Source: https://www.justetf.com/uk/about/data-privacy.html
Timestamp: 2019-04-24 06:35:23+00:00

Document:
Please feel free to address any questions or concerns regarding data protection/privacy to privacy@justetf.com.
from our customers, prospects and business partners for the purpose of providing contractual services, customer service and customer care, marketing, advertising and market research.
Visitors and users of the online offering (in the following we refer to the affected persons as "users").
“Controller” means the natural or legal person, public authority, agency or other bodies which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person, public authority, agency or other bodies which processes personal data on behalf of the controller.
In accordance with Art. 13 GDPR, we inform you about the legal basis of our data processing. Unless the legal basis in the data protection declaration is mentioned, the following applies: The legal basis for obtaining consent is Article 6 (1) lit. a and Art. 7 GDPR, the legal basis for the processing for delivering our services and the execution of contractual obligations as well as the response to inquiries is Art. 6 (1) lit. b GDPR, the legal basis for processing in order to fulfil our legal obligations is Art. 6 (1) lit. c GDPR, and the legal basis for processing in order to safeguard our legitimate interests is Article 6 (1) lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) lit. d GDPR applies as legal basis.
We take appropriate organisational and technical measures in accordance with Art. 32 GDPR, taking into account the current state of technology, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different likelihood and severity of the risk to the rights and freedoms of natural persons to ensure a level of protection appropriate to the risk.
Measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as their access, input, disclosure, availability and separation. We have also set up procedures to ensure data subject rights, data deletion and data vulnerability. Furthermore, we consider the protection of personal data already in the development, or selection of hardware, software and procedures, according to the principle of data protection through technology design and privacy-friendly default settings (Art. 25 GDPR).
If in the context of our processing, we disclose data to other persons and companies (contract processors or third parties), transmit them to them or otherwise grant access to the data, this will only be done on the basis of a legal permission, you have consented to it, a legal obligation requires it or based on our legitimate interests.
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third-party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfil our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. GDPR. That the processing is e.g. on the basis of specific guarantees, such as the officially recognised level of data protection (e.g. for the US through the Privacy Shield) or compliance with officially recognised special contractual obligations (so-called "standard contractual clauses").
You have the right, at any time upon request, to obtain information from us about your personal data in the scope of Art. 15 GDPR. For this, you can submit a request to privacy@justetf.com or to the address given above.
You have the right to request immediate correction of your personal data if it is incorrect. For this, please contact the contact address listed above or make changes yourself under the menu item "Settings".
Of course, you have the right to request information about the data stored by justETF on your person. You also have the right to correct incorrect data, blockage and deletion. Please contact us at privacy@justetf.com or by mail to the above-mentioned contact.
You have the right to demand that we restrict processing in accordance with Art. 18 GDPR. This right exists in particular if the accuracy of the personal data between the user and us is controversial, for the period of time required to verify correctness and in the event that the user requires limited processing in the case of an existing right of deletion instead of deletion; and in the event that the data is no longer required for the purposes we are pursuing, but the user is required to assert, exercise or defend legal claims, and if the successful exercise of an objection between us and the user is still controversial. To assert your right, please contact the above-mentioned contact.
You have the right to receive from us the personal data relating to you which you have provided to us in a structured, common, machine-readable format in accordance with Art. 20 GDPR. To assert your right, please contact the above-mentioned contact.
You also have the right to lodge a complaint with the relevant supervisory authority for complaints.
You have the right to withdraw your consent at any time in accordance with. Art. 7 (3) GDPR with effect for the future.
You have the right to object against the processing of your personal data on the basis of Art. 21 GDPR at any time, for reasons arising out of your particular situation. This is especially true for personal data processed according to Art. 6 para. 1 lit. e or f GDPR. We will cease the processing of your personal information unless we can establish compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, pursuing or defending legal claims.
"Cookies" are small files that are stored on users' computers. Different information can be stored within the cookies. A cookie is primarily used to store the information about a user (or the device on which the cookie is stored) during or after his visit to an online offer. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online service and closes his browser. In such a cookie, e.g. the contents of a shopping cart in an online shop or a login status are saved. The term "permanent" or "persistent" refers to cookies that remain stored even after the browser has been closed. Thus, e.g. the login status will be saved if users visit it after several days. Likewise, in such a cookie the interests of the users can be stored, which are used for measurement of reach or marketing purposes. A "third-party cookie" refers to cookies that are offered by providers other than the person responsible for providing the online offer (otherwise, if only their cookies are called "first-party cookies").
