Privacy policy

Introduction

With the following data protection declaration we would like to inform you about the types of personal data (hereinafter also referred to as “data”) we process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter also referred to collectively as “online offer”).

The terms used are not gender-specific.

Status: January 24, 2020

Table of contents

– Introduction
– Responsible
– Overview of the processing
– Applicable legal basis
– Security measures
– Transmission and disclosure of personal data
– Data processing in third countries
– Use of cookies
– Single sign-on registration
– Blogs and publication media
– Contact
– Provision of the online offer and web hosting
– Newsletter and broad communication
– online marketing
– Presence in social networks
– Plugins and embedded functions and content
– Deletion of data
– Amendment and update of the privacy policy
– Rights of the data subjects
– Definitions of terms

Responsible

Susanne Herbold
Am Schultsgarten 19
50129 Bergheim-Glessen
Germany

E-Mail: mail@susanne-herbold.art

Phone: +49 (0) 177 6823649

Impressum: https://susanne-herbold.art/en/impressum/

Overview of processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of processed data

Stock data (e.g. names, addresses).
Content data (e.g. text entries, photographs, videos).
Contact data (e.g. e-mail, telephone numbers).
Meta/communication data (e.g. device information, IP addresses).
Usage data (e.g. websites visited, interest in content, access times).

Categories of data subjects

interested parties.
communication partners.
Users (e.g. website visitors, users of online services).

Purpose of processing

Registration procedure.
Provision of our online offer and user-friendliness.
Visitor action evaluation.
Direct marketing (e.g. by e-mail or by post).
Feedback (e.g. collecting feedback via online form).
Interest-based and behavioral marketing.
Contact requests and communication.
Conversion measurement (measuring the effectiveness of marketing measures).
Profiling (creation of user profiles).
remarketing.
Reach measurement (e.g. access statistics, recognition of recurring visitors).
Security measures.
Tracking (e.g. interest/behavioural profiling, use of cookies).
Contractual performance and service.
Management and response to inquiries.

Applicable legal basis

In the following, we provide the legal basis of the Basic Data Protection Regulation (DSGVO), on the basis of which we process personal data. Please note that in addition to the regulations of the DSGVO, national data protection regulations may apply in your or our country of residence and domicile.

• Consent (Art. 6 para. 1 sentence 1 lit. a DPA) – The data subject has given his/her consent to the processing of personal data concerning him/her for one or more specific purposes.
• Fulfilment of a contract and pre-contractual requests (Art. 6 para. 1 sentence 1 letter b. DPA) – Processing is necessary for the performance of a contract to which the data subject is party or for carrying out pre-contractual measures taken at the request of the data subject.
• Protection of vital interests (Art. 6 para. 1 sentence 1 lit. d. DPA) – The processing is necessary to protect the vital interests of the data subject or of another natural person.
• Legitimate interests (Art. 6 para. 1 sentence 1 letter f. DSGVO) – The processing is necessary to safeguard the legitimate interests of the controller or of a third party unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data prevail.

National data protection regulations in Germany: In addition to the data protection regulations of the Basic Data Protection Regulation, national regulations on data protection apply in Germany. These include in particular the law on protection against misuse of personal data in data processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains special regulations on the right to information, the right to deletion, the right of objection, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision making in individual cases including profiling. Furthermore, it regulates data processing for the purposes of the employment relationship (§ 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships and the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.

Security measures

We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

Such measures shall include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, disclosure, security of availability and separation of data relating to them. Furthermore, we have established procedures to ensure that data subjects’ rights are exercised, data is deleted, and responses are made to any threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and processes in accordance with the principle of data protection, by designing technology and by using data protection-friendly default settings.

Shortening of the IP address: If it is possible or not necessary for us to save your IP address, we will shorten or have your IP address shortened. In the case of shortening the IP address, also known as “IP masking”, the last octet, i.e. the last two numbers of an IP address, are deleted (in this context, the IP address is an identifier individually assigned to an Internet connection by the online access provider). The purpose of shortening the IP address is to prevent or significantly impede the identification of a person based on his or her IP address.

SSL encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address line of your browser.

Transmission and disclosure of personal data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. The recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if the processing takes place in the context of the use of services of third parties or the disclosure or transfer of data to other persons, bodies or companies, this is only done in accordance with the legal requirements.

Subject to express consent or transfer required by contract or by law, we process or allow data to be processed only in third countries with a recognized level of data protection, including the US processors certified under the “Privacy Shield”, or on the basis of special guarantees, such as contractual obligations through so-called standard protection clauses of the EU Commission, the existence of certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO, information page of the EU Commission.

