Source: https://www.soyka.de/en/privacy-statement
Timestamp: 2019-04-22 12:15:24+00:00

Document:
We at Soyka GmbH, thank you for your interest in our website and the services offered there.
Protecting your personal information is a very important concern for our company. The following document will provide you with comprehensive information about the kind of data we record when you visit our website, and how we process or use that data thereafter. In addition, this document will also explain the other technical and organisational protective measures we have taken to safeguard your data.
We always process the personal data of data subjects, such as your name, address, e-mail address, or telephone number in accordance with applicable data privacy law regulations. In this Data Privacy Declaration, we will inform you of the type, scope, and purpose of the personal information we collect, use, and process, and help you understand whether you are affected by data processing.
Although we have taken a large number of technical and organisational measures as the entity responsible for data processing, web-based data transmissions may always have gaps in security. There is no way to guarantee absolute protection for your data. We ask that you take this into consideration when using our website.
The goal of our Data Privacy Declaration is to provide information on how your personal information is processed on our website in a simple and easy to understand format.
If not otherwise indicated in section B. of this Data Privacy Declaration with respect to processing personal information, we delete saved data once it is no longer required for its specific purpose, unless there are statutory retention periods that apply to the data. If we do not delete a data subject's data because it is required for other legally permissible purposes, then we instead restrict its processing. This means the data is blocked and not used for other purposes. This applies, for instance, to data of data subjects that must be saved for tax law or commercial law reasons.
Data is stored for six years in accordance with Sec. 257 para.1 HGB (German Commercial Code) (account books, inventories, opening balances, annual financial statements, commercial letters, accounting documents, etc.) under the law, o for ten years in accordance with Sec. 147 para. 1 AO (German Tax Code) (accounting books, records, management reports, accounting documents, commercial and business letters, etc.).
Under EU guidelines, all data subjects have been granted the right to request confirmation from entities responsible for processing of whether that entity does process their personal information. If a data subject wants to take advantage of this right to confirmation, they may contact us at any time.
Furthermore, the data subject has a right to information regarding whether personal information was transmitted to a third party country or international organisation. If this is the case, the data subject also has the right to receive information on suitable guarantees associated with the transmission.
If a data subject wants to take advantage of this informational right, they are welcome to contact us at any time.
Any individual affected by the processing of personal data has the right to request a prompt rectification of incorrect personal data on themselves. Furthermore, the data subject has the right to request the rectification of incomplete personal data through a supplementary declaration, in consideration of the purpose of processing.
If a data subject wants to take advantage of this right to rectification, they are welcome to contact us at any time.
- Personal information was collected or processed for purposes or in some other manner for which it is no longer required.
- The data subject revokes their consent, upon which the processing is based in accordance with Art. 6 para. 1 letter a GDPR or Art. 9 para. 2 letter a GDPR, and there is no other legal basis for processing.
- The data subject submits an objection to processing in accordance with Art. 21 para. 1 GDPR, and there are no reasons for the processing that take priority, or the data subject submits an objection to processing in accordance with Art. 21 para. 2 GDPR.
- The personal information was processed illegally.
- Deletion of personal information is required to fulfil a legal obligation under EU law or the law of its member states, to which the responsible entity is subject.
- The personal information was collected in relation to offered IT services in accordance with Art. 8 para. 1 GDPR.
If one of the above justifications applies, and if a data subject requests that Soyka GmbH delete personal information that relates to them, they are welcome contact us at any time. We will ensure we fulfil the deletion request as soon as possible.
If Soyka GmbH publicly disclosed the data, and if our company is obligated to delete the personal information as the responsible entity under Art. 17 para. 1 GDPR, Soyka GmbH will take appropriate measures - in consideration of available technology and implementation costs - including technical measures, to inform other entities responsible for data processing who process published personal information that the data subject has requested these other entities responsible for data processing delete all links to this personal information or copies or duplicates of this personal information, if the processing is not mandatory. We will do what is necessary in each individual case.
- The data subject disputes the correctness of the personal information for a long enough period to allow the responsible entity to review the correctness of the personal information.
- The processing is illegal, and the data subject rejects the deletion of personal information and instead requests a restriction for the use of personal information.