If you do not want cookies stored on your computer, you will be asked to disable the corresponding option in the system settings of your browser. Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of our online offering.
These data are stored for purely technical reasons and are never associated with any particular individual.
Users can create a user account. As part of the registration, the required mandatory information is communicated to the users and based on Art. 6 para. 1 lit. b GDPR processed for purposes of providing the user account. The processed data includes, in particular, the login information (name, password, country of origin, investor type and an email address). The data entered during registration will be used for the purpose of using the user account and its purpose.
Users will be informed via email about relevant information regarding their user account, e.g. technical changes, portfolio reports and portfolio alert notifications.
If users have terminated their user account, their data will be deleted with respect to the user account, subject to a statutory retention requirement. It is the responsibility of the users to secure their data upon termination before the end of the contract. We are entitled to irretrievably delete all user data stored during the term of the contract.
In the context of the use of our registration and login process as well as the use of the user account, the IP address and the time of the respective user action will be saved. The storage is based on our legitimate interests, as well as the user's protection against misuse and other unauthorised use. A transfer of these data to third parties does not take place unless it is necessary for the prosecution of our claims or there is a legal obligation in accordance with. Art. 6 (1) lit. c GDPR. The IP addresses will be anonymised or deleted after 7 days at the latest.
In addition, you may voluntarily enter virtual portfolio transaction data (collectively referred to as "portfolio data") and a bank name in your user account. We collect this data in order to provide you with the corresponding functions of our portfolio management on justETF, Art. 6 (1) lit. b GDPR.
You are not required to provide the above voluntary information. Without this data, however, we will not be able to provide you with the appropriate features of our portfolio management.
The portfolio data you enter will never be disclosed to third parties or otherwise disclosed. They are only used to produce fully anonymous statistics.
We process the data of our customers during the ordering process of paid subscriptions in our online shop to enable them to select and order the selected products and services as well as pay for them and use them.
The processed data includes base data, contact details, communication data, contract data, payment data and persons affected by the processing belong to our customers, prospects and other business partners. The processing is for the purpose of providing contractual services in the context of the operation of an online shop, billing, provision and customer service.
Processing is based on Art. 6 (1) lit. b (execution of order transactions) and c (legally required archiving) GDPR. The information marked as required for the establishment and fulfilment of the contract is required. We disclose the data to third parties only in the context of the provision, payment or within the framework of the legal permissions and obligations to legal advisers and authorities.
All payment processes are processed via the payment service provider BS PAYONE GmbH (“BS PAYONE”), Lyoner Strasse 9, 60528 Frankfurt / Main, Germany, to whom we provide your information communicated during the ordering process in addition to the information about your order pursuant to Art. 6 (1) lit. b GDPR. The transfer of your data is exclusively for the purpose of payment processing and subscription management with the payment service provider BS PAYONE and only insofar as it is necessary for this purpose.
Amongst the data processed by the payment service provider are base data, e.g. the name and the address, bank data, such as account numbers or credit card numbers. The information is required to complete the transactions. Credit card-related information is only stored and processed by the payment service provider.
We process data in the context of administrative tasks and organisation of our business, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the course of rendering our contractual services. The processing principles are Art. 6 (1) lit. c. GDPR, Art. 6 (1) lit. f. GDPR. The processing affects customers, prospects, business partners and website visitors. The purpose and interest in processing lie in administration, financial accounting, office organisation, data archiving, that is, tasks that serve to maintain our business, perform our duties and provide our services. The deletion of the data in terms of contractual performance and contractual communication corresponds to the information provided in these processing activities.
In order to operate our business economically, to recognise market trends, wishes of the contractors and users, we analyse the data available to us for business transactions, contracts, inquiries, etc. We process base data, contact details, communication data, contract data, payment data, usage data, metadata based on the nature of Art. 6 (1) lit. f GDPR, whereby the data subjects include contractual partners, interested parties, customers, visitors and users of our online offer.
