© Leipziger Messe GmbH, 09/2018 (M6687)
I. Name and address of the responsible party
The party responsible within the meaning of the EU's General Data Protection Regulation and other national data protection laws of the EU member states as well as further data protection regulations is:
Leipziger Messe GmbH
Messe-Allee 1 • 04356 Leipzig • Germany
Phone: +49 341 / 678-0
represented by its management: Martin Buhl-Wagner and Markus Geisenberger.
Commercial register number:
Leipzig Local Court, HRB 622
II. Address of the data protection officer
III. General information on data processing
1. Extent of the processing of personal data
We only process the personal data of our users if this is necessary to provide a functional website as well as our contents and services. The processing of the personal data of our users normally takes place only after consent has been provided by the user. An exception applies in such cases in which the processing of the data is permitted by legal regulations.
2. The legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 Section 1 a of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
In the processing of personal data required for the performance of a contract to which the data subject is a party, Art. 6 Section 1 b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 Section 1 c GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 Section 1 f GDPR serves as the legal basis for processing.
3. Data deletion and storage time
The user's personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Furthermore, data may be stored if this has been provided for by the European or national legislators in EU regulations, laws or other provisions to which the responsible party is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.
IV. Provision of the website and creation of log files
Every time you visit our website, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
- browser type and version,
- the operating system used,
- the website from which you visit us (referrer URL),
- the web page on which you are currently browsing,
- date and time of the respective access and
- your IP address.
The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
The legal basis for the temporary storage of data and log files is Art. 6 Section 1 f GDPR.
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose the IP address of the user must remain stored for the duration of the session.
The data is stored in log files to ensure the functionality of the website. In addition, the data helps us to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
Our legitimate interest in data processing is also in accordance with Art. 6 Section 1 f GDPR.
The personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this applies when the respective session has ended.
If the data is stored in log files, it is implemented after three months at the latest.
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user.
V. Data processing upon registration of a user account
If you wish to use specific functions of our website (e.g. ordering tickets or creating bookmarks) you will need a user account. When you register a user account we process the following data:
- email address (required)
- salutation (optional)
- title (optional)
- surname, first name (required)
- address (optional)
- telephone (optional)
- company (optional)
- position (optional)
whereby the data marked 'optional' is voluntary.
Registration of a user account via Keycloak:
For selected events, it may be necessary for the user to have a Keycloak user account.
During registration you will be asked to create an SSO (Single-Sign-On) access via Keycloak.
You can find all information about the tool used at https://www.keycloak.org/
The following categories of personal data can be processed as part of the user registration: First name, last name, e-mail address, address, telephone number, position, occupation, institution
This data will be processed for the purpose of controlling access to applications and for user identification.
Our service providers receive this data on the basis of Art. 6 Section 1 b GDPR. We have signed Data Processing Agreements with our service providers (Art. 28 GDPR).
The personal data recorded in Keycloak will only be processed with the active consent of the data owner (Art. 6 Section 1 a GDPR) (does not apply to contacting for the performance of the contract according to Art. 6 Section 1 b GDPR).
If the processing of the specified personal data is necessary for the implementation of a pre-contractual measure, Art. 6 Section 1 b GDPR serves as the legal basis for the processing of the data. If the processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 Section 1 c GDPR serves as the legal basis for the processing of the relevant data.
In other respects, the processing of this personal data is necessary to safeguard a legitimate interest of our company, which means that Art. 6 Section 1 f GDPR serves as the legal basis for the processing.
The purpose of the data processing is to provide various functions on our website (e.g. ordering tickets or creating bookmarks) which can not be used without registration and the use of a user account. This purpose also covers our justified interest in the processing of the personal data of users in accordance with Art. 6 Section 1 f GDPR.
Within the scope of registration and use of the user account, we store the IP address and the time of the individual user actions. The storage is based on our legitimate interests (Art. 6 Section 1 f GDPR), as well as in the interest of the user in the protection against misuse and other unauthorised use of the user account by a third party.
The personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and there is no statutory requirement for its storage. This requirement does not apply as soon as the user deletes his/her user account. In the case of the legal archiving obligations, the deletion takes place after their expiration.
Registering a Matchmaking Account
The Matchmaking platform provided by Leipziger Messe GmbH enables registered exhibitors and visitors to schedule meetings (purpose of data collection).
The data in the profiles is visible to all Matchmaking users at the relevant event.
