1. Information on the collection of personal data and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how we handle your personal data when you use our website. In this context, personal data is all data by which you can be personally identified.

1.2 The controller for the data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is SPINOGY GmbH, Brunnenweg 17, 64331 Weiterstadt, Germany, phone: +49 6150 970 960, email: mail [at] spinogy.de. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser line.

2. Data collection when visiting our website

When using our website for purely informational purposes, i.e. if you do not register or otherwise provide us with information, we only collect such data as your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • Our website visited
  • Date and time at the time of access
  • Amount of data sent in bytes
  • Source/reference from which you reached the page
  • Browser used
  • Operating system used
  • IP address used (where applicable: in anonymized form)

The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to subsequently check the server log files if there are concrete indications of unlawful use.

3. Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted again after you close your browser (so-called "session cookies"), while others remain on your end device for longer and enable the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of the cookie settings of your web browser.

Insofar as personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the case of consent granted, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

Consent management and consent logging

When you first visit our website, you will be asked via a consent banner for your consent to the use of non-essential cookies or services (e.g. statistics). Technically necessary cookies are set without consent; non-essential services are only loaded after you have actively given your consent to this. We store your selection locally in your browser so that the banner does not appear again on every visit. You can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer; withdrawing consent for the "Statistics" category ends the relevant processing immediately.

To provide evidence of consent granted (Art. 7(1) GDPR), we log each consent on the server side. In doing so, we store the point in time, the version of the consent text, the categories you selected, whether you made the selection in the banner or changed it later via the cookie settings, a hashed (not stored in plain text) IP address as well as technical information about your browser (user agent) and the page accessed. The legal basis is our legal obligation to be able to demonstrate consent as well as our legitimate interest in legal certainty in accordance with Art. 6(1)(c) and (f) GDPR. The log entries are deleted automatically after three years.

In addition, we evaluate the log entries in aggregated form in order to assess how our consent banner works and how frequently which categories are chosen. For each day, we determine the number of decisions made in the banner and of later changes as well as how often each category was selected (broken down by version of the consent text, design of the banner, way the decision was made and language). We also count how often the banner is displayed. For this purpose, your browser sends a message to our server when the banner appears, and the server then only increases a daily counter. For this counter, we do not store an IP address, a hash value, a cookie or any information about your browser or the page accessed. Likewise, for every page view we count whether it is the first page of a visit or a further page and whether the visit came from one of our Google ads. Here, too, our server only increases daily counters, without an IP address, hash value, cookie or any information about your browser or the page accessed. Only totals are evaluated. Individual entries are not evaluated, and no conclusions are drawn about individual persons. The results can only be viewed internally by authorised staff. The legal basis is our legitimate interest in assessing and improving our consent banner and our website in accordance with Art. 6(1)(f) GDPR.

This log data and these evaluations are not passed on to third parties.

4. Contacting us

When you contact us (e.g. via the contact form or email), personal data is processed – exclusively for the purpose of handling and responding to your request and only to the extent necessary for this. The legal basis for the processing of this data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent this.

Configurator: saving and sending your configuration

If you use the "Save configuration by email" function in our configurator, we store the following data on our server:

  • time of saving
  • configuration number
  • your email address
  • value of the configuration (price)
  • language and page visited
  • content of the configuration (selected options)
  • time of your consent
  • status of the email dispatch

Your IP address is not stored in this process.

We process this data in order to send you the configuration by email, to handle your enquiry and to contact you about this configuration. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR, which you give by ticking the checkbox. If your enquiry is aimed at concluding a contract, the additional legal basis is Art. 6(1)(b) GDPR.

The data is deleted automatically after 24 months, or earlier if you withdraw your consent, provided that no statutory retention obligations prevent this. You can withdraw your consent at any time with effect for the future, for example by email to mail [at] spinogy.de.

