to require confirmation from woodandmore as to whether or not we will process the personal information concerned. If an affected person wishes to use this confirmation right, they can contact a woodandmore employee at any time.
Furthermore, the data subject has a right of access as to whether personal data has been transmitted to a third country or to an international organization. If that is the case, then the data subject has the right to obtain information about the appropriate guarantees in connection with the transfer.
If an affected person wishes to exercise this right to information, they can contact a woodandmore employee at any time.
Any person affected by the processing of personal data has the right granted by the European legislator to demand the immediate correction of inaccurate personal data concerning him / her. Furthermore, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration, taking into account the purposes of the processing. If an affected person wishes to exercise this right to rectification, they can contact an employee of woodandmore at any time.
The data subject revokes their consent, on which the processing was based in accordance with Article 6 (1) (a) of the GDPR or Article 9 (2) (a) GDPR, and lacks any other legal basis for the processing.
If one of the above reasons is correct and an affected person wishes to initiate the deletion of personal data stored at woodandmore, they may, at any time, contact an employee of the controller. The employee of woodandmore will arrange that the extinguishing request be fulfilled immediately.
If the personal data of woodandmore have been made public and if our company is responsible for deleting personal data as the person responsible according to Art. 17 (1) GDPR, woodandmore will take appropriate measures, including technical ones, taking into account the available technology and the implementation costs Inform other data controllers processing the published personal data that the data subject has requested that these other data controllers delete all links to such personal data or copies or replications of such personal data, as far as the processing is not required. Woodandmore will arrange the necessary in individual cases.
The data controller no longer needs the personal data for the purposes of processing, but the data subject requires them to assert, exercise or defend their rights.
The data subject has objection to the processing acc. Art. 21 para. 1 GDPR and it is not yet clear whether the legitimate reasons of the person responsible outweigh those of the person concerned.
If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored at woodandmore, they may contact a woodandmore employee at any time. Woodandmore will cause the restriction of processing.
Any person affected by the processing of personal data shall have the right conferred by the European Directives and Regulations to obtain the personal data concerning him / her provided to a controller by the data subject in a structured, common and machine-readable format. It also has the right to transfer this data to another person responsible without hindrance by the controller to whom the personal data was provided, provided that the processing is based on the consent pursuant to Article 6 (1) (a) of the GDPR or Article 9 (1) (b) 2 (a) of the GDPR or on a contract pursuant to Article 6 (1) (b) of the GDPR and processing by means of automated processes, unless the processing is necessary for the performance of a task of public interest or in the exercise of public authority, which has been assigned to the responsible person. Furthermore, in exercising their right to data portability under Article 20 (1) of the GDPR, the data subject has the right to obtain that the personal data are transmitted directly from one controller to another, insofar as this is technically feasible and if so this does not affect the rights and freedoms of others. To assert the right to data portability, the data subject can contact woodandmore at any time.
Any person concerned by the processing of personal data shall have the right conferred by the European directive and regulatory authority at any time, for reasons arising from its particular situation, against the processing of personal data relating to it pursuant to Article 6 (1) (e) or f GDPR takes an objection. This also applies to profiling based on these provisions. In the event of an objection, Woodandmore will no longer process personal data unless we can establish compelling legitimate grounds for processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims , If Woodandmore processes personal data in order to operate direct mail, the data subject has the right to object at any time to the processing of personal data for the purpose of such advertising. This also applies to the profiling, as far as it is associated with such direct mail. If the data subject objects to Woodandmore's processing for direct marketing purposes, woodandmore will no longer process the personal data for these purposes. In addition, the data subject has the right, for reasons arising from his / her particular situation, to process personal data concerning him or her at Woodandmore for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR to object, unless such processing is necessary to fulfill a public interest task. In order to exercise the right of opposition, the data subject may directly contact woodandmore or an employee. The data subject is also free, in the context of the use of information society services, notwithstanding Directive 2002/58 / EC, to exercise his right of opposition by means of automated procedures using technical specifications.