Use of cookies

Cookies sind Textdateien, die Daten von besuchten Websites oder Domänen enthalten und von einem Browser auf dem Computer des Benutzers gespeichert werden. Ein Cookie wird in erster Linie dazu verwendet, Informationen über einen Benutzer während oder nach seinem Besuch innerhalb eines Online-Angebots zu speichern. Zu den gespeicherten Informationen können z.B. die Spracheinstellungen auf einer Website, der Anmeldestatus, ein Warenkorb oder der Ort, an dem ein Video angesehen wurde, gehören. Der Begriff “Cookies” umfasst auch andere Technologien, die dieselben Funktionen wie Cookies erfüllen (z.B. wenn Benutzerinformationen unter Verwendung von pseudonymen Online-Identifikatoren gespeichert werden, die auch als “Benutzer-IDs” bezeichnet werden)

The following cookie types and functions are distinguished:

• Temporary cookies (also: session or session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his browser.
• Permanent Cookies: Permanent cookies remain stored even after closing the browser. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. The interests of users used for reach measurement or marketing purposes can also be stored in such a cookie.
• First-Party-Cookies: First-Party-Cookies are set by ourselves.
• Third-party cookies (also: third-party cookies): third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
• Necessary (also: essential or absolutely necessary) cookies: Cookies can be absolutely necessary for the operation of a website (e.g. to store logins or other user entries or for security reasons).
• Statistical, marketing and personalization cookies: Furthermore, cookies are generally also used in the context of range measurement as well as when the interests of a user or his behavior (e.g. viewing certain content, using functions, etc.) are stored in a user profile on individual websites. Such profiles are used to show users e.g. content that corresponds to their potential interests. This procedure is also known as “tracking”, i.e. following the potential interests of users. . If we use cookies or “tracking” technologies, we will inform you separately in our privacy policy or when you give your consent.

Information on legal bases: The legal basis on which we process your personal data using cookies depends on whether we ask you for your consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is the declared consent. Otherwise, the data processed with the help of cookies will be processed on the basis of our legitimate interests (e.g. in a business operation of our online offer and its improvement) or, if the use of cookies is necessary to fulfil our contractual obligations.

General information on revocation and objection (opt-out): Depending on whether processing is based on consent or legal permission, you have the option at any time to revoke any consent you have given or to object to the processing of your data by cookie technologies (collectively referred to as “opt-out”). You can initially declare your objection by means of the settings of your browser, e.g. by deactivating the use of cookies (although this may also restrict the functionality of our online service). An objection to the use of cookies for online marketing purposes can also be declared by means of a variety of services, especially in the case of tracking, via the web pages. In addition, you can receive further notices of objection in the context of the information on the service providers and cookies used.

Processing of cookie data based on consent: Before we process or have processed data in the context of the use of cookies, we ask users for their consent, which can be revoked at any time. Before consent has not been given, we will only use cookies if necessary for the operation of our online service. Their use is based on our interest and the interest of the users in the expected functionality of our online offer.

• Processed data types: Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Persons concerned: Users (e.g. website visitors, users of online services).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. DSGVO)

Single sign-on registration

Single sign-on” or “single sign-on registration or authentication” are procedures that allow users to register with a provider of single sign-on procedures (e.g. a social network), including our online service, using a user account. The prerequisite for single sign-on authentication is that users are registered with the respective single sign-on provider and enter the required access data in the online form provided for this purpose, or are already registered with the single sign-on provider and confirm the single sign-on registration via button.

The authentication is carried out directly with the respective single sign-on provider. Within the scope of such authentication, we receive a user ID with the information that the user is logged in under this user ID at the respective single sign-on provider and an ID (so-called “user handle”) that cannot be used by us for other purposes. Whether additional data is transmitted to us depends solely on the single sign-on procedure used, on the selected data releases within the scope of authentication and also on the data that users have released in the privacy or other settings of the user account with the single sign-on provider. Depending on the single sign-on provider and the choice of users, the data can be different, usually the e-mail address and the user name. The password entered with the single sign-on provider as part of the single sign-on procedure is neither visible to us nor is it stored by us.

Users are asked to note that the information stored with us can be automatically compared with their user account with the single sign-on provider, but this is not always possible or actually happens. If, for example, the e-mail addresses of users change, they must change them manually in their user account with us.

We can use single sign-on registration, if agreed with the users, as part of or prior to the fulfillment of the contract, if the users have been asked to do so, we can process the single sign-on as part of a consent and otherwise use it on the basis of the legitimate interests on our part and the interests of the users in an effective and secure registration system.

If users should ever decide that they no longer wish to use the link of their user account with the single sign-on provider for the single sign-on procedure, they must cancel this link within their user account with the single sign-on provider. If users wish to delete their data from our system, they must cancel their registration with us.

• Processed data types: inventory data (e.g. names, addresses), contact data (e.g. e-mail, phone numbers).
• Persons concerned: Users (e.g. website visitors, users of online services).
• Purposes of processing: Contractual benefits and services, registration procedure.
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO), Fulfilment of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. DSGVO)

Used services and service providers: