Source: https://www.toskana.de/en/data-protection-policy/
Timestamp: 2019-04-20 12:28:35+00:00

Document:
The purpose (person, company) of the forwarding of personal data, if this applies.
The company Toscana Landhäuser GmbH does not have to appoint a data protection officer according to the legal requirements of the GDPR.
We collect and utilise our users’ personal data only insofar as this is necessary for provision of an operational site and of our content and services. Collection and utilisation of our users’ personal data is only undertaken periodically with the user’s consent. An exception applies in those cases where prior consent cannot be obtained for legal or circumstantial reasons and the processing of the data is permitted by law.
Insofar as we obtain the consent of the data subject for processing personal data, Art. 6 para. 1 (a) of the EU General Data Protection Regulation (GDPR) serves as legal basis.
In processing personal data necessary for performance of a contract to which the data subject is a party, Art. 6 para. 1 (b) of the GDPR applies as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 (c) of the GDPR applies as the legal basis. In the event that vital interests of the data subject or another natural person require a processing of personal data, Art. 6 para. 1 (d) of the GDPR applies as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 (f) of the GDPR applies as the legal basis for processing.
It is possible that personal data may be transferred to third countries, also outside the EU, within the framework of our processing. If this is the case, this will be done on the basis of our legitimate interests, your consent, in fulfilment of existing (pre)contractual obligations or legal requirements. Where processing takes place in third countries, this is done in accordance with Art 44 GDPR, i.e. on the basis of special guarantees for compliance with the data protection level applicable in the EU, which in the USA is done, for example, through the Privacy Shield, or by observing special contractual obligations.
The personal data of a relevant person will be deleted or blocked as soon as the purpose of storage ceases to exist. Furthermore, data may be stored if this has been provided by the European or national legislation in EU regulations, laws or other provisions to which the data controller is subject. Blocking or erasing of data will also be carried out if a storage deadline prescribed by the above-mentioned standards expires, unless data storage is a necessity for concluding or performing a contract.
Temporary storage of IP address by the system is necessary to enable delivery of the website to the user’s computer. To this end, the user’s IP address must remain stored for the duration of the session.
The data is stored in log files to ensure the website’s functionality. The data is also used to optimise the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes is undertaken in this context. These purposes also encompass our legitimate interest in data processing in accordance with Art. 6 para. 1 (f) of the GDPR.
Any data is to be stored in log files will be stored within seven days at the latest. Further storage is possible. In this case, the user’s IP addresses will be deleted or distorted, so that assignment of the accessing client is no longer possible.
We use hosting services which we make use of for the purpose of providing this website and the services associated therewith with a partner (third party and recipient of data). During hosting, personal data are processed, in particular the data from the log files, cookies, but also communication data from the contact forms etc. of affected persons. The purpose of the processing is to provide the online offer. For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 para. 1 (f) GDPR. The data will be deleted as soon as they are no longer required for the provision of the offer. Users have no right of objection. There is an agreement with the partner in accordance with Art. 28 GDPR.
If you do not want cookies to be stored, you will be asked to deactivate the setting in your own Internet browser. Please note that in this case not all functions of the website can be used in full.
The user data collected in this way is pseudonymised via technical precautions. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with users’ other personal data.
The legal basis for processing personal data using cookies is Art. 6 para. 1 (f) of the GDPR.
The legal basis for processing personal data using technically necessary cookies is Art. 6 para. 1 (f) of the GDPR.
The legal basis for processing personal data by using cookies for analytical purposes, if the user’s consent to this has been obtained, is Art. 6 Para. 1 (a) GDPR.
For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 Para. 1 (f) of the GDPR.
There is a contact form on our website in various places that can be used for electronic contact. If a user accepts this option, the data entered in the input screen will be transmitted to us and stored. This data is: Surname, first name, email address and usually IP address of the user and date and time of registration.
Alternatively, you can contact us via the provided e-mail address. In this case, the user’s personal data that is transmitted along with the email will be stored.
The data can be processed in a customer relationship management system or a comparable digital system.
The legal basis for processing the data, if the user’s consent to this has been obtained, is Art. 6 para. 1 (a) of the GDPR.
The legal basis for processing the data transferred in the course of sending an email is Art. 6 para. 1 (f) of the GDPR. If you send us an e-mail with the intention to enter into a contract with us, this creates an additional legal basis for its processing per Art. 6 para. 1 (b) GDPR.
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the contact form input mask and those sent by email, this is the case when the respective conversation has ended or when a pre-contractual measure or a contract has been linked to the establishment of contact, when this has expired and there are no more legal retention periods. The conversation will have ended when it is evident from the circumstances that the matter at hand has been conclusively resolved. We routinely review the necessity of further processing of data every two years and observe the legal retention periods.
It is pointed out that personal data is also collected and processed on the websites of these providers, but we do not have access to the revocation or the cancellation option there. The data will only be forwarded for the purpose of the request made by the data subject. The legal basis for processing the personal data of users is Art. 6 para. 1 (f) of the GDPR.
The legal basis for processing is your consent under Art. 6 para. 1 (f) of the GDPR.