Any person concerned by the processing of personal data shall have the right, as granted by the European legislature and the legislature, not to be subject to a decision based solely on automated processing, including profiling, which has a legal effect on it or, in a similar manner, significantly affects it; if decision (a) is not required for the conclusion or performance of a contract between the data subject and the controller; or (b) permitted by Union or Member State legislation to which the controller is subject, and that legislation provides for appropriate action to safeguard the rights and freedoms and the legitimate interests of the data subject; or (c) with the express consent of the data subject. If the decision (a) is required for the conclusion or performance of a contract between the data subject and the controller or (b) it takes place with the express consent of the data subject, woodandmore takes appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject person, including at least the right to obtain the intervention of a person by the controller, to express his / her own position and to contest the decision. If the data subject wishes to assert any rights with respect to automated decisions, they can contact a woodandmore employee at any time.
Any person affected by the processing of personal data has the right, granted by the European directive and regulatory authority, to revoke consent to the processing of personal data at any time. If the data subject wishes to assert their right to withdraw consent, they can contact a woodandmore employee at any time.
The woodandmore website contains components of the companies Facebook, Google+, Pinterset, Twitter, Instagram, FlickR / SmugMug and Twitter. These are social networks. Some of the components are disabled by default and are only activated by clicking on the user. Few components (image bar of flickr, Pinterest Pin-Button) are activated by default. In the case of the activation of the respective services, data (cookies, URL, IP, if necessary allocation of the respective profile of the user) are passed on to these networks.
The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. Persons responsible for the processing of personal data, if an affected person lives outside the US or Canada, are Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland. The data policy published by Facebook, which is available at https://de-de.facebook.com/about/privacy/, provides information on the collection, processing and use of personal data by Facebook. It also explains which options Facebook offers to protect the privacy of the data subject.
The controller has integrated on this website the component Google Analytics (with anonymization function). Google Analytics is a web analytics service. Web analysis is the collection and analysis of data about the behavior of visitors to websites. Among other things, a web analysis service collects data on which website an affected person has come to a website (so-called referrers), which subpages of the website were accessed or how often and for which length of stay a subpage was viewed. A web analysis is mainly used to optimize a website and cost-benefit analysis of Internet advertising.
The operating company of the Google-Analytics-component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
Google Analytics uses a cookie on the information technology system of the user. What cookies are, has already been explained above. By using this cookie Google is enabled to analyze the usage of our website. Each time one of the pages of this website is accessed by the controller and a Google Analytics component has been integrated, the Internet browser on the information technology system of the person concerned is automatically initiated by the respective Google Analytics component to submit data to Google for online analysis purposes. As part of this technical process, Google will be aware of personal data, such as the IP address of the person concerned, which serve, among other things, Google to track the origin of the visitors and clicks, and subsequently make commission settlements possible.
The user can prevent the setting of cookies through our website, as shown above, at any time by means of a corresponding setting of the Internet browser used and thus permanently contradict the setting of cookies. Such a setting of the Internet browser used would also prevent Google from setting a cookie on the information technology system of the person concerned. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.
The operator of this website has integrated the Matomo component on this website. Matomo is an open source software tool for web analysis. Web analysis is the collection and analysis of data about the behavior of visitors to websites. Among other things, a web analysis tool collects data on which website an affected person came to a website (so-called referrer), which subpages of the website were accessed or how often and for which length of stay a subpage was viewed. A web analysis is mainly used to optimize a website and cost-benefit analysis of Internet advertising.
The software is operated on the server of the website operator’s hosting service, the data protection sensitive log files are stored exclusively on this server.
