Source: https://schottmusiclondon.com/shop/datenschutz/
Timestamp: 2019-04-25 02:14:00+00:00

Document:
When using the website www.schottmusiclondon.com and its functions, making contact with us and submitting a query, you transfer your personal data to us, which we use to process your queries. This data is used by us strictly for this purpose only, within the framework of data protection legislation.
As a matter of principle, we only process personal data to the extent required in order to provide a properly functioning website and to deliver our content and services.
The legal basis for processing personal data is Article 6 (1) a) – f) of the General Data Protection Regulation (GDPR).
If the data subject gives consent, Art. 6 (1) a) GDPR is the legal basis.
Art. 6 (1) b) GDPR is the legal basis for the processing of personal data for the fulfilment of a contract in which the data subject is a contracting party or for the processing procedures for pre-contractual measures.
If processing is required to meet a legal obligation of the data controller, Art. 6 (1) c) GDPR is the legal basis.
If essential interests of the data subject or another natural person make processing necessary, Art. 6 (1) d) GDPR is the legal basis.
If processing is required to carry out a task that is in the public interest or to exercise public authority that has been transferred to the data controller, the legal basis is Art. 6 (1) e) GDPR.
If processing is required to protect a legitimate interest of our company and if the interests, basic freedoms and basic rights of the data subject do not outweigh this, the legal basis is Art. 6 (1) f) GDPR.
Whenever you make contact with us, we collect personal data. This data is saved by us, partly in accordance with statutory regulations, partly because it is required to conclude a contract. If you wish to conclude a contract with us, you must provide us with your data so that we can deliver/render our services to/for you. We are also under legal retention obligations in respect of tax and commercial law that we must meet. Otherwise we may be unable to provide you with our services.
Before providing your personal data, you are welcome to get in touch with your contact in our company to find out if we require your data to conclude a contract and/or to meet our statutory retention obligations and what the consequences will be if you do not provide us with this data.
We store your personal data as long as is necessary to fulfil the particular purpose or as is prescribed by legal regulations, Art. 6 (1) c) GDPR.
If the purpose of storage of personal data no longer exists, the data shall be erased after 6 months or its processing shall be restricted, unless there is still a need for further storage of the data to conclude or fulfil a contract.
Storage beyond this shall take place only if European or national legislation dictates.
For security purposes and to protect your confidential data, we use SSL and TLS encryption throughout our website.
As a result of this encryption, confidential data that you send to us, such as queries or orders, cannot be seen by third parties.
You can recognise an encrypted connection by the fact that the address bar of your browser changes from "http://" to https://. Many browsers also give a further visual indication – such as a padlock symbol.
When this site is accessed, requests are sent to the server that must receive a response. Your IP address must be collected and processed so that the corresponding server requests can be answered.
The legal basis for the processing of this data is Art. 6 (1) f) GDPR.
The purpose of processing your IP address is to ensure functioning of the website and provide technical access to it.
The legitimate interest in the temporary storage of your IP address lies in the fact that the functioning of and provision of technical access to the website is not possible without it.
The data will be deleted as soon as further storage is no longer required to achieve the particular purpose.
When recording data to make the website accessible, this is the case when the retrieval process is complete.
We use the services of our hosting service provider for the technical implementation of the website, to make it accessible, and to carry out technical maintenance.
This comprises the provision of storage and database services and the maintenance and servicing of these.
The purpose of processing is the implementation of the online service and the detection of malfunctions or any attempted unauthorized access.
The legitimate interest in commissioning the hosting service provider is to have external technical competence and the provision of a functioning and uncompromised technical website environment.
The IP addresses recorded when accessing this site are also stored in so-called server log files to identify and allow rectification of technical faults, attempted manipulation, and/or unauthorised access to the server structure.
The hosting provider for this website also automatically collects, stores and processes information in so-called server log files, which is transferred automatically by your browser.
However, this information is not combined with any other data sources.