The following personal data can be processed for user registration. Name, surname, email address, postal address, telephone number, position, profession, institution, profile picture.
Our service provider processes this data on the basis of Art. 6 Section 1 b GDPR. We have concluded contract processing agreements with our partners (Art. 28 Section 3 GDPR).
Leipziger Messe processes this data on the basis of Art. 6 Section 1 b and also f GDPR.
Within the scope of registration and use of the user account, we store the IP address and the time of the individual user actions. The storage is based on our legitimate interests (Art. 6 Section 1 f GDPR), and the protection of users against misuse and other unauthorised use of the user account by a third party.
The use of our Matchmaking platform requires the respective user to have a Keycloak account.
Login to the user account with Facebook or LinkedIn:
Users also have the option of logging into their user account using their Facebook or LinkedIn login data. Facebook is a service operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. LinkedIn is a service provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. The LinkedIn Corporation has submitted to the EU-US Privacy Shield.
Users registered on Facebook or LinkedIn can use the "Login/Register" function with Facebook or LinkedIn on our website to log in to their user account on our website without having to register separately with us, i.e. without having to enter the data required to register a user account on our website.
In order to enable this function, the data protection regulations must be accepted during registration. If the registration function via Facebook or LinkedIn on our website is used, Facebook or LinkedIn provides us with information about the user. This provision of information is initiated by the fact that after activating the registration function on our site, the user is redirected to a Facebook or LinkedIn website and asked by Facebook or LinkedIn for permission to access certain information from their Facebook or LinkedIn database. If permission is granted by the user, Facebook or LinkedIn will transmit this information to us. We now carry out a data check, i.e. we only store the data that we would normally collect from the user when registering a user account on our website. Of course, the links can also be deleted at any time. To that end, the user must withdraw the corresponding access rights on Facebook or LinkedIn.
The legal basis for the processing of this data is Art. 6 Section 1 a GDPR.
The storage and processing of all the above-mentioned data transmitted to us by Facebook or LinkedIn can be revoked at any time with effect for the future.
For more information about the options for privacy settings on Facebook and the related privacy rights, please visit https://www.facebook.com/about/privacy
Further information on data protection and the setting options on LinkedIn can be found at https://www.linkedin.com/legal/privacy-policy?_l=de_DE .
VI. Data processing when ordering from the online shop
If you place an order in our shop system, we store the information you entered during the order process. This is the following data:
- surname, first name
- email address
- date of birth
- payment type, status and reference
- surname, first name of ticket holder
- if applicable company
- if applicable industry
- if applicable position
- type of participant
- download time ticket
The legal basis for the processing of this data is Art. 6 Section 1 b GDPR.
In connection with the purchase of a ticket, Leipziger Messe GmbH reserves the right to inform you about this and similar proprietary events. You have the right to object at any time to the use of your data for advertising. You will not incur any costs other than the transmission costs according to basic rates. To revoke the use of your data please contact email@example.com
We may pass your data onto our contract partner (currently Gelzus rmm Marketing Research GmbH) for the purpose of a customer survey after the event. We have concluded contract processing agreements with our partners in accordance with Art. 28 of the GDPR.
The purpose of this data processing is to carry out the contractual relationship concluded between us and you (e.g. ticket order, stand registration). The data will not be processed for any other purpose.
The personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and there is no statutory requirement for its storage. In the case of statutory archiving obligations, the deletion takes place after their expiry (commercial law 6 years and tax law 10 years).
The following data is stored and transmitted in the cookies:
- session ID
The legal basis for the processing of personal data using cookies is Art. 6 Section 1 f GDPR.
We need cookies for the following applications:
- identification of the user session in the server's memory, for the fulfilment of orders in the web shop system, creation of bookmarks and operation of the user's personal user account.
The user data collected by cookies is not used to create user profiles.
For these purposes, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 Section 1 f GDPR.
Interested parties have the possibility to subscribe to a free newsletter. When registering for the newsletter, the data from the input mask is transmitted to us. This is the
- email address (required field)
- first name (optional)
- name (optional)
- gender (optional)
whereby the data marked 'optional' is voluntary. In addition, the following data is collected upon registration:
- the anonymised (i.e. truncated) IP address of the accessing computer;
- the date and time of registration;
In connection with data processing for the dispatch of newsletters, no data is passed on to third parties. The data will be used exclusively for sending users the newsletter.
