Source: https://www.kieser-training.com/en/data-protection/
Timestamp: 2019-04-19 23:22:46+00:00

Document:
We, Kieser Training AG, Hardstrasse 223, 8005 Zurich, Switzerland, take data protection & privacy seriously and provide you in the following declaration with information on how personal data is collected, stored and possibly used on our website.
The use of this website may entail the processing of personal data. The handling of this data is regulated by law, in particular in the EU General Data Protection Regulation (GDPR). We would like to take this opportunity to provide information regarding the processing of your personal data.
Kieser Training AG, Hardstr. 223, 8005 Zurich, Switzerland, (hereafter referred to as “we” or “us”) is responsible for data processing on our website.
For Switzerland, the EU Commission has issued an adequacy decision (2002/518/EC), meaning that the appropriate level of data protection pursuant to Art. 45 GDPR is ensured.
This Policy applies to all services offered and operated by us, in particular to our websites www.kieser-training.de, www.kieser-training.ch, www.kieser-training.at www.kieser-training.lu and www.kieser-training.com. It applies accordingly to mobile end devices or services and sites adapted for other platforms.
Use of this website may result in the processing of personal data. The data protection term “personal data” encompasses all information relating to a particular or identifiable person. An IP address can also be personal data. An IP address is assigned to each internet-connected device by the internet service provider so that the device can send and receive data. When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, we automatically collect certain information about your use of the website.
We process personal data in compliance with the relevant data protection regulations, in particular the GDPR. We only process data on the basis of legal permission. When using this website, we process personal data only with your consent (Art. 6 (1) lit. a) GDPR), for the performance of a contract to which you are party, or upon your request for the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR), to fulfil a legal obligation (Art. 6 (1) lit. c) GDPR) or if the processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and fundamental freedoms that require the protection of personal data prevail (Art. 6 (1) lit. f) GDPR).
Unless otherwise stated in the following information, we only store the data for as long as is necessary to achieve the processing purpose or to fulfil our contractual or legal obligations. Such statutory retention requirements may stem in particular from commercial or tax regulations.
Unless otherwise stated in the following information, the data is processed on the servers of technical service providers who have been commissioned by us for this purpose. These service providers process the data only after explicit instruction and are contractually obliged to guarantee sufficient technical and organisational measures for data protection.
Specifically, we use the services of Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (AWS), to host this site. AWS is certified under the Privacy Shield Agreement, and thus provides a guarantee to comply with European and Swiss privacy legislation (https://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA4&status=Active). The server is located in Frankfurt.
Our website uses SSL encryption for security reasons and to protect the transmission of sensitive content, such as the requests you send to us. You can recognise an encrypted connection when the browser's address bar changes from “http://” to “https://” and the lock symbol appears in the address bar. If SSL encryption is enabled, the data you submit to us cannot be read by third parties.
During the purely informative use of our website, automated (i.e. not collected via registration) general information is initially stored, which your browser transmits to our server. These include as standard: Browser type/version, used operating system, page visited, the previously visited page (referrer URL), IP address, date and time of the server request and HTTP status code. Processing is carried out for the protection of our legitimate interests and is based on Art. 6 (1) lit. f) GDPR. This processing is carried out for the purpose of the website’s technical management and security. The stored data will be deleted unless legitimate suspicion of unlawful use exists based on specific evidence and further examination and processing of the information is necessary for this reason.
Our website contains a contact form which you can use to send us messages. Your data is transferred in encrypted form. All mandatory data fields are required to process your request. We cannot process your request without this data. The provision of further data is voluntary. Alternatively, you can contact us via email. The legal basis for data processing in connection with a contract request is Art. 6 (1) lit. b) GDPR.
You can also send requests to individual Kieser Training studios or the respective studio operator. Under the section “Studios” you will find the corresponding information as well as a contact form for each studio. Your request will be transmitted in encrypted form to the operator of the Kieser Training studio that you have selected. All mandatory data fields are required to process your request. Without this data, the Kieser Training studio in question cannot process your request and you may not receive a reply. Please note that the Kieser Training studio can also contact you by phone to answer your request if you provide a telephone number. Alternatively, you can send a message to the respective Kieser Training studio via the specified email address or call there. The legal basis for data processing with regard to your studio request is Art. 6 (1) lit. b) GDPR.