The processing of personal data serves us to improve our online presence and to evaluate user behaviour on our website. Google uses the transmitted personal data to create evaluations of the usage behaviour on our website. In addition, other Google services are offered to us. Google does not combine the transmitted IP address or parts thereof with further personal data.
Further information on the use of data for advertising purposes by Google, possible settings and objections can be found on the websites of Google: https://www.google.com/intl/de/policies/privacy/partners/ (“Use of data by Google when using our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Use of data for advertising purposes”), http://www.google.de/settings/ads (“Manage information Google uses to show you advertisements”) and http://www.google.com/ads/preferences/ (“Determine what ad Google shows you”).
In addition, additional cookies are set when a video is played. In addition, personal data can be transmitted to YouTube and linked to an existing Google profile if you have an account there and are logged in. If you wish to prevent this transfer, please log out of your account before using the service.
We use various social plug-ins on our website, in which personal data is collected on the one hand and forwarded to these providers on the other.
We use the following social plug-ins based on our legitimate interests (i.e. interest in analysing, optimising and operating our website economically in accordance with the Terms and Conditions of this Agreement). Art. 6 para. (f) GDPR.
Plug-ins are integrated on this website for the social network Facebook, Provider Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can find an overview of Facebook plug-ins here: https://developers.facebook.com/docs/plugins/.
Facebook guarantees compliance with European data protection standards and is certified under the EU-US Privacy Shield Agreement (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active). If you call such a plug-in, a direct connection is established with Facebook’s servers, which can be located in Europe or the USA. The content of the plug-in is transmitted by Facebook directly to the user’s device to be integrated into the online offer. Pseudonymous usage profiles of users may be created from the processed data. We therefore have no influence on the scope of the data which Facebook collects using this plug-in and inform you according of our knowledge. Other Facebook data may be combined with this data, especially if you have a profile on the Facebook page and are logged in. However, even without a user account, your IP address and the time of access are usually stored there.
If you do not want Facebook to collect data about you via our online offer and link this to your membership data stored on Facebook, you must log out of Facebook before using our online offer and delete your cookies. More settings and ways to revoke permission to use your data for advertising purposes are available in your Facebook profile settings: https://www.facebook.com/settings?tab=ads or the US web page http://www.aboutads.info/choices/ or the EU web page http://www.youronlinechoices.com/.
The settings apply across platforms, i.e. they are applied to all devices, such as desktop computers or mobile devices.
We operate our own company page on Facebook, which we have also linked to and which you can subscribe to. There, further personal data will be collected from you.
Facebook Messenger may also be part of this service and personal data may also be collected about it.
The Facebook Pixel plug-in is included on our pages. Facebook Inc, 1 Hacker Way, Menlo Park, CA, 94025 USA, is integrated. You can find an overview of Facebook plug-ins here: https://developers.facebook.com/docs/plugins/.
You can access functions and content of the Twitter service via our website. Twitter is an offering of Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. It may contain content such as images, videos, texts or buttons with which you can interact on the service or subscribe to our contributions. If you are a member of Twitter, Twitter can assign the calling of contents and functions to your profile. Twitter ensures compliance with European data protection standards and is certified with the EU-US Privacy Shield Agreement.
If you want to prevent the connection of data with your profile, you should log out of Twitter and delete your cookies before using it.
Through interaction with this service, personal data may be collected and transmitted, in particular the IP address. And the time of the call. This may include content such as images, videos, texts and buttons with which users interact or subscribe to our contributions. If you are a member of the Google Plus platform, Google Plus can assign the above content and functions to your profile.
If you want to prevent the connection of data with your profile, you should log out of Google Plus and delete your cookies before using it.
(8) the existence of automated decision-making, including profiling, in accordance with Article 22 Para. 1 and 4, GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the person concerned.
You have a right of rectification and/or completion with respect to the data controller if the personal data processed concerning you is incorrect or incomplete. The responsible party shall make the correction immediately.
(4) you have objected to processing pursuant to Art. 21 Para. 1 GDPR pending the verification whether the legitimate grounds of the controller overrides your reasons.
(2) You withdraw your consent on which the processing is based according to Art. 6 Para. 1 (a) or Art. 9 para. 2 (a) GDPR, and where there is no other legal ground for its processing.
(5) The personal data concerning you must be deleted for compliance with a legal obligation under Union or Member State law to which the data controller is subject.
(6) The personal data concerning you has been collected in relation to services offered by information society services pursuant to Art. 8 para. 1 of the GDPR.
If the data controller has made personal data that concerns you public and is subject to the obligation to delete them pursuant to Art. 17 para. 1 of the GDPR, that responsible party shall take appropriate measures, including technical means, while taking into account available technology and implementation costs, to inform the parties responsible for data processing who process the personal data, that you as the person concerned have requested deletion of all links to such personal data or of copies or replications of such personal data.
The right to data portability shall not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the responsible party (data controller).
However, these decisions may not be based on special categories of personal data pursuant to Art. 9, para. 1 of the GDPR, unless Art. 9 para. 2 (a) or (g) of the GDPR and appropriate measures have been taken to protect your rights and freedom as well as your legitimate interests.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art 44
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 21
 Art. 6
 Art. 9
 Art. 8
 Art. 17
 Art. 9
 Art. 9