Source: https://www.jako.de/en/info/data-protection/
Timestamp: 2019-08-19 16:45:06
Document Index: 325250280

Matched Legal Cases: ['§ 147', '§257', '§ 147', '§ 257', '§ 147', '§257']

Data Protection & Privacy | jako.de
Whenever a user visits one of our pages and when requesting a file on our website, access information related to this action in are saved to a log file. Each dataset contains:
(1) the page requesting the file,
(4) the data volume transferred,
(8) host name of the of the accessing computer,
We use this data to operate our website, particularly to determine utilisation of the website and website errors, and to make changes or improvements. The client IP address is used to transmit the requested data; once the technical necessity no longer exists it is anonymised by erasing the last number block (Ipv4) or the last byte (Ipv6).
b) Storage period
The data is saved every time a user accesses a page on our website and with every visit to our website and is erased once it is no longer required for den purpose for which it was collected, at the latest three months after visiting the website.
The legal basis for temporary storage of the aforementioned data is Article 6(1)(f) EU General Data Protection Regulation (hereinafter 'GDPR'). The legitimate interest lies in offering our website and identifying misuse.
d) Objection and removal option
The data subject can object to processing by choosing not to use our website the processing and, subject to the requirements specified under section 'rights', request erasure of the data concerning him collected in the course data by information request.
For technical facilitation of the visit to our website and the ordering process we transfer so-called cookies to the device of the data subject. Cookies are small text files which enable identifying the device of the data subject by typically collecting the name of the domain sending the cookie data, information about the age of the cookie and an alphanumeric identifier. By saving the cookie to the device being used – without accessing the operating system – enables it to be recognised and allows us to immediately make any presets available. We use this information to tailor our website and services offered to your needs and make our website faster.
The storage period of the various cookies varies but does not exceed two years. They are stored on your local device, not on our server, hence the actual time until deleted depends on your browser configuration. Please refer to the operating instructions of your browser software to learn how to delete our cookies as warranted or automatically.
The legal basis for storing the aforementioned data is Article 6(1)(f) GDPR. The legitimate interest for adding cookies is to one hand optimise the quality of our website through analysis, and on the other hand to enable delivery of our website; in particular, some functions of our website cannot be used without cookies, as the user and his settings otherwise would not be recognised when switching pages, language settings would be lost, and searches cannot be executed. The further legal basis for storage is Article 6(1)(b) GDPR for implementation of contract.
The data subject can block the use of cookies on the device being used or delete these after use thereof. However, some functions of our website will then no longer be available. Please refer to the instructions for your browser software to learn how to block and delete cookies.
Name, address(es), bank details, e-mail address, telephone or fax number, client IP address at the time a purchase order was submitted are collected, stored and processed solely for the purpose of establishing or implementing a contract, which particularly includes billing and performance of contract. The personal data is only disclosed to third parties when required for contract implementation, for example when engaging a shipper or using a payment service provider.
The data is erased once it is no longer required for the purposes for which it was collected or otherwise processed. This period is five years for personal data subject to § 147 German Tax Code and ten years for personal data subject to §257 German Commercial Code. These periods are calculated from the end of the calendar year the data was collected.
The legal basis for storing the aforementioned data is Article 6(1)(b) and (c) GDPR, to comply with obligations under the contract and to render the services required for contract implementation.
Since there are retention periods standardised by law and the data must be stored and processed for contract implementation, objection or erasure is excluded.
4. Contact form, e-mail, fax or phone contact
Our website features a contact form. The data subject may use this to contact us electronically and we can process the request. The following data will be collected and stored when doing so: Name, address, e-mail address, telephone number, date and time of the request and a description of the issue, and, if applicable, contract data for inquiries for the purpose of concluding or implementing a contract. Users may contact us by e-mail, fax or phone. We store the data transmitted to us in the process and provided by the user to process the request. This data is the name, address, e-mail address, phone and/or fax number, date and time of the request and a description of the issue, and, if applicable, contract data for inquiries for the purpose of concluding or implementing a contract. The data is not disclosed to third parties. They serve the purpose of processing the contact request of the data subject.
Once the data is no longer required to achieve the purpose they are erased, which is the case when the conversation has been finalised and the matter has been resolved and there are no conflicting retention periods by virtue of contract or tax law. This period is five years for personal data subject to § 147 German Tax Code and ten years for personal data subject to § 257 German Commercial Code. These periods are calculated from the end of the calendar year the data was collected.
The legal basis for storing the aforementioned data is Article 6(1)(b) GDPR within the context of initiating or implementing a contract, or Article 6(1)(f) GDPR. The legitimate interest of the controller is to enable processing the contact request and prevent misuse of the contact request.