The purpose of processing your IP address and the above information is detecting malfunctions and any attempts at unauthorised access.
The legitimate interest in processing the IP address and the aforementioned information is the provision of a functioning and uncompromised technical website environment.
The data is erased within 7 days.
The site www.schottmusiclondon.com uses so-called "cookies". Cookies are text files that are stored in the memory and/or on a data storage carrier of the device you use to visit the site and are processed by your web browser in accordance with its settings. We use a cookie when you log in to your customer account to determine whether you have registered. We also use a shopping basket cookie to identify and process the products that you have placed in your shopping basket in the context of the ordering process.
The legal basis for such processing is Art. 6 (1) b) and Art. 6 (1) f) GDPR.
These cookies contain technical information for the provision of website functions concerning ordering procedures and customer accounts processes. This facilitates technical implementation of the purchasing and customer account processes.
Our legitimate interest lies in the provision of a technical environment which presents an online purchasing process for our customers and users. The cookies used only contain technical data and product information, which provide a technical representation of the completion of an online purchase by our customers at the initiative of our customers.
The cookies used on the site are so-called "session cookies". They are automatically deleted from the browser cache/memory of your computer at the end of your visit to our website and/or when you close your browser, provided that you have activated this function in your browser.
Please check the settings of your internet browser (e.g. Firefox, Internet Explorer, Edge, Chrome, Opera, Safari) in regards to this. You internet browser also gives you the option to control how you handle cookies or to deactivate them completely. Cookies that have already been saved can be deleted at any time. This can also take place automatically. If cookies are deactivated for our website, it may be the case that it is not possible to use all of the functions of the website to the fullest extent possible.
A contact form is provided on our website which is used only for electronic contact. We process your personal data only to the extent that you communicate it to us when you make contact.
The fields marked with an asterisk "*" symbol are obligatory and queries cannot be sent to us using this form unless they are completed.
Please enter your telephone number only if you want us to contact you by telephone.
Providing your name allows us to address you in person when we process your query.
Simply entering the data on the form does not communicate any data to us, as this happens only when you press the blue "Submit" button.
The legal basis for the processing of personal data for handling and responding to your queries is Art. 6 (1) f) GDPR.
The legal basis for the processing of personal data for the preparation and/or implementation a contractual relationship is Art. 6 (1) b) GDPR.
Processing of personal data via the contact form is used solely for the purpose of making contact and allows the customer to request information from the company at the initiative of the customer.
Depending on the intention and content of your query, the purpose may also be the initiation and/or execution of a contractual relationship.
The legitimate interest in data processing lies in the option to process your query and respond to your query appropriately. The data collected is processed on the basis of a query that comes from you. This processing is also in your interest, so that we can respond to your query in accordance with your expectations.
The data is erased within 6 months of the point at which it is no longer required to achieve the purpose for which it was collected, provided that it is not subject to further statutory retention obligations (e.g. 10 years under the German Tax Code, 6 years under the Commercial Code). This is the case for the data that you enter in the contact form if the conversation with the user has ended.
The conversation is ended when circumstances indicate that the issue in question has been resolved definitively.
Processing of the personal data in the course of registration serves to create the customer account by means of which you can manage your orders and contract data more easily.
Your personal data will be erased if you instruct us to erase your customer account. This does not apply if the data is subject to further statutory retention obligations (e.g. 10 years under the German Tax Code, 6 years under the Commercial Code). In this case, processing is limited to the expiry of the retention period.
You can initiate product orders in our shop, which we will then supply within the framework of our shipping process.
You can use the shop functions as a guest or as a registered customer.
The information provided above applies for setting up a customer account online.
The purpose of the processing of the personal data in the context of the order is to process the order, process the payment, arrange for delivery of the product and facilitate any complaints, as well as to maintain and support the customer relationship.
