Source: https://blog.because-security.com/t/privacy-policy-gdpr/336/2
Timestamp: 2020-04-08 18:32:23
Document Index: 273374761

Matched Legal Cases: ['§ 5', '§ 55', 'Art. 6', 'Art. 6', 'Art. 6', '§ 10', '§ 5', '§ 55']

Privacy Policy - GDPR - Editorial - because-security
marius January 28, 2018, 11:00pm #1
Privacy Policy - protections
Individual Rights - consent
Legal information, Site Notice
Data Protection provisions and Third Parties
Appendix: Cookie Opt-In
Appendix: German § 5 TMG, § 55 RfStV
Appendix: German Haftungsausschluss für Links
Appendix: German Urheberrecht
Last policy change, date
I am delighted that you have shown interest in this private website. Data protection is of a particularly high priority at Because Security.
The use of the Internet page, from now on referred to as Because Security, is possible without any indication of personal data; however, if a data subject wants to use special services via the website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, I generally obtain consent from the data subject.
The processing of personal data, such as the IP address, e-mail address, or a (pseudonymous) name of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to my website Because Security. By means of this data protection declaration, I would like to inform the general public of the nature, scope, and purpose of the personal data that is collected, used and processed. Furthermore, data subjects are informed, by means of this data protection declaration, of the rights to which they are entitled.
As the controller, Because Security has implemented numerous technical and organisational measures to ensure a proportional protection of personal data processed through this private website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. Given that this is a private website, alternative means of data-transmission may not be provided at this point in time, because that is not considered proportional.
The data protection declaration of the Because Security website is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). The data protection declaration should be legible and understandable for the general public. To ensure this, I would like to first explain the terminology used.
Email: marius -at - because-security.com
Website: https://www.because-security.com
The website of Because Security collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are temporarily stored in the log files. Collected may be (1) the browser types and versions used, (2) the operating system as it is indicated by the accessing system, (3) the website from which an accessing system reaches my website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on my information technology systems.
When using these general data and information, Because Security does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of the website correctly, (2) optimize the content of my website (which is free of advertisements and third-party tracking methods) , (3) ensure the long-term viability of information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. Therefore, the Because Security analyzes anonymously collected data and information statistically, with the aim of increasing the data protection and data security, and to ensure an optimal level of protection for the personal data I process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.
If a data subject wishes to avail himself of this right of access, he or she may, at any time, contact me (the controller).
If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by the Because Security, he or she may, at any time, contact any employee of the controller. An employee of Because Security shall promptly ensure that the erasure request is complied with immediately.
Where the controller has made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. An employees of the Because Security will arrange the necessary measures in individual cases.
If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by the Because Security, he or she may at any time contact any employee of the controller. The employee of the Because Security will arrange the restriction of the processing.
In order to assert the right to data portability, the data subject may at any time contact any employee of the Because Security.
The Because Security shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
If the Because Security processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to the Because Security to the processing for direct marketing purposes, the Because Security will no longer process the personal data for these purposes.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by the Because Security for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
In order to exercise the right to object, the data subject may contact any employee of the Because Security. In addition, the data subject is free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use his or her right to object by automated means using technical specifications.
If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) it is based on the data subject's explicit consent, the Because Security shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and contest the decision.
If the data subject wishes to exercise the rights concerning automated individual decision-making, he or she may, at any time, contact any employee of the Because Security.
If the data subject wishes to exercise the right to withdraw the consent, he or she may, at any time, contact any employee of the Because Security.
6 Data protection provisions
6.1 Data protection provisions about the application and use of Facebook
On this website, the controller has integrated select components of the enterprise Facebook. Facebook is a social network.
This website allows a data-subject to re-use the existing account (subject to the Terms of Services and policies of Facebook) for the means of an informed, active and consensual way of identification and authentication. This happens after the data-subject explicitly allows this with Facebook.
With the specific authentication call-up to the login page of this Internet website, which is operated by the controller and into which a Facebook component (Facebook OAuth) was integrated, the web browser on the information technology system of the data subject is automatically prompted to download display of the corresponding Facebook component from Facebook through the Facebook component. An overview of all the Facebook Plug-ins may be accessed under https://developers.facebook.com/docs/plugins/. During the course of this technical procedure, Facebook is made aware of what specific sub-site of our website was visited by the data subject.
Facebook always receives, through the Facebook component, information about a visit to the website by the data subject, whenever the respective data subject is logged in at the same time on Facebook. This occurs regardless of whether the authenticated data subject clicks on the Facebook component or not. If such a transmission of information to Facebook is not desirable for the data subject, then he or she may prevent this by logging off from their Facebook account before a call-up to our website is made.
The Facebook authentication is optional, and only provided in case a data-subject wishes to use it. It is not actively encouraged.
6.2 Data protection provisions about the application and use of Google
On this website, the controller has integrated Google OAuth as a component, which is part of the Google+ services. Google+ is a so-called social network. A social network is a social meeting place on the Internet, an online community, which usually allows users to communicate with each other and interact in a virtual space. A social network may serve as a platform for the exchange of opinions and experiences, or enable the Internet community to provide personal or business-related information. Google+ allows users of the social network to include the creation of private profiles, upload photos and network through friend requests.
With the specific authentication call-up to one of the individual pages of this website, which is operated by the controller and on which a Google+ has been integrated, the Internet browser on the information technology system of the data subject automatically downloads a display of the corresponding Google login fields of Google OAuth through the respective component. During the course of this technical procedure, Google is made aware of what specific sub-page of the website was visited by the data subject. More detailed information about Google+ is available under https://developers.google.com/+/.
If the data subject is logged in at the same time to Google, Google recognizes with each call-up to my website by the data subject and for the entire duration of his or her stay on our Internet site, which specific sub-pages of our Internet page were visited by the data subject. This information is collected through the Google authentication and Google matches this with the respective Google account associated with the data subject.
If the data subject does not wish to transmit personal data to Google, he or she may prevent such transmission by logging out of his Google account before calling up the website.
6.3 Data protection provisions about the application and use of GitHub
On this website, the controller has integrated GitHub OAuth as a component, which is part of the GitHub services. GitHub is a development focused community with a set of various engineering tools. GitHub allows users of the service to include the creation of private profiles, upload photos and network through messages and contributions to Open Source projects.
The operating company of GitHub is GitHub Inc., 188 Colin P Kelly Jr St, San Francisco, CA 94107, UNITED STATES.
With the specific authentication call-up to one of the individual pages of this website, which is operated by the controller and on which a GitHub has been integrated, the Internet browser on the information technology system of the data subject automatically downloads a display of the corresponding GitHub login fields of GitHub OAuth through the respective component. During the course of this technical procedure, GitHub is made aware of what specific sub-page of the website was visited by the data subject. More detailed information about GitHub is available under https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/.
If the registered data subject is logged in at the same time at GitHub, GitHub recognizes with each call-up to my website by the data subject and for the entire duration of his or her stay on our Internet site, which specific sub-pages of our Internet page were visited by the data subject. This information is collected through the GitHub authentication and GitHub matches this with the respective GitHub account associated with the data subject.
If the data subject does not wish to transmit personal data to GitHub, he or she may prevent such transmission by logging out of his GitHub account before calling up the website.
Further information and the data protection provisions of GitHub may be retrieved under https://help.github.com/articles/github-privacy-statement/ .
6.4 Data protection provisions about the application and use of Cloudflare CDN
To serve this website, the controller has integrated Cloudflare as a component, which is part of the Content Delivery Network (CDN) services. Cloudflare is a globally distributed server network, that aims to accelerate network requests by serving them to the individual data-subjects from a location with the optimal latency.
The operating company of Cloudflare is Cloudflare Inc., 101 Townsend Street, San Francisco, CA 94107, UNITED STATES
Cloudflare is an infrastructure-level service, that provides security functions to this website. Information about the privacy policies of Cloudflare can be found here: https://www.cloudflare.com/gdpr/introduction/
If the data subject does not wish to transmit personal data to Cloudflare, he or she may not be eligible to use this website. Cloudflare is an essential internet-level component, that affects 200 million web-surfers on a daily basis.
6.5 Data protection provisions about the application and use of LinkedIn
The controller has integrated shared login and authentication components of the LinkedIn Corporation on this website. LinkedIn is a web-based social network that enables users with existing business contacts to connect and to make new business contacts. Over 400 million registered people in more than 200 countries use LinkedIn. Thus, LinkedIn is currently the largest platform for business contacts and one of the most visited websites in the world.
With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a LinkedIn component (LinkedIn OAuth plug-in) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to the download of a display of the corresponding LinkedIn component of LinkedIn. Further information about the LinkedIn plug-in may be accessed under https://developer.linkedin.com/plugins. During the course of this technical procedure, LinkedIn gains knowledge of what specific sub-page of our website was visited by the respective data subject.
If the data subject is logged in at the same time on LinkedIn, LinkedIn detects with every call-up to our website by the data subject—and for the entire duration of their stay on our Internet site—which specific sub-page of this Internet page was visited by the data subject. This information is collected through the LinkedIn OAuth component and associated with the respective LinkedIn account of the data subject. If the data subject clicks on one of the LinkedIn buttons integrated on the website, then LinkedIn assigns this information to the personal LinkedIn user account of the data subject and stores the personal data.
LinkedIn receives information via the LinkedIn login component that the data subject has visited our website, provided that the data subject is logged in at LinkedIn at the time of the call-up to my website. If such a transmission of information to LinkedIn is not desirable for the respective data subject, then he or she may prevent this by logging off from their LinkedIn account before a call-up to my website is made.
6.6 Data protection provisions about the application and use of Twitter
With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a Twitter component (Twitter OAuth) was integrated. Further information about the Twitter OAuth is available under https://developer.twitter.com/en/docs/basics/authentication/overview/oauth . During the course of this technical procedure, Twitter gains knowledge of what specific sub-page of my website was visited by the data subject. The purpose of the integration of the Twitter component is a to allow registered Twitter users to use their existing accounts without having to store their passwords with my website. This way I can limit the personal data I process.
If the data subject is logged in at the same time on Twitter, Twitter detects with every call-up to my website by the data subject and for the entire duration of their stay on our Internet site which specific sub-page of our Internet page was visited by the data subject. This information is collected through the Twitter OAuth component and associated with the respective Twitter account of the data subject.
Twitter receives information via the Twitter OAuth component that the respective data subject has visited our website, provided that the data subject is logged in on Twitter at the time of the call-up to my website. If such a transmission of information to Twitter is not desirable for the data subject, then he or she may prevent this by logging off from their Twitter account before a call-up to my website is made.
Art. 6(1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. Is Because Security subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured on my premises and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6(1) lit. d GDPR. Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by Because Security or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47 Sentence 2 GDPR).
Where the processing of personal data is based on Article 6(1) lit. f GDPR my legitimate interest is provide my website in favour of the well-being of anyone, who wants to engage with it.
Sometimes it may be necessary to conclude a contract that the data subject provides me with personal data, which must subsequently be processed. The data subject is, for example, obliged to provide us with personal data when we a contract. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded.
Before personal data is provided by the data subject, the data subject must contact me. I start a process that clarifies to the data subject whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of non-provision of the personal data.
I do not use automatic decision-making or profiling on this website.
This Privacy Policy has been generated with the Privacy Policy Generator of the External Data Protection Officers that was developed in cooperation with the Media Law Lawyers from WBS-LAW. If it helps you, please feel free copy it.
Why is there no Cookie warning?
Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow). These cookies enable the site to recognize your browser and, if you have a registered account, associate it with your registered account. Registering an account is optional at this website, and not required for data-subjects.
Because Security uses cookies so that we can offer the site experiences and tools.
email Y Session Used during account creation
destination_url Y Session Used during login to redirect to the requested page
sso_destination_url Y Session Used during SSO login to redirect to the requested page
fsl Y Session Full screen login client setting
theme_key Y Forever Client theme personalization. Only used when “Make this my default theme on all my devices” unselected.
cn Y Forever Client clear notifications. I’m counting this as user input instead of personalization because it doesn’t make sense to ‘undo’ or change cleared notifications.
_bypass_cache Y Session Used with ‘fsl’ for full screen login
_t Y 24 hours User authentication token cookie. SiteSetting.maximum_session_age.hours.from_now
_forum_session Y Session Session cookie
dosp Y next page view Temoporary cookie that informs client denial of service protection is in place.
The following paragraphs reflect nation-specific laws from Germany. They are only relevant for German citizens.
Inhaltlich Verantwortlicher gemäß § 10 Absatz 3 MDStV, § 5 TMG, § 55 RfStV:
Marius Ciepluch
marius -at - because-security.com
Dieses Angebot enthält Links zu externen Webseiten Dritter, auf deren Inhalte Because Security keinen Einfluss hat. Deshalb wird diese fremden Inhalte auch keine Gewähr übernommen. Für die Inhalte der verlinkten Seiten ist stets der jeweilige Anbieter oder Betreiber der Seiten verantwortlich. Die verlinkten Seiten wurden zum Zeitpunkt der Verlinkung auf mögliche Rechtsverstöße überprüft. Rechtswidrige Inhalte waren zum Zeitpunkt der Verlinkung nicht erkennbar. Eine permanente inhaltliche Kontrolle der verlinkten Seiten ist jedoch ohne konkrete Anhaltspunkte einer Rechtsverletzung nicht zumutbar. Bei Bekanntwerden von Rechtsverletzungen werden derartige Links umgehend entfernt. Hinweise hierzu können per email übermittelt werden.
Die Inhalte dieser Webseite unterliegen auch dem deutschen Urheberrecht. Links auf Angebote Dritter sind von der Lizenzgebung explizit ausgeschlossen.
24.05.2018 - release of the policy document, added Germany specific information to the appendix
Don't panic because you have a blog - GDPR is simple enough
marius unlisted January 25, 2020, 7:24am #2