Source: https://mailfriends.com/privacy
Timestamp: 2019-05-24 10:53:10
Document Index: 130485155

Matched Legal Cases: ['Art. 4', 'Art. 32', 'Art. 6', 'Art. 7', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 15', 'Art. 16', 'Art. 20', 'Art. 17', 'Art. 18', 'Art. 7', 'Art. 21', 'Art. 21', 'Art. 77']

Mailfriends - E-Mail-Friends and Snail-Mail Friends
This privacy policy explains the nature, scope and purpose of the collection and processing of personal data when using the online service "Mailfriends". Terms like "personal data" are defined in Art. 4 of the General Data Protection Regulation (GDPR).
Due to the further development of the online service or due to changed legal or regulatory requirements, it may be necessary to change this privacy policy. The current version can always be accessed via the links within the online service. All prior communications or agreements are superseded by the current version.
The date of this version is November 18, 2018.
For the provision of the online service, the controller (hereinafter also referred to as the "operator") collects personal data (hereinafter also referred to as "data" or "information") from data subjects (hereinafter also "users").
The operator processes the data of the users directly or with the help of processors (hereinafter referred to as "service providers"), treats it confidentially and takes appropriate technical and organizational measures for the security of the data processing in accordance with Art. 32 GDPR.
The controller within the meaning of the GDPR is: Christoph Ziegenberg, Husarenstr. 45, 38104 Braunschweig, Germany
1.2. Legal basis of processing
The processing of data is always carried out in accordance with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection regulations applicable to the operator.
Provided that the respective legal basis is not explicitly mentioned in this privacy policy, the following legal bases apply:
For obtaining consent: Art. 6 para. 1 lit. a and Art. 7 GDPR
For the completion of a contract, the delivery of goods, the provision of any other service or consideration or the execution of pre-contractual measures: Art. 6 para. 1 lit. b GDPR
For the compliance with legal obligations: Art. 6 para. 1 lit. c GDPR
For the protection of vital interests of the data subject or another natural person: Art. 6 para. 1 lit. d GDPR
For the protection of legitimate interests of the operator or a third party: Art. 6 para. 1 lit. f GDPR
Unless explicitly stated in this privacy policy, stored data is routinely erased as soon as it is no longer required for its intended purpose and no further statutory retention requirements have to be met.
In case the deletion is not possible because the data is required for other and legitimate purposes, processing of the data will be restricted instead.
1.4. Transfer of data to third parties
Personal data will not be disclosed to third parties, unless ...
disclosure is permitted to safeguard legitimate interests and there is no reason to believe that there is an overriding interest to protect by not disclosing the information,
users have given their consent,
the operator is legally obliged to do so, or
it is legally permissible and necessary for the execution of contractual relationships.
The operator makes the online service available with the help of processors, which provide the necessary technologies and/or services.
The processors contracted by the operator must be able to confirm or prove that they process the users' data in accordance with statutory provisions, or special guarantees must exist to ensure a corresponding level of data protection.
The infrastructure - the basic technical means for the operation of the online service - is provided by service providers, based on the legitimate interests of the operator in a secure, efficient and economic provision of the online service.
Provision of servers and measures for their security and maintenance
Provision of storage space and databases
Provision of other technical services, e.g. for sending and receiving e-mails
The use of these services may technically require that content from service providers is integrated into the online service in such a way that it's loaded by the user's browser software (hereinafter referred to as "browser"). In this case the browser sends requests to the servers of service providers and for technical reasons transmits the user's IP address and other request data.
2.2. Request data
When using the online service, the browsers used by the users transmit general data with each request made to the online service, some of which are processed and stored.
The data transmitted include:
Information about the requested URL and the time of the request
The IP address to which the response should be sent
Information about the preferred language of the user
Information about technical features of the browser
Information on the name and version of the browser (often with information about the operating system)
The URL of the web page from which the request was made
The IP address is technically required to answer the request. In addition, the data will be processed based on the following legitimate interests of the operator:
Adaptation of the online service, so that it can be used correctly with different browsers
Improvement of the presentation of content and advertising
Performance of proof obligations
Detection, defense and prosecution of unlawful or abusive use of the online service
Generation of anonymous statistics to improve the online service
2.3. Storage of data in browsers
The operator of the online service uses the storage techniques described in the following subsections for the following purposes:
The secure and efficient provision of features that require storage of data in browsers, e.g. the secure authentication of users
The provision of features that have been explicitly requested by users and that require storage of data in browsers, e.g. remembering a previously made selection
The use for these purposes is mandatory for the provision of the online service and is based on the legitimate interests of the operator. If the aforementioned techniques are used for any other purpose, a separate description of this use will be given in the following sections of this privacy policy.
As far as necessary for a purpose, the data storage in the browser is pointed out separately within the online service and the necessary consent of the users obtained.
Cookies are a common technique used to transmit information from an online service to users' browsers in order to store it for a defined period of time. The browsers automatically send this information back to the online service on later requests, so that information can be exchanged between the two sides.
The storage period for cookies depends on the purpose. Either cookies are stored for the duration of the current session only (until the browser is closed) or for a certain period of time, so that they persist even after the browser has been closed (for example, 30 days).