The data subject may at any time object to storage. In this case the data related to the action will be erased. If a contract was concluded, the above explanations regarding 'conclusion of contract' apply.
The data subject may register on our website by providing personal data which is transmitted to us and stored. We store the data entered in the input screen or otherwise collected. This is the name, address(es), data of birth, e-mail address, IP address, date and time of registration. Registration is required to provide certain contents and services and also serves to establish and implement our contract with the data subject.
Once the data is no longer required to achieve the purpose it is erased. When registering without concluding a contract this is the case when the registration is deleted or the data is edited. In the case of a registration resulting in further conclusion of contract the data is erased once erasure of the contract data is permitted according to legal and tax provisions. This period is five years for personal data subject to § 147 German Tax Code and ten years for personal data subject to §257 German Commercial Code. These periods are calculated from the end of the calendar year the data was collected.
The legal basis for storing the aforementioned data is Article 6(1)(b) GDPR within the context of initiating or implementing a contract, or Article 6(1)(f) GDPR. The legitimate interest of the controller is to enable providing our users with certain contents and services.
The data subject may at any time delete his registration or edit the data. The account can be deleted or edited by notice to the contact person specified under Item I. The option to object and remove the registration and data does not apply if the registration was used to establish or implement a contractual relationship; in this case only the account can be deleted. The account can be deleted by following the aforementioned steps.
6. Direct advertising
We use the data obtained from the data subject in connection with the sale of goods or services to directly advertise for our products. In the case of the e-mail address this only applies to our similar products or services and provided the data subject has not objected to use thereof, as indicated during data collection (including hereby); the continued option to object is further indicated with any use.
Once the data is no longer required to achieve the purpose it is erased, which is the case when the data subject has objected to direct advertising or as required based on the passage of time from the last advertising effort specifying the right to object, which is twelve months from the last advertising effort.
The legal basis for advertising following a product purchase or using services is Article 6(1)(f) GDPR. The legitimate interest is direct advertising for sales promotion.
The data subject may at any time object to future use without incurring costs apart from the standard cost of transmission.
We offer the option to subscribe to a newsletter. If the data subject subscribes to a newsletter, the data provided by the data subject in the input screen during registration is transmitted to us. These are the e-mail address specified, the IP address, time and date subscribed. The collected data is required to send the newsletter.
The data is erased once the data is no longer required to achieve the purpose and the data subject has unsubscribed the newsletter. It is then stored for ten years from the time the last newsletter was sent for verification purposes in the event of an inquiry about consents in compliance with the statute of limitations.
The aforementioned data is only stored on the legal basis of Article 6(1)(a) GDPR with prior consent through subscription. The user may withdraw his consent at any time, which does not affect the lawfulness of processing personal data prior to withdrawing consent.
The user may object to data being used for the purpose of receiving the newsletter at any time for future publications by unsubscribing from the newsletter at no cost apart from the basic rate of transmission. This can be done by notice to us. Every newsletter includes a designated link the data subject can click to unsubscribe the newsletter.
We use the YouTube embedding function to show and play 'YouTube' videos, a service provided by LLC, 901 Cherry Ave, San Bruno, CA 94066, USA, represented by Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ('Google'). When opening a page containing a YouTube video, a connection will be established to YouTube servers which is then matched with the personal profile of the user and communicates the pages of the website which were visited if the user is logged into his YouTube account. You can prevent this by first logging out of your YouTube account.
For information about data protection and personal data stored by 'YouTube', please read the privacy policy of the provider at https://www.google.de/intl/en/policies/privacy.
The use of YouTube serves safeguarding our overriding interest in displaying our online services optimally according to Article 6(1)(f) GDPR.
You can object to the collection of data by blocking cookies in your browser settings. However, you should be aware that doing do may affect the functionality of our website. You will further find an opt-out function at https://adssettings.google.com/authenticated
We use Google AdWords to draw attention to our products on external websites. We use Ad Server cookies for this purpose, which can be used to measure specific performance parameters, such as showing advertisements or user clicks. If you arrived on our website via a Google ad, Google AdWords stores a cookie on your PC. These cookies typically expire after 30 days and do not serve the purpose of identifying you. This cookie typically stores the unique cookie ID, number of Ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (indicating the user does not wish to see this again) as analysis values. The cookies enable Google to recognize your web browser. If a user visits specific pages on the website of an AdWords customer and the cookie on his computer has not yet expired, Google and the customer can determine the user clicked the advertisement and was redirected to this site. Every AdWords customer is assigned a different cookie. Cookies therefore cannot be tracked from the websites of AdWords customers. We do not collect or process personal data via these marketing measures. We only receive statistical analyses from Google. Based on these analyses, we are able to see which of the advertising means used are particularly effective. Using advertising means does not provide us with additional data; the data particularly does not enable us to identify users. Due to the marketing tools used your browser automatically establishes a direct connection with the Google server. We have no control on the scope and further use of the data collected by Google through the use of this tool and therefore provide information to the best of our knowledge: By integrating AdWords conversion, Google receives information that you visited the respective part of our website or clicked on one of our ads. If you are registered with a Google service, Google is able to associate your visit to your account. Even if you are not registered with Google, or not logged in, there is a possibility the provider will obtain and save your IP address.