The analyses are carried out for the purpose of business analysis, marketing and market research. In doing so, we can take advantage of profiles of registered users with information, e.g. take into account their services. The analyses serve us to increase the user-friendliness, the optimisation of our offer and business economics. The analyses are for us alone and will not be disclosed externally unless they are anonymous, aggregated value reports.
If these analyses or profiles are personal, they will be deleted or anonymised upon termination of the users, otherwise after two years from the conclusion of the contract. Incidentally, the overall business analyses and general trend projections are created anonymously if possible.
The hosting services we use are designed to provide the following services: infrastructure and platform services, computing capacity, storage and database services, emailing, security and technical maintenance services we use to operate this online offering.
Here we, or our hosting provider, process base data, contact details, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online offering on the basis of our legitimate interests to provide an efficient and secure online offer acc. Art. 6 (1) lit. f GDPR in combination with Art. 28 GDPR (conclusion of data processing contract).
With the following information, we inform you about the content of our newsletter as well as the registration, sending and statistical evaluation procedures as well as your right of objection. By subscribing to our newsletter, you agree to the receipt and the procedures described.
Content of the newsletter: We send newsletters, emails and other electronic notifications with advertising information (hereinafter "newsletter") only with the consent of the recipient or legal permission. Insofar as the content of a newsletter is concretely described, they are authoritative for the consent of the users. Among others, our newsletter contains information about our services and us.
Double opt-in and logging: Registration for our newsletter is done in a so-called double-opt-in procedure. You receive an email asking you to confirm your registration after you registered (e.g. at www.justetf.com/newsletter). This confirmation is necessary so that nobody can register with external email addresses. The registration for the newsletter will be logged in order to prove the registration process according to the legal requirements. This includes saving the registration and confirmation times. Likewise, changes to your data stored with the newsletter service provider will be logged.
Sign-up credentials: To sign up for the newsletter, it is sufficient to provide your email address. Optionally, we ask you to give a surname and first name for a personal salutation.
The sending of the newsletter and the associated performance measurement are based on the consent of the recipients acc. Art. 6 (1) lit. a, Art. 7 GDPR in combination with Art. 7 (2) No. 3 UWG (German law against unfair competition) or if consent is not required, based on our legitimate interests in the direct marketing acc. Art. 6 (1) lt. f GDPR in combination with Art. 7 (3) UWG (German law against unfair competition).
The logging of the registration process is based on our legitimate interests in accordance with Art. 6 (1) lit. f GDPR. Our interest lies in the use of a user-friendly and secure newsletter system, which serves both our business interests and the expectations of the users and also allows us to prove our consent.
Termination / Revocation: You can terminate the receipt of our newsletter at any time, i.e. revoke your consent. A link to cancel the newsletter can be found at the end of each newsletter. We may save the email addresses for up to three years on the basis of our legitimate interests before we delete them in order to provide evidence of prior consent. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for cancellation is possible at any time, provided that at the same time the former existence of consent is confirmed.
The newsletter service provider may use the data of the recipients in pseudonymous form, i.e. without assignment to a user, to optimise or improve their own services, e.g. for the technical optimisation of sending and the presentation of newsletters or for statistical purposes. However, the shipping service provider does not use the data of our newsletter recipients to address them themselves or to pass the data on to third parties.
The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server when opening the newsletter or from the server of the newsletter service provider. This request will collect technical information, such as information about the browser and your system, as well as your IP address and time of retrieval.
This information is used to improve the technical performance of services based on technical data or audience and their reading habits, based on their locations (which can be determined using the IP address) or access times. Statistical surveys also include determining if the newsletters are opened, when they will be opened and which links will be clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. However, it is neither our goal nor that of the newsletter service provider to observe individual users. The evaluations serve us much more to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.
When you contact us (for example, by contact form, email, telephone or via social media), we will process the contact request based on the received data in accordance with. Art. 6 (1) lit. b GDPR. User information can be stored in a customer relationship management system ("CRM System") or comparable software.
Within our online offer, we rely on our legitimate interests (i.e., interest in the analysis, optimisation and economic operation of our online offering) acc. Art. 6 (1) lit. f GDPR industry-standard tracking measures, as far as these are necessary for the operation of the affiliate system. Below we give clarification about the technical background.