- The responsible entity no longer requires the personal information for the purposes of processing; however, the data subject requires it to assert, exercise, or defend against legal claims.
- The data subject has objected to processing in accordance with Art. 21 para. 1 GDPR, and it is not yet clear whether the responsible entity's justifiable interests outweigh those of the data subject.
If one of the above applies and a data subject would like to request that Soyka GmbH restrict the processing of personal information, they are welcome to contact us at any time. We will then initiate the restriction of processing.
Any person affected by the processing of personal information has the right to receive that personal data in a structured, accessible, and machine-readable format. The responsible entity must provide this data to them. The data subject also has the right to transmit this data to another responsible entity without being prevented from doing so by the responsible entity that provided the personal information, if such processing is based on their consent in accordance with Art. 6 para. 1 letter a GDPR or Art. 9 para. 2 letter a GDPR, or on an agreement in accordance with Art. 6 para. 1 letter b GDPR, and if the processing is completed using automated processes, if processing is not necessary to complete a task in the public interest or to exercise public authority assigned to the responsible entity.
Furthermore, while exercising its right to data portability, the data subject has the right under Art. 20 para. 1 GDPR to ensure their personal information is transmitted directly from one responsible entity to another if technically feasible, and if this does not affect the rights and freedoms of other individuals.
Data subjects are welcome to contact us at any time to assert their right to data portability.
Any person affected by the processing of their personal data has the right to submit an objection to the processing of their personal data under Art. 6 para. 1 letters e or f GDPR for reasons related to their specific situation at any time. This also applies to profiling based on these provisions.
Soyka GmbH will no longer process an individual's personal information after receiving an objection unless we have a mandatory and protected interest in doing so that outweighs the rights and freedoms of the data subject, or if data is processed in relation to asserting, carrying out, or defending against legal claims.
If Soyka GmbH processes personal information for direct advertising purposes, data subjects have the right to object to such processing of personal information at any time for the purpose of such advertisements. This also applies to profiling, if associated with such direct advertisements. If the data subject objects to Soyka GmbH processing their data for direct advertising purposes, Soyka GmbH will no longer process their personal information for these purposes.
In addition, the data subject has the right to object to processing of their personal data by Soyka GmbH for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, unless such processing is required to fulfil a tasks that is in the public interest.
The data subject is welcome to contact us directly to exercise this right to object. The data subject is furthermore to exercise its right to object through automated processes involving technical specifications in conjunction with using IT company services, regardless of directive 2002/58/EG.
- If it is made with the express consent of the data subject, Soyka GmbH will take appropriate measures to safeguard the rights, freedoms, and justifiable interests of the data subject, including at least the right to have decisions made by the responsible entity reviewed by a person, the right to present one's own standpoint, and the right to contest decisions.
If a data subject wants to assert rights associated to automatic decision-making processes, they are welcome to contact us at any time.
Any person affected by the processing of personal data has the right to revoke their consent to the processing of their personal data at any time.
If a data subject wants to assert their right to revoke their consent, they are welcome to contact us at any time.
Any data subject can contact us directly with questions or concerns related to data privacy.
Any person affected by the processing of personal data has the right to submit a complaint with a data subject supervising authority regarding our processing of their personal data.
Unless otherwise indicated in the description of the data processing procedure in the following section B. of this Data Privacy Declaration, the following regulations apply.Soyka GmbH considers Art. 6 I lit. a GDPR the legal basis for processing that requires consent be obtained for a specific purpose. If personal data must be processed to fulfil an agreement to which the data subject is a party, processing is based on Art. 6 I lit. b GDPR. The same applies to processing necessary to carry out pre-contractual measures, for instance if there are inquiries regarding our services or products. If Soyka GmbH is subject to legal obligations that require processing of personal information, the processing is done based on Art. 6 I lit. c GDPR. In rare cases, it may be necessary for the company to process personal information to protect the vital interests of the data subject or another natural person. In this case, processing is based on Art. 6 I lit. d GDPR. Finally, processing may be based on Art. 6 I lit. f GDPR. Processing not included under any of the above legal justifications is carried out on this legal basis, if processing is necessary to safeguard a justifiable interest of Soyka GmbH or a third party, unless outweighed by the interests, basic rights, and basic freedoms of the data subject. We are allowed to carry out such processing, in particular, because it has been specifically mentioned in European law (cf. Recital 47 clause 2 GDPR).