The cookies are valid for 30 days, at which time they are deleted unless previously deleted by you, for example based on your browser settings or manually.
The legal basis for storing the aforementioned data is Article 6(1)(f) GDPR and Article 15(3) German Teleservices Act.
ou can block cookies; please refer to the instructions of your browser software for the required steps. You can further block their use by disabling interest-based ads from the providers who are members of the WebChoices tool 'About Ads' by clicking the link http://www.aboutads.info/choices, which however will be deleted when deleting cookies.
The client IP address is obtained to use the service Google Analytics. This website uses Google Analytics, a web analysis service provided by Google LLC ('Google'). Google Analytics uses so-called 'cookies', text files which are saved to the device of the data subject and enable analysis of the use of this website. The information about the use of this website generated by the cookie are typically transmitted to a Google server in the USA and stored there. Since this website uses IP anonymisation, Google first truncates the IP address of the data subject within member states of the European Union and other states party to the Agreement on the European Economic Area. The complete IP address is only transmitted to a Google server in the USA and truncated there in exceptions. Google uses this information on behalf of the operator of this website to analyse the use of this website, generate reports on website activity and to provide the website operator with additional services related to website and internet use. The IP address transmitted by your browser in line with Google Analytics is not merged with other data Google data.
Once the data is no longer necessary to achieve the purpose it is erased, which is when anonymisation used within the European Union has been completed. This takes less than a second. The data transmitted by us and linked to cookies, user identifiers (e.g. user ID) or advertising IDs are automatically erased after 14 months. Data is automatically erased once a month at the end of the retention period. For more information please visit https://www.google.com/analytics/terms/de.html and https://policies.google.com/?hl=de.
The legal basis for storing the aforementioned data is Article 6(1)(f) GDPR. The legitimate interest is enabling us to analyse the use the website by all users as a whole without providing information about behaviour of identifiable persons; this allows us to optimise our website and our offers.
The data subject can configure the settings of the browser software to prevent cookies from being stored; however, in this case the data subject should be aware in this case they may not be able to make full use of all functions of this website. The data subject can further prevent data generated by the cookie and related to the use the website (including IP address) from being transmitted to Google and this data being processed by Google by downloading and installing the browser plugin available under the following link [http://tools.google.com/dlpage/gaoptout?hl=de].
11. Trusted Shops seal of approval with reviews
The Trusted Shops Trustbadge is embedded in this website to display our Trusted Shops seal of approval and any reviews about the services of the Trusted Shops product for past buyers. When requesting the Trustbadge the Trusted Shops web server automatically stores a so-called server log file containing e.g. your IP address, date and time of the request, data volume transferred and the requesting provider (Access data) and documents the access. This data is stored on our behalf in line with a processing agreement with the service provider.
This access data is not analysed and is automatically overwritten at the latest seven days after closing your session.
This serves safeguarding our overriding legitimate interest in optimal marketing of our products according to Article 6(1)(f) GDPR.
The data subject can object to processing; for details please refer to the information under section 'Rights'.
To protect the against denial-of-service attacks we use the services of cloudflare Inc, located in the USA. We have a data processing agreement with this Privacy Shield certified service provider, ensuring the data processed on our behalf is in safe hands. The data transmitted is the IP address, browser type, operating system used and the requested file.
The data is erased immediately after accessing the page; the data is only logged by us as described in section 'Visiting our website'.
The aforementioned data is stored based on Article 6(1)(f) GDPR ('legitimate interest'). The legitimate interest is safeguarding the availability of our website and secure operation.
The data subject can prevent data processing by not using our website.
13. Single sign-on and payment services
For easy ordering and payment processing we use the following tools of third-party providers:
AmazonPay, a service provided by Amazon Payments Europe S.C.A. 5, Rue Plaetis - 2338 Luxembourg;
PayPal Express, a service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg and
ipayment, a service provided by 1&1 Internet SE, Elgendorfer Str. 57, 56410 Montabaur.
When accessing the basket, these providers use scripts embedded in our website to verify if the user has an account with the respective provider and is signed in. This is achieved by matching cookies the provider has saved to the browser of the user. The IP address, browser used, operating system and the respective page visited are transmitted to the third-party provider for this purpose. We only collect data if a customer of the provider uses the service provided by the third party, thus prompting the personal information concerning him stored – name and billing and shipping address – are transmitted to us and checking out through the service provider the customer has a contractual relationship with, subject to the terms of the service provider. If the customer chooses a payment process which does not require a contract with one of the service providers, the data required to process the payment – name, address, bank details, credit card data, amount due – are collected directly by the service provider selected by the customer and the payment forwarded to us on behalf of the customer.