You can register with a Kieser Training studio via our website for a free introductory training. To do this, you can send us a request via the form provided under the “Test Now” menu item. This transmission is also encrypted. We will then forward your request for this purpose to the operator of the selected Kieser Training studio to process your training request. Information about the respective operator can be found in the selection of the Kieser Training studio as well as under the menu item “Studios”. To offer you a trial, we or the respective studio operator need some information from you. This includes your name, your email address and your telephone number. Please note that the date for an introductory training session is always arranged by phone or alternatively by email. Accordingly, the selected studio will contact you by telephone or email to discuss your desired appointment. The legal basis for data processing in relation to the described request for an introductory training is Art. 6 (1) lit. b) GDPR.
You have the option of allowing your location to be determined through your browser when searching for a Kieser Training studio. Our website will only use this information to find and show you Kieser Training studios near you. To determine your location, normally your IP address, information on nearby wireless access nodes and a random identification number are collected and processed. Your browser provider and the provider of the browser’s location service will also receive this data. We use the Google Location Service, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). A transmission of your data to the USA cannot be excluded. Google is certified under the Privacy Shield Agreement, and thus provides a guarantee to comply with European and Swiss privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). The legal basis for the data processing in connection with the desired localisation and the display of Kieser Training studios in your vicinity is Art. 6 (1) lit. b) GDPR.
Our newsletter enables you to receive our customer magazine by email four times a year. To sign up for this newsletter, a valid email address is required. Further information is voluntary. To verify your email address, you will first receive a registration email that you must confirm via a link (double opt-in). We send you our newsletter on the basis of your consent (Art. 6 (1) lit. a) GDPR). You always have the option to unsubscribe from the newsletter or withdraw your consent with effect for the future. Simply use the unsubscribe link contained in each email or one of the above-mentioned contact channels. When subscribing to the newsletter, we save the IP address as well as the date and time of registration. The processing of this data is required in order to prove that consent has been granted. The legal basis stems from our legal obligation to document your consent (Art. 6 (1) lit. c) GDPR in combination with Art. 7 (1) GDPR).
We also analyse the reading behaviour and opening rates of our newsletter. We collect and process pseudonymised usage data that we do not combine with your email address or IP address. Any personal reference to you or personalised evaluation is therefore not possible. The legal basis for the analysis of our newsletter is Art. 6 (1) lit. f) GDPR and the processing serves our legitimate interest in optimising our newsletter. You can object to this at any time by unsubscribing from our newsletter.
We use MailChimp, a newsletter service provided by The Rocket Science Group LLC, 675 Ponce de Leon Avenue NE, Suite 5000, Atlanta, GA 30308 USA; “MailChimp”. Mailchimp acts as a processor for us, is strictly bound by instructions and contracted to ensure adequate technical and organisational data protection measures. MailChimp is certified under the Privacy Shield Agreement, and thus provides a guarantee to comply with European and Swiss privacy legislation (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active).
Our website uses a plugin from the provider Hotjar Ltd. (St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta, “Hotjar”) via which we conduct an analysis of movements on our website using co-called “heat maps”. For example, it is possible to see how far users scroll as well as which buttons users click and how often. Furthermore, the tool also allows feedback to be obtained directly from website users. This allows us to gain valuable information to make our website faster and more customer-friendly. With Hotjar, we can only track which buttons are clicked, the mouse trajectory, how far was scrolled, the screen size of the device, device type and browser information. We also receive information about your geographical location (country) and the preferred language for displaying our website. Areas of the website where personally identifiable information about you or a third party are displayed are automatically hidden by Hotjar and are therefore never traceable by the tool. The use of this service is based on the legal basis of Art. 6 (1) lit. f) GDPR and serves the legitimate interest of a needs-based and demand-oriented design of our website. You can object to data processing at any time. To do this, you can use a browser extension that blocks tracking services or prevents cookies from being stored in your browser settings. You can also prevent Hotjar from collecting your information when you visit a Hotjar-based website by visiting this page: https://www.hotjar.com/opt-out and clicking ‘Disable Hotjar’. You can find more information about Hotjar’s data protection on the following website. https://www.hotjar.com/legal/policies/privacy.