Origin of your enquiry

If you send us an enquiry via the contact form, the repair form, the configurator or the notification about the X11 configurator, we store together with the enquiry the way you reached us. For this purpose, we evaluate the address of the website from which you opened the form page, which your browser transmits anyway. We store only the domain name of this website (e.g. "google.de"), a category derived from it (e.g. search engine, Google ad, AI assistant, social network, business directory, direct access) and, if you entered our website directly on the form page, its path without parameters. We do not store the full referring address, your IP address or identifiers from the address. If you reached our website via an external link, for example from a search engine, one of our ads or a social network, and only open the form later, we add only the category of this source to the address of the following pages as you click on (the parameter "sp_q", e.g. "Google ad" or "Instagram"). This allows us to assign your enquiry even if you did not enter our website directly on the form page. We do not pass on click identifiers such as the Google click ID or any other information. No information is stored on or read from your device for this purpose.

If you have consented to the "Statistics" category in the cookie banner, we instead take this information from the session history (see section "Google Analytics 4"), i.e. the domain and category of the website through which you first reached our website, and the first page you visited. We do not store the list of pages visited, the number of pages or the duration of your visit with the enquiry.

We use this information exclusively for our own evaluation of the channels through which enquiries arise. It is contained in our database and in the internal notification about your enquiry and is not passed on to advertising services. The legal basis is our legitimate interest in assessing our communication channels in accordance with Art. 6(1)(f) GDPR. Insofar as we use the session history for this purpose, the legal basis is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The information is deleted automatically together with your enquiry after 24 months.

Sending and receiving email

Emails that we send you via our website, such as your configuration or the confirmation of a form enquiry, are sent via the web server of our hosting provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We receive and process your enquiries and emails to us using Microsoft 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. In the process, your email address, the content of the email and technical transmission data are processed. Data processing agreements in accordance with Art. 28 GDPR are in place with both service providers. In the case of Microsoft, a transfer to Microsoft Corporation in the USA cannot be ruled out. Microsoft bases the transfer of personal data from the EEA to the USA on the standard contractual clauses of the EU Commission. The legal basis is our legitimate interest in secure and reliable email communication in accordance with Art. 6(1)(f) GDPR and, where the initiation or performance of a contract is concerned, Art. 6(1)(b) GDPR.

5. Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the respective extent necessary if you provide it to us when opening a customer account. You can find out which data is required for opening an account from the input mask of the relevant form on our website. You can delete your customer account at any time by sending a message to the above-mentioned address of the controller. After your customer account has been deleted, your data will be deleted, provided that all contracts concluded via it have been fully processed, no statutory retention periods prevent this and we no longer have a legitimate interest in continued storage.

6. Use of customer data for direct advertising

Subscription to our email newsletter

If you subscribe to our email newsletter, we regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary and is used to be able to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive newsletters once you have expressly confirmed your consent to receiving the newsletter by clicking a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent for the use of your personal data in accordance with Art. 6(1)(a) GDPR. In this context, we store the IP address entered by your internet service provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later point in time. The data collected by us when you subscribe to the newsletter is used strictly for the intended purpose. You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the controller named at the outset. After unsubscribing, your email address will be deleted immediately from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use the data beyond this, which is legally permitted and about which we inform you in this policy.

7. Data processing for order handling

7.1 Insofar as necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us is passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.

To process your order, we also work together with the following service provider(s) who support us in whole or in part with the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

7.2 Transfer of personal data to shipping service providers

Deutsche Post

If the goods are delivered by Deutsche Post (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn), we pass on your email address to Deutsche Post in accordance with Art. 6(1)(a) GDPR before the delivery of the goods for the purpose of arranging a delivery date or for delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we only pass on the name of the recipient and the delivery address to Deutsche Post in accordance with Art. 6(1)(b) GDPR. The transfer takes place only insofar as this is necessary for the delivery of the goods. In this case, prior arrangement of the delivery date with Deutsche Post or delivery notification is not possible.

Consent can be withdrawn at any time with effect for the future vis-à-vis the controller designated above or vis-à-vis Deutsche Post.

DHL

If the goods are delivered by the transport service provider DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), we pass on your email address to DHL in accordance with Art. 6(1)(a) GDPR before the delivery of the goods for the purpose of arranging a delivery date or for delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we only pass on the name of the recipient and the delivery address to DHL in accordance with Art. 6(1)(b) GDPR. The transfer takes place only insofar as this is necessary for the delivery of the goods. In this case, prior arrangement of the delivery date with DHL or delivery notification is not possible.

Consent can be withdrawn at any time with effect for the future vis-à-vis the controller designated above or vis-à-vis the transport service provider DHL.

7.3 Use of payment service providers (payment services)

Paypal

When paying via PayPal, credit or debit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal, we pass on your payment data as part of the payment processing to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). The transfer is carried out in accordance with Art. 6(1)(b) GDPR and only insofar as this is necessary for the payment processing.

For the payment methods credit or debit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal, PayPal reserves the right to carry out a credit check. For this purpose, your payment data may, in accordance with Art. 6(1)(f) GDPR, be passed on to credit agencies on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check with regard to the statistical probability of default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. Among other things, but not exclusively, address data is included in the calculation of the score values. For further data protection information, including on the credit agencies used, please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still remain entitled to process your personal data insofar as this is necessary for the contractual processing of payments.

8. Website functionalities

Google Customer Reviews (formerly Google Certified Shops program)

We work together with Google as part of the "Google Customer Reviews" program. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This program gives us the opportunity to obtain customer reviews from users of our website. In this context, after a purchase on our website you are asked whether you would like to participate in an email survey by Google. If you give your consent in accordance with Art. 6(1)(a) GDPR, we transmit your email address to Google. You will receive an email from Google Customer Reviews in which you are asked to rate the purchasing experience on our website. The rating you submit is then combined with our other ratings and displayed in our Google Customer Reviews logo as well as in our Merchant Center dashboard. In addition, your rating is used for Google Seller Ratings. As part of the use of Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC in the USA.

You can withdraw your consent at any time by sending a message to the controller responsible for the data processing or to Google.

You can access further information on Google's data protection in connection with the Google Customer Reviews program at the following link: https://support.google.com/merchants/answer/7188525?hl=de

You can read further information on the data protection of Google Seller Ratings at this link: https://support.google.com/google-ads/answer/2375474

Google Analytics 4

This website uses – exclusively after your express consent – the web analytics service Google Analytics 4. The provider is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and comparable technologies that enable an analysis of the use of our website. The information generated in this way about your use of this website is generally transmitted to a Google server and stored there; in doing so, a transmission to Google LLC in the USA may take place.

We have activated IP anonymization, so that your IP address is shortened by Google within the EU or the EEA before transmission. Google uses this information on our behalf to evaluate your use of the website, to compile reports on website activity and to provide further services associated with the use of the website. There is a data processing agreement with Google in accordance with Art. 28 GDPR.

The legal basis for the processing is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. Google Analytics is only loaded once you consent to the "Statistics" category in the cookie banner. You can withdraw your consent at any time with effect for the future via the "Cookie settings" (link in the footer).

Also only with your consent to the "Statistics" category, we create a session history in your browser's session storage (sessionStorage). It contains the time of your first page view, the most recently visited pages of our website (a maximum of 15, each as a path without parameters), the address of the website through which you reached us, whether you entered via an ad, and any source information contained in the address. If you submit an enquiry, save a configuration or click on telephone or consultation, we transmit to Google Analytics the pages visited, the entry page, the number of pages, the duration since the start of your visit and the domain name of the referring website. With an enquiry, we also store part of this in our database (see section "Origin of your enquiry"). The session history is deleted as soon as you withdraw your consent to the "Statistics" category, but at the latest when you close the browser tab.

Insofar as personal data is transmitted to the USA, Google relies on the EU-US Data Privacy Framework as well as additionally on standard contractual clauses of the EU Commission. You can find further information on the handling of user data at Google Analytics in Google's privacy policy: https://policies.google.com/privacy as well as at https://support.google.com/analytics/answer/6004245.

If you have also consented to the "Marketing" category, we also use the data for remarketing in Google Ads (see section "Google Ads: remarketing and attribution of enquiries").

Google Ads: remarketing and attribution of enquiries

If you have consented to the "Marketing" category in the cookie banner, we also use the data collected with Google Analytics for remarketing. For this purpose, we create audiences, for example from visitors to certain pages or from people who have added an item to their cart, and later show these audiences our ads on Google: currently in Google Search, in future possibly also on YouTube, in Gmail and in Google Discover. Membership in an audience ends after 180 days at the latest. We use Google Consent Mode for this: without your consent to the "Marketing" category, you are not added to any audience. We do not transmit names, email addresses or telephone numbers in this process. Google acts as our processor for creating the audiences in Google Analytics and as an independent controller for serving the ads in Google Ads.