We only process the data transmitted to us by the third-party service on behalf of the customer for the purpose of contract implementation. In this respect this information about the storage period under 'Contract implementation' apply. If the third-provider processes data on behalf of the data subject, the storage period specified in the privacy policy of the service provider apply.
The legal basis for processing is Article 6(1)(b) GDPR when data is used to implement contracts through our website. With respect to payment services, storage is also based on Article 6(1)(c) GDPR, as the data collected in this manner is of tax relevance and therefore required to comply with our tax obligations. Processing is further based on Article 6(1)(e) GDPR, as is serves our legitimate interest to enable the customer of the respective service provider to use the services of our partners and enable quick and easy implementation of contract.
Since standardised retention periods apply and data must remain stored and processed for contract implementation, objection or erasure is excluded.
14. Facebook, Google+, WhatsApp, Twitter, Pinterest buttons
We collect no personal data through buttons for social media networks. However, we will explain the technical background for the sake of completeness. We only use disabled buttons for the social media networks Facebook, Google+, WhatsApp, Twitter and Pinterest. This means no data is transmitted to these networks. The data subject himself decides to activate the button by clicking on it, thus establishing a connection to the servers of the operators of the social media networks and transmit data to the servers of the social media network according to the agreement between the data subject and the social media network. Activating these results in requesting contents of the social media networks. Please refer to the privacy policies of the respective social media networks for the type, purpose and scope of data collected and used. The user can share the item on the social media network by clicking the button a second time. If the data subject wishes to share several pages, consent is required on every page. The data subject can permanently activate the buttons to permanently allow the social media network access to his data. The respective setting can be ticked under the gear icon and the selected button will always be immediately active.
The storage period is based on the specifications of the operator of the media networks.
The operators of the social media networks provide the data subject with information about the legal basis.
The data subject can later withdraw his consent again and disable the buttons through the gear icon the data subject used to activate the buttons.
15. Shipping process
We use the ‘Address Factory’ address verification service provided by Deutsche Post AG for shipping purposes and offer returns via DHL. We further share the address data with the DHL shipping service for delivery purposes. In this case DHL Express Germany GmbH, Heinrich-Brüning-Straße 5, 53113 Bonn is the additional controller. The data processed in this context are name, billing and shipping address.
The legal basis for storing the aforementioned data is Article 6(1)(b) and (c) GDPR to comply with the contractual obligations and comply with retention and documentation obligations under tax and commercial law.
Where personal data relating to the user are processed on our website, according to the GDPR the respective person (data subject) has the following rights against the controller.
1. Right of access according to Article 15 GDPR
i) where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.
We provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.
2. Right to rectification according to Article 16 GDPR
3. Right to erasure according to Article 17 GDPR
b) the data subject withdraws consent on which the processing is based according to Article 6(1)(a) GDPR, or Article 9(2)(a) GDPR, and where there is no other legal ground for the processing;
4. Right to restriction of processing according to Article 18 GDPR
c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
5. Notification obligation according to Article 19 GDPR
If the data subject exercised his right to rectification according to Article 16 GDPR, erasure according to Article 17(1) GDPR or restriction of processing according to Article 18 GDPR and the controller has communicated the request of the data subject to each recipient to whom the personal data have been disclosed unless this proved impossible or involved disproportionate effort, the data subject has the right to obtain the recipients from the controller.
6. Right to data portability according to Article 20 GDPR
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us to which the personal data have been provided, where:
a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR; and
This shall not adversely affect the rights and freedoms of others.
In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from us to another controller, where technically feasible.
The exercise of the right to data portability shall be without prejudice to Article 17 GDPR. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to object according to Article 21 GDPR
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6(1)(e) and (f) GDPR, including profiling based on those provisions.
We shall no longer process the personal data unless we demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Consent given by the data subject may be withdrawn at any time. This does not affect the lawfulness of collection and processing prior to withdrawing consent.
8. Automated individual decision-making, including profiling according to Article 22 GDPR
b) is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
These decisions shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless Article 9(2)(a) or (g) GDPR applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.
In the cases referred to in points a) and c), we shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express his or her point of view and to contest the decision.
9. Right to lodge a complaint with a supervisory authority according to Article 77 GDPR
10. Right to an effective judicial remedy according to Article 79 GDPR
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.
Proceedings against us or a processor shall be brought before the courts of the Member State where we or the processor have an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless we or processor are a public authority of a Member State acting in the exercise of its public powers.