Within our website, we use the “Facebook Pixel” from Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are located in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook"). By using the Facebook Pixel, we can track users’ behaviour after they have been redirected to our site by clicking on a Facebook ad (“conversion”). This also enables us to track the effectiveness of Facebook advertisements for statistical and market research purposes. The data collected in this way is anonymous for us: in other words, we do not see individual users’ personal data. However, this data is stored and processed by Facebook, about which we inform you to the best of our knowledge. According to Facebook's data usage policy https://www.facebook.com/about/privacy/, Facebook can associate this data with your Facebook account and also use it for its own advertising purposes. The Facebook Pixel is triggered by Facebook when our website is accessed and can store a cookie on your device. If you subsequently log in to Facebook or visit Facebook in the logged-in state, your visit to our online offer will be noted in your profile. The data collected about you is still anonymous to us, and thus does not provide us with any references to the identity of users. However, the data is stored and processed by Facebook, which makes a connection to the respective user profile possible and means that the data can also be used by Facebook for its own market research and advertising purposes. Use of this service has its legal basis in Art. 6 (1) lit. f) GDPR and serves our legitimate economic interests. You can object to the collection by the Facebook Pixel and use of your data to display Facebook Ads at the following address: https://www.facebook.com/settings?tab=ads. Facebook is certified under the Privacy Shield Agreement, and thus provides a guarantee to comply with European and Swiss privacy legislation (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
On our website, we use marketing and remarketing services provided Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). These services allow us to better target advertisements to show users interest-based ads.
Remarketing will display ads and products to users for which an interest on other sites in the Google Network has been established. To this end, a code is executed and (re)marketing tags are integrated into the website by Google when our website is accessed. They store an individual cookie, in other words a small file, onto the users' device (instead of cookies, comparable technologies can also be used). The cookies can be set by different domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com or googleadservices.com. This file records which websites users have visited, what content they are interested in and what offers have been used. In addition, technical information about the browser and operating system, referring websites, time of visit and other information regarding the use of the website are stored. Users’ IP address will also be collected. In the context of Google Analytics, please note that the IP address will be abridged within member states of the European Union or other states party to the Agreement on the European Economic Area. All user data is processed only as pseudonymous data. Google therefore does not store names or email addresses. All displayed ads are thus not displayed specifically for a person, but for the owner of the cookie. This information is collected by Google, transmitted to servers and stored there. A transmission of your data to the USA cannot be excluded.
The Google marketing services we use also includes the online advertising program Google AdWords. In the case of Google AdWords, each AdWords customer receives a different conversion cookie. Cookies can therefore not be tracked via the websites of AdWords customers. The information acquired with the aid of cookies is used to prepare conversion statistics for AdWords customers that have opted in to Conversion Tracking. AdWords customers receive information on the total number of users that have clicked on their advertisement and that have been forwarded to a site with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.
The legal basis for the use of this service is Art. 6 lit. f) GDPR. If you wish to opt-out of interest-based advertising through Google marketing services, you can make use of Google's settings and opt-out options: https://adssettings.google.com/.
A transmission of your data to the USA cannot be excluded. Google is certified under the EU-US Privacy Shield Agreement, and thus provides a suitable guarantee to comply with European and Swiss privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
On occasions, we run surveys. For this purpose, we collect and process personal data about you that is transferred via the surveys. Participation in surveys is always voluntary.
The legal ground for processing of satisfaction survey data is Article 6 (1)(f) of GDPR. 1 Buchst. f) DSGVO. Our legitimate interest lies in improving our service and the user experience.
The legal ground for processing of data relating to your application for a job at Kieser Training is Article 6 (1)(f) of GDPR. 1 Buchst. b) DSGVO.
We use a service provided by SurveyMonkey Europe UC (2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland) to conduct surveys. SurveyMonkey collects information from respondents about the device and application they use to participate in surveys, and it also sets its own cookies. This is to ensure that the survey service can be operated without restriction and that the surveys run as planned and in the best possible manner. Further information on the cookies set by SurveyMonkey, on data protection, and the length of time they are stored can be found at https://www.surveymonkey.co.uk/mp/legal/privacy-policy/. If you do not participate in our survey, SurveyMonkey will not collect any personal information about you.