The services offered by our contractual partners can also be advertised and linked to other websites (so-called affiliate links or after-buy systems, if, for example, links or services of third parties are offered after the conclusion of a contract). The operators of the respective websites receive a commission if users follow the affiliate links and then take advantage of the offers.
In summary, our online offering requires us to be able to keep track of whether users who are interested in products/services advertised in our online offering through affiliate links. For this, the affiliate links are supplemented by certain values that are part of the link or set otherwise, e.g. in a cookie. The values include in particular the source website (referrer), time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user, as well as tracking specific values such as ad ID, affiliate ID, and categorisations.
The user IDs used by us are pseudonymous values. The identifiers themselves do not contain personal data such as names or email addresses. They only help us determine whether the same user who clicked on an affiliate link or was interested in an offer through our online offer, has signed a contract with a contractual partner. However, online identification is personal in so far as the partner company as well as we possess other user data in combination with it. Only then can the partner company tell us whether the user has taken advantage of the offer.
On the basis of our legitimate interests (i.e. interest in the economic operation of our online offer within the meaning of Art. 6 (1) lit. f GDPR), we are participants in the Amazon EU Affiliate Program, which was designed to provide a medium for websites by means of which the placement of advertisements and links to Amazon.de advertising fee refund can be earned (so-called affiliate system). As an Amazon partner, we earn on qualified purchases.
We are on the basis of our legitimate interests (i.e. interest in the economic operation of our online offer within the meaning of Art. 6 (1) lit. f GDPR) participants of the affiliate program of AWIN AG, Eichhornstrasse 3, 10785 Berlin, Germany, to provide a medium was designed for websites that earn advertising costs by placing advertisements and links to AWIN (so-called affiliate system).
We are based on our legitimate interests (ie interest in the economic operation of our online offer within the meaning of Art. 6 (1) lit. f GDPR) Participants of the affiliate program of financeAds GmbH & Co. KG, Karlstrasse 9, 90403 Nuremberg, Germany, the was designed to provide a medium for websites that can be used to earn advertising costs through the placement of advertisements and links to financeAds (so-called affiliate system).
We only use Google Analytics with activated IP anonymisation. This means that the IP address of the users will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there.
The IP address submitted by the user's browser will not be merged with other data provided by Google. You can prevent the storage of cookies by setting your browser software accordingly; In addition, you may prevent the data collection by Google generated by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
We use the services of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, ("Google") on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online service within the meaning of Art. 6 (1) lit. f GDPR).
We use Google's online AdWords marketing tool "AdWords" to place ads on the Google advertising network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who have a suspected interest in the ads. This allows us to more specifically display ads for and within our online offering so that we only present ads to users that potentially match their interests. “Remarketing” in this regard is targeted advertising of a product to a user in which he has previously shown an interest on a different website.
For this purpose, Google executes a code to set (re)marketing tags (invisible graphics or code also known as “web beacons“ on our website or any other website that belongs to the Google Advertising Network.
With their help, the user is provided with an individual cookie, i.e. a small file is saved (instead of cookies, comparable technologies can also be used). In this file is noted which websites the user visited, in which content he is interested and what offers the user has clicked, as well as technical information about the browser and operating system, referring websites, visit time and other information on the use of the online offering.
Furthermore, we receive an individual "conversion cookie". The information obtained through the cookie is used by Google to generate conversion statistics for us. We only receive the anonymous total number of users who clicked on our ad and were redirected to a conversion tracking tag page. We do not receive any information that personally identifies users.
The data of the users are pseudonym processed within the Google advertising network. That means, Google does not store and process the name or email address of the users but links the cookie data to pseudonymous user profiles. From the perspective of Google, the ads are not managed and displayed to a specifically identified person, but to the cookie owner, regardless of who that cookie owner is. This does not apply if a user has explicitly allowed Google to process the data without this pseudonymisation. The information collected about users is transmitted to Google and stored on Google's servers in the United States.
We maintain an online presence within social networks and platforms in order to communicate with customers, prospects and active users as well as inform them about our services. When calling the respective networks and platforms, the terms and conditions and their data privacy guidelines apply.