The purpose of the Matomo component is to analyze visitor flows on our website. Among other things, the controller uses the data and information obtained to evaluate the use of this website in order to compile online reports showing the activities on our website. Matomo sets a cookie on the information technology system of the user. What cookies are, has already been explained above. By setting the cookie, we are enabled to analyze the use of our website. Each time you visit one of the individual pages on this website, the internet browser on the information technology system of the person concerned is automatically led by the Matomo component to transmit data to our server for the purpose of online analysis. In the course of this technical process, we gain knowledge of personal data, such as the IP address of the person concerned, which among other things serves to help us understand the origin of visitors and clicks.
Furthermore, the data subject has the possibility of objecting to and preventing detection of the data generated by Matomo on the use of this website. For this the person concerned must set an opt-out cookie. If the information technology system of the data subject is deleted, formatted or reinstalled at a later date, the data subject must again set an opt-out cookie.
The operator of this website has integrated components from PayPal on this website. PayPal is an online payment service provider. Payments are made through so-called PayPal accounts, which are virtual private or business accounts. In addition, PayPal has the ability to process virtual payments through credit cards if a user does not have a PayPal account. A PayPal account is managed via an email address, which is why there is no classic account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also takes on trustee functions and offers buyer protection services.
If the user selects "PayPal" as a payment option during the order process in our online shop, data of the data subject will be automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transfer of personal data required for payment processing.
PayPal may disclose personal information to affiliates and service providers or subcontractors, to the extent necessary to fulfill its contractual obligations or to process the data on behalf of. The data subject has the option to revoke the consent to the handling of personal data against PayPal at any time. A revocation has no effect on personal data which must be processed, used or transmitted for (contractual) payment processing.
Unless otherwise stated, Art. 6 I lit. a GDPR functions as the legal basis for processing operations where we obtain consent for a particular processing purpose. If the processing of personal data is necessary to fulfill a contract of which the user is a party, as is the case, for example, in processing operations necessary for the supply of goods or the provision of any other service or consideration, processing shall be based on Art. 6 I lit. b GDPR. The same applies to processing operations that are necessary to carry out pre-contractual measures, for example in cases of inquiries regarding our products or services. If our company is subject to a legal obligation which requires the processing of personal data, such as the fulfillment of tax obligations, the processing is based on Art. 6 I lit. c GDPR. Ultimately, processing operations could be based on Art. 6 I lit. f GDPR are based. On this legal basis, processing operations that are not covered by any of the above legal bases are required if processing is necessary to safeguard the legitimate interests of our company or a third party, unless the interests, fundamental rights and fundamental freedoms of the person concerned prevail. Such processing operations are particularly allowed to us because they have been specifically mentioned by the European legislator. In that regard, it considered that a legitimate interest could be assumed if the data subject is a customer of the controller (recital 47, second sentence, GDPR).
Unless otherwise stated, the respective statutory retention period applies for the duration of the storage of personal data. After expiry of the deadline, the relevant data will be routinely checked and, if necessary, deleted, provided that they are no longer required for statistical purposes or for contract fulfillment or contract initiation.
During the transmission of personal data, modern SSL encryption techniques are used so that they do not fall into the wrong hands. Only the most necessary personal data is stored online. The databases are protected by encrypted passwords.
The object of the company is the trade in furniture, small furniture, flat-pack furniture, home accessories, home accessories, kitchenware. The collection, processing, transmission and use of data is for the purpose of performing the aforementioned purposes.
Customer data, employee data as well as data from suppliers as well as other business partners, if these are necessary for the fulfillment of the purposes mentioned under 4. above. Upon request, we will be pleased to inform you about the procedure in which your data may be stored and what the data is.
Public bodies in the case of priority legislation, external contractors in accordance with § 11 BDSG as well as external bodies and internal woodandmore departments to fulfill the purposes stated above.
The legislature has issued a variety of storage obligations and deadlines. After expiration of these deadlines, the corresponding data will be routinely checked. If data are not affected by this, they will be deleted if the purposes mentioned in section 4 are omitted.

References: Art. 17
 Art. 21
 Art. 89
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 § 11