If not otherwise indicated in the description of the respective data processing procedure in section B. of this Data Privacy Declaration, and if processing of personal data is based on Article 6 I lit. f GDPR, our justifiable interest relates to carrying out our business activities and our associated economic interests.
If you use contact data provided on our website (such as our e-mail address or fax number) to contact us, the personal information you provide in this context is only used in relation to the purpose for which you contacted us.
If we are contacting you to provide you with our services or products, or to fulfil an agreement you have with us, the legal basis for this contact is Art. 6 para. 1 lit. b GDPR. In all other cases of contact, we have a justifiable interest in data processing under Art. 6 para. 1 lit. f GDPR based on the communication initiated by you.
We save data necessary to carry out the agreement until the end of the statutory warranty and any contractual guarantee terms. We archive data required under tax and commercial law for the legally mandated time period, typically ten years (cf. Sec. 257 HGB, Sec. 147 AO). We delete data processed to handle pre-contractual measures once said measures have been completed and it is clear that no contract will be concluded.
Personal information saved by us based on our justifiable interests is saved until we have achieved the purpose associated with the contact. You have the right to object at any time to data processing based on Art. 6 para. 1 f) GDPR and not related to direct advertising for reasons related to your specific situation. In cases of direct advertising, in contrast, you can object to processing at any time without providing grounds.
The recipients of personal information processed under this regulation are IT service providers (in particular hosters) with whom we have concluded contract data processing agreements in accordance with Art. 28 GDPR.
We collect and process the personal information of applicants for the purpose of carrying out the application process and therefore based on a pre-contractual measure in the sense of Art. 6 para. 1 lit. b GDPR, or under our justifiable interest in hiring employees in accordance with Art. 6 para. 1 lit. f GDPR.
Data may also be processed electronically, for instance if an applicant submits application documents electronically to us, for instance via e-mail or using our contact form. If we conclude an employment agreement with an applicant, the transmitted data is saved for the purpose of carrying out the employment relationship in accordance with legal regulations. If the entity responsible for processing does not conclude an employment agreement with the applicant, application documents are automatically deleted two months after the applicant is informed of their rejection, unless the entity responsible for processing has other justifiable interests in processing such data. Other justifiable interests in this sense include, for instance, a burden of proof in proceedings under the German General Equal of Treatment Act (AGG).
Because incoming applications are processed digitally, the recipients of the processed personal information are our IT service providers (in particular hosters), with whom we have concluded relevant contract data processing agreements in the sense of Art. 28 GDPR.
Soyka GmbH reserves the right to amend these data privacy provisions at any time with future effect. An updated version is always available on the website. Please visit our website regularly to review the applicable data privacy provisions.
The scope and type of processing and use of your data depends on whether you only visit our website to access information, or if you take advantage of services we offer, such as you do if you conclude an agreement through our website.
(2) We do not save data processed in accordance with para. 1 of this regulation.
(3) In addition to the data indicated above, cookies are saved on your computer when you use our website. These are saved based on our justifiable interest in accordance with Art. 6 para. 1 lit. f GDPR in optimising the economical operation of our online services. Cookies are small text files saved on your hard drive and assigned to the browser you use. These are used to provide the entity saving the cookie (us in this case) with certaininformation. Cookies cannot execute programmes or transmit viruses to your computer. They are used to make our website more user-friendly and more effective overall.
Transient cookies are automatically deleted when you close your browser. These include session cookies in particular. These save a so-called session ID which can be used to assign various inquiries from your browser to the overall session. This allows us to recognise your browser again when you return to our website. Session cookies are deleted when you log out or close your browser.
b) You can configure your browser settings as you want, for instance to reject third party cookies or all cookies. We would like to note that you may not be able to use all of the functions of this website if you do so.
(5) The recipients of data processed in accordance with the above paragraphs are IT service providers (in particular hosters) with whom we have concluded contract data processing agreements in accordance with Art. 28 GDPR.