The data is erased within 6 months (or 12 months in the case of bookings for rehearsal rooms and concert space) of the point at which it is no longer required to achieve the purpose for which it was collected, provided that it is not subject to further statutory retention obligations (e.g. 10 years under the German Tax Code, 6 years under the Commercial Code). In this case, processing is limited to the expiry of the retention period.
Personal data is processed for queries submitted by email in accordance with the content of the email.
The data is used exclusively to process the conversation and/or to implement and/or initiate a contractual relationship.
Due to the explicit query coming from the user by email, the legal basis for the processing of this data is Art. 6 (1) f) GDPR. If the aim of the email contact is also to conclude and/or execute a contract, the additional legal basis for processing is Art. 6 (1) b) GDPR.
Processing of personal data via email query is used solely for the purpose of making contact and allows the customer to request information from the company at the initiative of the customer.
Depending on the intention and content of your query, the purpose may also be to initiate and/or execute a contractual relationship, process an order, process payment, arrange for delivery, facilitate complaints, and to maintain and support the customer relationship.
The legitimate interest in data processing lies in the option to process your query and respond to your query appropriately. This processing is also in your interest, so that we can respond to your query in accordance with your expectations.
The data will be erased if you instruct us to erase it. This does not apply if the data is subject to further statutory retention obligations (e.g. 10 years under the German Tax Code, 6 years under the Commercial Code). In this case, processing is limited to the expiry of the retention period.
Personal data is processed for telephone queries in accordance with the content of the conversation.
No credit/debit card data is stored, unless you submit a written request for us to store it.
Due to the explicit query coming from the user via telephone, the legal basis for processing of this data is Art. 6 (1) f) GDPR. If the aim of the telephone contact is also to conclude and/or execute a contract, the additional legal basis for processing is Art. 6 (1) b) GDPR.
The processing of personal data through the telephone call is solely done for the purpose of making contact and allows the customer to request information from the company at the initiative of the customer.
We offer a newsletter containing advertising information for our customers and potential customers. Subscription to our newsletter service uses the double opt-in procedure to verify your registration.
You register using the newsletter form and, once you have pressed the Register button, you are sent a link via email which you can click in order to confirm and conclude the newsletter subscription process. Once you have clicked on this activation link, you will receive regular mailshots with the content described in detail when you subscribe to the newsletter. You can revoke this subscription at any time with effect from that point forward by clicking on the cancellation link included in every newsletter.
Our newsletter provides information about our offers, services and us.
We log/record your subscription to our newsletter so that we can provide evidence of the subscription in accordance with applicable statutory provisions.
In this process, the registration and confirmation times and your IP address are saved.
At the same time, your data is also logged and saved by our delivery service provider.
The data you provide when subscribing is processed in our CRM system for legally compliant management of your consent.
The legal basis for the processing of this personal data for the sending of the newsletter is Art. 6 (1) f) GDPR.
The legal basis for the processing and logging/recording of the subscription process is Art. 6 (1) f) GDPR.
Data processing is solely done for the purpose of sending out our newsletter and your legally compliant subscription to it.
Our legitimate interest lies in contacting you in a customer-friendly and user-friendly way for the purposes of direct advertising (Recital 47 to the GDPR) as well as for logging/recording the subscription process in a legally compliant manner.
The data you provide when subscribing to the newsletter is erased by us at the latest 6 months from your cancellation of the newsletter.
Our newsletter is created using Newsletter2Go from the delivery service provider Newsletter2Go GmbH, Köpenicker Str. 126, 10179 Berlin, Germany.
Our delivery service provider is commissioned to work on our behalf on the basis of an order data processing agreement in accordance with Art. 28 (2) and (4) GDPR.
Our delivery service provider will not use your data to write to you directly.
We provide regular information about current job vacancies in job advertisements and on our website. You have the opportunity to apply for such vacancies. You can send your application data to us by post or by email.
The data is used exclusively in the context of the application process to take a decision about filling the post.
The legal basis for processing data in the context of the application process is Art. 6 (1) b) GDPR.
