Privacy policy

Whenever you enter your data on websites, place online orders or send emails over the internet, you must always expect that unauthorized third parties may access your data. There is no complete protection against such access. However, we do everything we can to protect your data as well as possible and to close security gaps as far as we are able to.

An important protective mechanism is the SSL or TLS encryption of our website, which ensures that data you transmit to us cannot be read by third parties. You can recognize the encryption by the padlock icon in front of the web address entered in your browser and by the fact that our web address begins with https:// and not with http://.

Payment data, such as account or credit card numbers, is particularly in need of protection. For this reason, payment transactions using the common means of payment are likewise carried out with us exclusively via an encrypted SSL or TLS connection.

At certain points in this privacy policy, we inform you how long we, or the companies that process your data on our behalf, store your data. Where no such information is given, we store your data until the purpose of the data processing no longer applies, you object to the data processing or you withdraw your consent to the data processing.

In the event of an objection or withdrawal, however, we may continue to process your data if at least one of the following conditions is met:

• We have compelling legitimate grounds for continuing the data processing which override your interests, rights and freedoms (only in the case of an objection to the data processing; if the objection is directed against direct marketing, we cannot put forward any legitimate grounds).
• The data processing is necessary for the establishment, exercise or defense of legal claims (does not apply if your objection is directed against direct marketing).
• We are legally obliged to retain your data.

In this case, we will delete your data as soon as the condition or conditions cease to apply.

IF YOU READ IN THIS PRIVACY POLICY THAT WE HAVE LEGITIMATE INTERESTS IN PROCESSING YOUR DATA AND THEREFORE BASE THE PROCESSING ON ART. 6(1)(F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THIS UNDER ART. 21 GDPR. THIS ALSO APPLIES TO PROFILING CARRIED OUT ON THE BASIS OF THAT PROVISION. THE PREREQUISITE IS THAT YOU STATE GROUNDS FOR THE OBJECTION ARISING FROM YOUR PARTICULAR SITUATION. NO REASONS NEED TO BE GIVEN IF THE OBJECTION IS DIRECTED AGAINST THE USE OF YOUR DATA FOR DIRECT MARKETING.

THE CONSEQUENCE OF THE OBJECTION IS THAT WE MAY NO LONGER PROCESS YOUR DATA. THE ONLY EXCEPTION IS WHERE ONE OF THE FOLLOWING CONDITIONS IS MET:

• WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS.
• THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

THESE EXCEPTIONS DO NOT APPLY IF YOUR OBJECTION IS DIRECTED AGAINST DIRECT MARKETING OR AGAINST PROFILING RELATED TO SUCH MARKETING.

Many data processing operations are based on your consent. You give this consent, for example, by ticking the relevant box on online forms before submitting the form, or by allowing certain cookies when you visit our website. You may withdraw your consent at any time without giving reasons (Art. 7(3) GDPR). From the time of withdrawal, we may then no longer process your data. The only exception: we are legally obliged to retain the data for a certain period of time. Such retention periods exist in particular under tax and commercial law.

If you believe that we are infringing the General Data Protection Regulation (GDPR), you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority. You may contact a supervisory authority in the Member State of your place of residence, of your place of work or of the place where the alleged infringement took place. The right to lodge a complaint exists in addition to any administrative or judicial remedies.

Data that we process by automated means on the basis of your consent or in performance of a contract must be handed over by us to you or to a third party in a commonly used, machine-readable format if you so request. We can transfer the data to another controller only where this is technically feasible.

Under Art. 15 GDPR, you have the right to obtain, free of charge, information about which personal data we have stored about you, where the data comes from, to whom we transmit the data and for what purpose it is stored. Should the data be incorrect, you have a right to rectification (Art. 16 GDPR); under the conditions of Art. 17 GDPR, you may request that we erase the data.

In certain situations, you may request under Art. 18 GDPR that we restrict the processing of your data. Apart from being stored, the data may then only be processed as follows:

• with your consent
• for the establishment, exercise or defense of legal claims
• for the protection of the rights of another natural or legal person
• for reasons of important public interest of the European Union or of a Member State

The right to restriction of processing exists in the following situations:

• You have contested the accuracy of your personal data stored by us and we need time to verify this. In this case, the right exists for the duration of the verification.
• The processing of your personal data is being carried out unlawfully or was unlawful in the past. In this case, the right exists as an alternative to the erasure of the data.
• We no longer need your personal data, but you need it for the exercise, defense or establishment of legal claims. In this case, the right exists as an alternative to the erasure of the data.
• You have lodged an objection under Art. 21(1) GDPR, and your interests and ours must now be weighed against each other. In this case, the right exists as long as the outcome of this balancing has not yet been determined.

Server log files record all requests made to our website and all access to it, and log error messages. They also include personal data, in particular your IP address. However, the provider anonymizes it after a short time, so that we cannot attribute the data to you personally. The data is transmitted automatically by your browser to our provider.

Our provider stores the server log files in order to be able to trace activity on our website and to identify errors. The files contain the following data:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address (anonymized, where applicable)

We do not combine this data with other data, but use it solely for statistical analysis and to improve our website.

We have a legitimate interest in ensuring that our website runs without errors. It is also in our legitimate interest to obtain an anonymized overview of access to our website. The data processing is therefore lawful under Art. 6(1)(f) GDPR.