If you reach our website via one of our ads on Google and have consented to the "Marketing" category, we also store the click identifier appended by Google to the address (gclid, gbraid or wbraid) as well as the campaign information (UTM parameters, e.g. source, medium and campaign). If you then send us an enquiry via the configurator, the contact form or the repair form, we store this information together with your enquiry. This lets us see which ad an enquiry resulted from. If an enquiry turns out to be qualified, we report the click identifier, the time and the type of enquiry back to Google Ads in order to optimise our advertising. We do not transmit names, email addresses or telephone numbers in this process.

The provider is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin 4, Ireland ("Google"). In the process, data may be transferred to Google LLC in the USA. In this respect, Google relies on the EU-US Data Privacy Framework as well as additionally on standard contractual clauses of the EU Commission. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. Without consent to the "Marketing" category, no click identifiers or campaign information are stored. The click identifier is kept for a maximum of 90 days. If it has been stored with an enquiry, it is kept for as long as the enquiry itself. You can withdraw your consent at any time with effect for the future via the "Cookie settings" (link in the footer). For information already stored with an enquiry, a message to mail [at] spinogy.de is sufficient. You can manage your ad settings with Google at https://adssettings.google.com. You can find further information in Google's privacy policy: https://policies.google.com/privacy

HubSpot live chat

On our website we offer – exclusively with your consent – a live chat through which you can ask us questions. The provider is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany ("HubSpot"). Your chat data is stored in HubSpot's European data centre. We have concluded a data processing agreement with HubSpot in accordance with Art. 28 GDPR.

Without your consent, the chat does not load. Instead, you see a button through which you can give your consent. Only then is the HubSpot software loaded and a connection to HubSpot established.

When you use the chat, we process the content of your messages, your details if you give us your name or email address, your IP address, the date and time, technical information about your browser and the page on which you started the chat. We only load HubSpot's chat software. We do not load HubSpot's visitor analytics. Data about your visit to our website, such as the pages you view, is not transmitted to HubSpot. The following cookies are set for the chat:

  • messagesUtk – recognises you in the chat so that the conversation history is kept, duration 180 days
  • hs-messages-is-open – stores whether the chat window is open, duration 30 minutes
  • __cf_bm – technical protection of HubSpot's servers against automated access (Cloudflare), set on HubSpot's domains, duration 30 minutes

The legal basis for loading the chat and the cookies set in the process is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You give your consent in the cookie banner (category "Chat") or via the button on the chat. You can withdraw it at any time with effect for the future via the "Cookie settings" (link in the footer).

We process the content you write to us in the chat, and the details it contains, in order to answer your enquiry. The legal basis is our legitimate interest in answering enquiries in accordance with Art. 6(1)(f) GDPR. If your enquiry concerns the initiation or performance of a contract, for example a quotation or an order, the legal basis is Art. 6(1)(b) GDPR. We do not use your details from the chat for advertising and do not create you as a marketing contact in HubSpot.

HubSpot is a subsidiary of HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA. A transfer of personal data to HubSpot, Inc. in the USA cannot be ruled out. HubSpot bases this transfer on the EU-US Data Privacy Framework and, in addition, on the European Commission's standard contractual clauses.

We delete chat histories 24 months after your last message, unless statutory retention obligations apply. Further information can be found in HubSpot's privacy policy: https://legal.hubspot.com/privacy-policy

Notification about the X11 configurator

On our X11 page and on the X11 product pages in our shop, you can sign up to receive a one-time email as soon as the configurator for the X11 is online. For this purpose, we process your email address, the page language, the wording of your consent, the time of your sign-up and of your confirmation, and a randomly generated code for the confirmation and unsubscribe links. We do not store your IP address for this purpose. We also store the page on which you signed up and the origin of your visit, as described under “Origin of your enquiry”. For each sign-up, we receive an internal notification with this information at our mailbox mail@spinogy.de, even before you have confirmed it. It is marked as unconfirmed. We do not use the address to contact you before you confirm. This data is used for this notification, as proof of your consent and to evaluate the channels through which sign-ups arise. You will not receive a newsletter as a result.

The legal basis is your consent in accordance with Art. 6(1)(a) GDPR. For the internal notification and the origin data, the legal basis is our legitimate interest in processing the sign-ups and in assessing our communication channels in accordance with Art. 6(1)(f) GDPR. Where we use the session history for this purpose, the legal basis is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. After you sign up, we send you an email with a confirmation link (double opt-in). We only add your address to the list once you have confirmed it. We protect the form against automated sign-ups with Cloudflare Turnstile (see “Spam protection with Cloudflare Turnstile”).

We store the data in a separate database table on our website’s server at our hosting provider IONOS SE. We send the emails in the same way as our other website emails (see “Sending and receiving email”). We delete unconfirmed sign-ups, including the internal notification, after 30 days and all other addresses as soon as we have sent the notification. We delete the internal notification for a confirmed sign-up together with the entry.

If you also tick the optional box “You may also contact me personally by email about the X11” and confirm your sign-up, we may write to you personally about the X11, for example to discuss your application or to send you a quote. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR. This consent is independent of the notification, and you can withdraw each separately. In this case, we delete your data 24 months after you signed up or as soon as you withdraw your consent.

You can withdraw your consent at any time via the unsubscribe link in our email or by email to mail@spinogy.de. This does not affect the lawfulness of processing carried out before the withdrawal.

Spam protection with Cloudflare Turnstile

To protect our forms, including the configurator, against misuse and automated requests (spam), we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Turnstile uses technical signals to check whether a request comes from a human or from an automated system. In doing so, Cloudflare processes, among other things, the IP address, information about the browser and device used, and technical characteristics such as the user agent and the TLS fingerprint. The processing serves exclusively to protect our website against abusive and automated requests. Turnstile does not process the content you enter in our forms.

With regard to the processing of the data required for the Turnstile service, Cloudflare acts as a processor. The processing is based on our legitimate interest in protecting our website and our forms against misuse and spam in accordance with Art. 6(1)(f) GDPR. The signals processed by Turnstile are technically necessary to detect and block automated requests.

A transfer of personal data to the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework and currently bases transfers of personal data from the European Economic Area to the USA on this certification. Should this basis cease to apply, Cloudflare states that it will in particular use the standard contractual clauses of the European Commission.

You can find further information on data processing by Cloudflare Turnstile in Cloudflare's Turnstile Privacy Addendum: Cloudflare Turnstile Privacy Addendum

9. Data subject rights

9.1 The applicable data protection law grants you the following data subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective conditions of exercise:

  • Right of access in accordance with Art. 15 GDPR;
  • Right to rectification in accordance with Art. 16 GDPR;
  • Right to erasure in accordance with Art. 17 GDPR;
  • Right to restriction of processing in accordance with Art. 18 GDPR;
  • Right to notification in accordance with Art. 19 GDPR;
  • Right to data portability in accordance with Art. 20 GDPR;
  • Right to withdraw consent granted in accordance with Art. 7(3) GDPR;
  • Right to lodge a complaint in accordance with Art. 77 GDPR.

9.2 Right to object

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL END THE PROCESSING OF THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT ADVERTISING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL END THE PROCESSING OF THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

10. Duration of storage of personal data

The duration of the storage of personal data is determined on the basis of the respective legal basis, the purpose of processing and – if applicable – additionally on the basis of the respective statutory retention period (e.g. commercial and tax law retention periods).

In the case of processing of personal data on the basis of an express consent in accordance with Art. 6(1)(a) GDPR, this data is stored until the data subject withdraws their consent.

If there are statutory retention periods for data that is processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after expiry of the retention periods, provided that it is no longer required for the performance of the contract or the initiation of a contract and/or we no longer have a legitimate interest in continued storage.

In the case of processing of personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object in accordance with Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defense of legal claims.

In the case of processing of personal data for the purpose of direct advertising on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object in accordance with Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy on specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.