If, in the course of the application process, you provide us with special categories of personal data, such as information about an existing serious disability or about your health, which is required to assess your suitability for a specific job, processing of the data communicated to us at your initiative is done in accordance with Art. 9 (2) b), h) GDPR, Section 26 (3) BDSG.
The processing or personal data in the course of the application process is solely done for the purpose of personnel planning and establishing employment relationships.
The legitimate interest in processing the data lies in the need to fill vacancies with qualified applicants as part of sustainable personnel planning and company management.
If an application is turned down, the data is erased within 6 months of the rejection. Data relating to successful applications is subject to retention obligations under the regulations of employment and social law, the Tax Code and the Commercial Code.
If your personal data is processed, you are the data subject within the meaning of the General Data Protection Regulation. You therefore have the following rights in respect of the data controller.
You have the right to request confirmation from the data controller as to whether your personal data is being processed or not.
• the existence of an automated decision-making process including profiling in accordance with Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, the scope and the intended effects of processing of this sort for the data subject.
You also have the right to demand information about whether the personal data about you is being transferred to a third country or an international organisation. Here, you can also demand information about the appropriate guarantees pursuant to Art. 46 GDPR in connection with such transfer.
You have the right, vis-a-vis the data controller, to immediate correction and/or completion of the data about you, insofar as the personal data is incorrect or incomplete.
• the personal data about you has been collected in relation to the information society services offered pursuant to Art. 8 (1) GDPR.
• if you have objected to processing pursuant to Art. 21 (1) GDPR and it has not yet been established whether the legitimate reasons of the data controller outweigh your reasons.
If processing of the personal data about you has been restricted, with the exception of storage, this data may be processed only with your consent or to assert, exercise or defend against legal claims or to protect the rights of another natural or legal person or for reasons of significant public interest in the EU or a Member State.
If processing has been restricted on the basis of the conditions described, you shall be notified by the data controller before the restriction is lifted.
If you have exercised one of your rights to correction, erasure or restriction of processing, we are obliged to notify all recipients to whom the personal data about you has been disclosed of the correction or erasure of the data or restriction of processing, unless this proves to be impossible or is associated with a disproportionate amount of work.
You also have the right to be informed of those recipients.
b) processing is carried out with the aid of an automated process.
In exercising this right to data transferability, you also have the right to have the personal data about you transferred directly from one data controller to another data controller, insofar as this is technically feasible.
You have the right for reasons resulting from your specific situation to object, at any time, to the processing of personal data about you that is/was carried out on the basis of Art. 6 (1) e) or f) GDPR; this also applies to profiling based on these provisions.
The data controller shall stop processing the personal data about you unless the data controller can demonstrate compelling reasons for processing that are worthy of protection and outweigh your interests, rights and freedoms, or the processing serves to assert, exercise of defend against legal claims.
If personal data is processed for the purposes of direct advertising, you have the right to object to the processing of personal data about you for the purposes of such advertising at any time; this also applies to profiling, insofar as it is connected with such direct advertising.
If you object to processing for purposes of direct advertising, the personal data about you shall no longer be processed for those purposes.
Notwithstanding Directive 2002/58/EC, you have the option, in connection with the use of services of the information company, to exercise your right to object by means of automated processes in which technical specifications are used.
You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawing your consent does not affect the legality of the processing that was already carried out on the basis of your consent up to the point at which you withdraw it.
Irrespective of any other legal remedies under administrative law or in court, you have the right to complain to a supervisory authority, in particular in the Member State of your normal place of residence, your place of work or the location of the alleged breach, if you believe that the processing of the personal data about you breaches the General Data Protection Regulation.
The supervisory authority to whom you submit your complaint shall notify you, as the complainant, of the status and outcome of the complaint, including the option to seek legal remedy in court pursuant to Art. 78 GDPR.
This data protection policy will be updated at regular intervals.

References: Art. 6

Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 9
 Art. 22
 Art. 46
 Art. 8
 Art. 21
 Art. 6
 Art. 78