Based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 (1) lit. f. GDPR), we make use of content or services offered by third-party providers in order to provide their content and services to our users, such as include videos or fonts (collectively referred to as "content").
This always presupposes that the third-party providers of this content perceive the IP address of the users since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content. We endeavour to use only content whose respective providers use the IP address solely for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website.
The pseudonymous information may also be stored in cookies on the user's device and may include, but is not limited to, technical information about the browser and operating system, referring web pages, visit time, and other information regarding the use of our online offering.
We embed YouTube videos offered by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
We use "Google Fonts" offered by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Within our online offering, we incorporate features and content of the Twitter service offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.
This could be content such as images, videos, or text and buttons that users use to like or comment on content, subscribe to the content creators, or subscribe to our posts. If the users are members of the platform Twitter, Twitter can match activities to the profiles of the users there.
Twitter is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active).
We do not use plugins from social networks on our website such as Facebook, Twitter, WhatsApp, LinkedIn and Xing. Our content sharing buttons are implemented via so-called deep links, which only pass on data to the respective network operators when you use them.
Only when you click on such a button, various data are transmitted to the respective social network. This may include: the date and time of the visit to the site, the URL of the site on which the visitor is located, the URL of the site the visitor previously visited, the browser used, the operating system used and the IP address of the visitor.
If you are logged in parallel to the respective social network (Facebook, Twitter, WhatsApp, LinkedIn or Xing) while visiting our page, it is not excluded that the provider assigns the visit to your network account. If you click on a social media button (for example, clicking the "Like" button, submit a comment), this information is also transmitted directly from your browser to the respective social network and stored there if necessary. The purpose and scope of the data collection and the further processing and use of the data by the networks can be found in the privacy policies of Facebook, Twitter, WhatsApp, LinkedIn and Xing.
We process the applicant data only for the purpose and in the context of the application process in accordance with the legal requirements. The processing of the applicant data takes place in order to fulfil our (pre)contractual obligations in the context of the application process within the meaning of Art. 6 (1) lit. b. GDPR Art. 6 (1) lit. f GDPR applies if the data processing e.g. is required for us in the context of legal proceedings (in Germany, Art. 26 BDSG applies additionally).
Applicants can send us their applications via email or by post. However, please note that emails are generally not sent in encrypted form and that applicants themselves must provide encryption. Therefore, we cannot take any responsibility for the transmission of the application between the sender and the reception on our server and therefore recommend to use the postal shipping.
In the case of a legitimate revocation, the deletion takes place after the expiration of a period of six months, so that we can answer any follow-up questions to the application and fulfil our proof obligations under the Equal Treatment Act. Invoices for any reimbursement of travel expenses are archived in accordance with the tax regulations.
The disclosure of this data is based on our legitimate interest in the fight against abuse, the prosecution of criminal offences and the protection, assertion and enforcement of claims and that your rights and interests in the protection of your personal data do not predominate, Art. 6 (1) lit. f GDPR.
Any disclosure of personal data is justified by the fact that we have a legitimate interest in adapting our corporate form as required by economic and legal circumstances and do not outweigh your rights and interests in the protection of your personal data, Art. 6 (1) lit. f GDPR.
Processing of your personal data for purposes other than those described will only take place if a legal provision allows this or if you have consented to the changed purpose of the data processing. In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes before further processing and provide you with all other relevant information.
We will delete or anonymise your personal data as soon as it is no longer necessary for the purposes for which we collected or used it in accordance with the preceding paragraphs. As a rule, we store your personal data for the duration of the use or contractual relationship via the website.
When you delete your user account, your profile will be completely and permanently deleted.
After the expiration of these periods the data will be deleted, as far as these data are not needed longer because of legal storage periods, for the criminal prosecution or for the protection, assertion or enforcement of legal claims. In this case, they will be locked. The data is then no longer available for further use.

References: Art. 13
 Art. 7
 Art. 6
 Art. 6
 Art. 6
 Art. 32
 Art. 44
 Art. 15
 Art. 18
 Art. 20
 Art. 7
 Art. 21
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 7
 Art. 7
 Art. 6
 Art. 7
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 26
 Art. 6
 Art. 6