SurveyMonkey Europe UC is a subsidiary of SurveyMonkey Inc. (San Mateo, One Curiosity Way, San Mateo, California 94403, USA). It is possible that your personal data as collected by SurveyMonkey may also be transferred to the USA. SurveyMonkey Inc. is certified under the EU-US Privacy Shield and thus offers an appropriate level of data protection in accordance with Article 45 of GDPR (https://www.privacyshield.gov/participant?id=a2zt0000000Gn7zAAC&status=Active).
The legal ground for data processing by SurveyMonkey is Article 6 (1)(f) of GDPR. 1 Buchst. f) DSGVO. Our legitimate interest is to provide you with an adequate system for conducting surveys.
To display maps and virtual tours of the studios, we use “Google Maps” from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland, “Google”). A transmission of your data to the USA cannot be excluded. Google is certified under the Privacy Shield Agreement, and thus provides a guarantee to comply with European and Swiss privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
To display videos, we use the service provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”). As a subsidiary of Google, YouTube is covered by Google's Privacy Shield certification.
To display text on our website, we use fonts provided by Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA (“Monotype”). Please note that processing by Monotype does not guarantee an appropriate level of data protection within the meaning of the GDPR.
To display content on our site, we use Amazon CloudFront, a service provided by Amazon Web Services, Inc. (410 Terry Avenue North, Seattle WA 98109, USA, “AWS”). This involves the use of a content delivery network (CDN) which can shorten the website’s loading times. AWS is certified under the Privacy Shield Agreement, and thus provides a guarantee to comply with European and Swiss privacy legislation (https://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA4&status=Active).
In addition to this website, we also operate the Facebook page www.facebook.com/KieserTrainingGlobal/, which we use to showcase our company, inform about our offers and communicate with our customers and prospects. In principle, we only process personal data when you interact with our Facebook page, e.g. if you leave a comment, click a Like button or send us a message. On the one hand, the legal basis for such data processing by us is Article 6 (1) (b) GDPR (for example, if you send us a contract-relevant request). On the other hand, data processing may also be based on your consent under Article 6 (1) (a) GDPR (for example, if you "like", comment on, or post content on our site). You may revoke any consent given at any time with effect for the future by deleting the comment or the content concerned. Revocation does not affect the legality of the data processing carried out on the basis of consent before the time of revocation. Furthermore, we analyse the views and interactions on our Facebook page. For this purpose, Facebook creates user profiles and provides us exclusively with anonymous data.
In accordance with Art. 15 GDPR, you have the right to request information about whether and, if applicable, to what extent we process personal data about you.
You have the right to demand the correction of your data in accordance with Art. 16 GDPR.
You have the right to demand the deletion of your personal data in accordance with Art. 17 GDPR.
You have the right to limit the processing of your personal data in accordance with Art. 18 GDPR.
You have the right in accordance with Art. 20 GDPR to receive your personal data that you provided to us in a structured, common and machine-readable format and to transmit this data to another controller.
According to Art. 21 (1) GDPR, you have the right to object to any processing on the legal basis of Art. 6 (1) lit. e) or f) GDPR. If we process personal data about you for the purpose of direct advertising, you can object to this processing pursuant to Art. 21 (2) and (3) GDPR.
You can revoke your consent according to with Art. 7 (3) GDPR at any time. Such revocation shall not affect the lawfulness of the processing on basis of consent up to the time of revocation.
According to the GDPR, Kieser Training AG is not obliged to appoint a data protection officer. Kieser Training studios are operated by subsidiaries of Kieser Training AG or by franchisees, who each have their own data protection officers, if they are legally obliged to do so. The contact details of the respective data protection officers are available directly from the respective Kieser Training studio and upon sending a request to kontakt.datenschutz@kieser-training.com.
16. Complaining to a supervisory authority.
If you believe that the processing of your personal data is in violation of the provisions of the GDPR, you have the right to complain to a supervisory authority in accordance with Art. 77 GDPR.

References: Art. 45
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 7
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 21
 Art. 6
 Art. 21
 Art. 7
 Art. 77