Regardless of the set storage time, users can delete cookies from their browsers at any time or configure their browsers to not accept cookies or to confirm each acceptance in advance. The self-acting deletion, the complete deactivation of cookies or the rejection of individual cookies can lead to the fact that the online service can no longer be used to its full extent.
2.3.2. JavaScript
Where appropriate, information is also stored in users' browsers using JavaScript. In contrast to the use of cookies, the information is only available within the browsers, so the browsers do not automatically send this information back to the online service on later requests.
As in the case of cookies, data is automatically deleted or persisted when closing the browser, depending on its purpose. The exact storage time is managed by the browser itself.
Regardless of the set storage time, users can delete the data at any time or configure their browsers so that the data storage features or JavaScript as a whole are not available. The self-acting deletion, the complete deactivation of these features or of JavaScript as a whole can lead to the fact that the online service can no longer be used to its full extent.
3. Features and contents
The following subsections provide detailed information on the nature, scope and purpose of the collection and processing of personal data that occurs when certain features and contents of the online service are used.
The operator provides different ways of contact, e.g. by mail, e-mail, telephone or via provided functions within the online service.
The transmitted data is processed and stored for the following purposes:
Detection, defense and prosecution of unlawful or abusive contacts
Archiving contacts for users who are already in a customer relationship with the operator
Performance of statutory retention requirements
The processing of contacts via provided functions within the online service takes place with the prior consent of the user. Contacts by other means are processed due to a legitimate interest of the operator. In addition, if the establishment of contact aims at concluding a contract, the legal basis of processing is Art. 6 para. 1 lit. b GDPR.
The data transmitted during a contact can be stored in programs or databases for managing contacts and customer relationships (for example in a customer relationship management system).
3.1.1. Contacts by e-mail
When contacting by e-mail, data may be transmitted unencrypted (for example, between the participating e-mail servers). Furthermore, an email may not arrive at the intended recipient due to spam filters or technical issues.
3.1.2. Contacts by phone
When contacting by phone, the phone number of the user can be transmitted. It may be displayed in the device of the called party and stored there for the purpose of recall (for a device-dependent duration).
The transmission of the user's phone number can be prevented, if the user suppresses it before contacting.
3.2. Opinion on the online service
By using the feature to leave your opinion about the operator's online service for the purpose of publication (in anonymous, shortened or translated form), the following personal information will be processed:
Opinion in text form
The information is stored for an indefinite period of time.
Only the operator has access to the original information. The information can be made accessible to all users of the online service in anonymised, possibly shortened or translated form.
3.3. Registration with an e-mail address
When using the feature to verify a user's identity using the e-mail address, the following personal information will be processed:
In order to verify new e-mail addresses, the e-mail address is buffered until the confirmation e-mail is sent (usually a few seconds), after which it is deleted and stored only anonymously.
With the confirmation of the e-mail address by the recipient of the confirmation e-mail, the e-mail address is stored in a readable form until it is blocked, replaced, or the user account is deleted.
The blocking of e-mail addresses by the recipient of an e-mail is done using hash values. The e-mail addresses are not saved for this purpose. The hash values are stored for an indefinite period of time..
Only the operator has access to saved e-mail addresses.
3.4. User account
The creation of a user account is required for the use of additional functions, so that other users learn something about the user for the purpose of getting to know each other. The following personal data is processed:
The storage takes place until the user account has not been deleted by the user and the operator can assume that the user is still interested in further use (usually 90 days after the last use of functions).
All users of the online service have access to the above information.
3.5. Ads
When using the feature to create an ad for the purpose of beeing contacted by other users, the following personal information will be processed:
Text of the ad
The ad will be stored from the moment the ad is saved to the expiration of the ad, plus a transitional period of 7 days, during which users may extend the ad. The ad expires 30 days after the ad has been checked or 30 days after the last extension by the user.
3.6. Contacts with users
By using the feature to contact other users and continue these contacts, the following personal information will be processed for the purpose of communicating with other users:
The data is stored until the contact is terminated by one of the communication participants or the user account of one of the communication participants is deleted.
Only the communication participants have access to the written messages. The operator usually has no access, since the storage is encrypted and only the communication partners have the key. However, a communication participant may grant access to the operator, e.g. in case of violations of the terms of use.
Users may request information on the categories of processed data, processing purposes, potential recipients of the data and the planned storage period (Art. 15 GDPR) as well as the correction of inaccurate and the supplement of incomplete data (Art. 16 GDPR). They has the right to receive previously provided data and transmit it to others (Art. 20 GDPR).
Under certain conditions, users have the right to request the deletion of data, in particular if the data is no longer required for its intended purpose or unlawfully processed (Art. 17 GDPR), or they may request the restriction of data, as far as a deletion is not possible or the deletion is disputed (Art. 18 GDPR).
Users may withdraw previously given consent as well as data processing for the purpose of direct marketing at any time with effect for the future (Art. 7 para. 3 GDPR and Art. 21 para. 2 GDPR). In addition, they may object the data processing that is performed due to a legitimate interest of the operator, for reasons arising from their specific situation (Art. 21 para. 1 GDPR).
Users have the right to submit a complaint to the competent supervisory authority (Art. 77 GDPR) if they consider that the processing of their personal data violates the GDPR.