Google is certified under the Privacy Shield agreement, guaranteeing that it will comply with European data privacy law. (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
We use the suffix “_gat.anonymizeIp” for web analysis via “Google Analytics.” This suffix ensures the IP address for the data subject's internet connection is abbreviated and anonymised by Google if they access our websites from a member state of the European Union or another contracting state to the Agreement on the European Economic Area.
Google Analytics components are used to analyse visitor streams to our website. Google uses the data and information collected partially to analyse use of our website, in order to generate online reports for us describing activity on our websites, and to perform other services associated with use of our website.
Google Analytics saves a cookie on the device of the data subject. Saving this cookie allows Google to analyse use of our website. Each time a user accesses an individual page of our website where Google Analytics components are integrated, the respective Google Analytics components automatically cause the data subject's web browser to transmit data to Google for use for online analysis. Google receives personal information during this technical process including the data subject's IP address. Google uses this information, for instance, to analyse the origins of visitors and clicks and then pay commission settlements.
Cookies are used to save personal information, such as the time of access, place of access, and frequency of visits to our website by the data subject. Each time a data subject visits our website, this personal information, including the IP address of their internet connection, is transmitted to Google Inc. in the USA. Google Inc. in the USA probably saves this information permanently. Google Inc. may provide personal information collected through this technical process to third parties.
Data subjects can prevent cookies from being saved by our website at any time by changing the settings accordingly in their web browser, thereby permanently objecting to cookies. Changing the settings on your web browser would also prevent Google from saving a cookie on the data subject's IT system. In addition, cookies saved in the past by Google Analytics can be deleted at any time through your web browser or using other software programmes.
Further information and Google's applicable data privacy provisions are available at https://www.google.de/intl/de/policies/privacy/and at http://www.google.com/analytics/terms/de.html.
Google Analytics is explained in more detail at the link https://www.google.com/intl/de_de/analytics/.
We use a plug-in from the web service Google Maps on our website based on our justifiable interest in accordance with Art. 6 para. 1 lit. f GDPR. The provider of Google Maps is Google Inc., headquartered in the USA, CA 94043, 1600 Amphitheatre Parkway, Mountain View.
Google is certified under the Privacy Shield agreement and guarantees to comply with European data privacy law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
If you take advantage of services offered on our website, such as by ordering goods in our web shop or using our contact form, you will be required to provide further personal information. The following regulations provide further details on such services.
(1) The personal information you provide us during the order process is required to conclude an agreement with us (such as information ona contractual partner) or required by law (such as under tax law). Failure to provide such personal information would make it impossible for us to conclude the agreement with you. In some payment processes, we are required to provide payment data to our commissioned payment services provider.
If you send us an inquiry using e-mail or our contact form before concluding an agreement or if you conclude an agreement through our website, we process data received in this respect to carry out pre-contractual measures and answer your questions on our services or products, for instance.
You can voluntarily create a customer account, allowing us to save your data for later purchases. If you create an account under “Your account”, the data you provide is saved, although you can revoke this saving. You can always delete all other data, including your user account, in the customer area.
The data you enter is processed for the purpose of fulfilling an agreement or carrying out pre-contractual measures in accordance with Art. 6 para. 1 b GDPR and to fulfil legal obligations under Art. 6 para. 1 c GDPR.
(2) The recipients of personal information processed under this regulation are shipping service providers, IT service providers (in particular hosting), and suppliers with whom we have concluded contract data processing agreements in accordance with Art. 28 GDPR.
(3) We save data necessary to carry out the agreement until the end of the statutory warranty and any contractual guarantee terms. We archive data required under tax and commercial law for the legally mandated time period, typically ten years (cf. Sec. 257 HGB, Sec. 147 AO). Data processed to carry out pre-contractual measures is deleted once the measures have been completed and it is clear that no agreement will be concluded.
Please see Google's Data Privacy Notice for information on what data is recorded and how it is used: www.google.com/privacy Options for protecting your privacy are available at: www.google.com/dashboard.
We take organisational, contractual and technical Security measures according to state of the art technology to ensure we comply with data privacy law regulations and to protect data we process against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons.
These security measures include, in particular, encrypted data transmissions between your browser and our server.

References: Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 21
 Art. 6
 Art. 9
 Art. 6
 Art. 20
 Art. 6
 Art. 89
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 28