The legal basis for the processing of the data after registration for the newsletter by the user is Art. 6 Section 1 a GDPR.
The recording of the user's email address serves the distribution of the newsletter by email. The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. The user's email address will therefore be stored for as long as the subscription to the newsletter is active.
The subscription to the newsletter can be cancelled by the user at any time. For this purpose there is a corresponding link in every newsletter.
IX. Contact form and email contact
Contact forms are available on our website which can be used for electronic contact. If a user takes advantage of this possibility, the data entered in the input mask will be transmitted to us and stored. This data is:
- surname, first name, function, department
- telephone number
- fax number
- email address
- text of the request
- area of interest,
although only the surname, first name, address, telephone number and email address are mandatory.
At the time the message is sent, the following data is also stored:
- the IP address of the user
- the date and time of the contact request
Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted by email will be stored.
In this context the data will not be passed on to third parties. The data is used exclusively for processing the conversation.
The legal basis for the processing of data is Art. 6 Section 1 a GDPR if the user has given his consent.
The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 Section 1 f GDPR. If the email contact aims at the conclusion of a contract, then the additional legal basis for the processing is Art. 6 Section 1 b GDPR.
The processing of the personal data from the input mask serves only for the processing of the establishment of contact. In the event of contact by email, this also constitutes a legitimate interest in the processing of the data.
The other personal data processed during the distribution process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
The personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and the data sent by email, this is the case when the respective conversation with the user is completed. The conversation is completed when it can be inferred from the circumstances that the facts in question have been finally clarified.
The additional personal data collected during the distribution process will be deleted after a period of three months at the latest.
The user has the possibility to revoke his/her consent to the processing of personal data at any time. If the user contacts us by email, he/she can object to the storage of his/her personal data at any time. In such a case, the conversation cannot be continued. The user only has to inform us about the withdrawal of his/her declaration of consent. All personal data stored in the course of contacting us will be deleted in this case.
X. Google Analytics
We use Google Analytics on our website. Google Analytics is a web analytics service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Web analysis is the collection, compilation and evaluation of data about the behaviour of users on our website. A web analysis service collects, for example, data on which website the user came from, which subpages of the website were accessed or how often and for how long a subpage was viewed.
We use the addition "_gat._anonymizeIp" for web analysis via Google Analytics. By means of this addition, Google shortens the IP address of the user and thus makes it anonymous if our internet pages are accessed from a member state of the European Union or from another state party to the Agreement on the European Economic Area. The shortening of the IP address results in anonymisation. It is then no longer possible to assign the abbreviated address to a specific or identifiable person.
Google Analytics places a cookie on the user's computer. By setting the cookie, Google is able to analyse the use of our website. Each time one of the individual pages of this website is called up, the internet browser on the user's computer is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. As part of this technical procedure, Google obtains knowledge of user data, such as the shortened IP address of the person concerned, which serves Google, among other things, to trace the origin of the visitors.
Cookies are used to store personal data, such as access time, the location from which access originated and the frequency of visits to our website by the user. Whenever you visit our website, this data, including the IP address of the internet connection used by the person concerned, is transmitted to Google in the USA. The personal data is also stored by Google in the USA. Google may disclose personal data collected through the technical process to third parties.
The legal basis for the processing of the data is Art. 6 Section 1 f GDPR and § 15 Section 3 Telemedia Act.
The purpose of using Google Analytics is to analyse the flow of visitors to our website. Google uses the data and information obtained to evaluate the use of our website in order to compile online reports for us that show the activities on our website, and to provide other services in connection with the use of our website. This enables us to further optimise our website for the user.
For these purposes, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 Section 1 f GDPR.
The data stored via Google Analytics will be automatically deleted by us after 26 months.
As already explained, the user can prevent the storage of cookies by our website at any time by means of an appropriate setting of the internet browser used and thus permanently object to the storage of cookies. In addition, a cookie already stored by Google Analytics can be deleted at any time via the internet browser or other software programmes.
Furthermore, the user has the possibility to object to the collection of data generated by Google Analytics as well as the processing of this data by Google and to prevent such collection. To do this, the user must download and install a browser add-on from the link https://tools.google.com/dlpage/gaoptout . This browser add-on automatically informs Google Analytics after installation that no data and information on visits to the user's internet pages may be transmitted to Google. The installation of the browser add-on is to be regarded as an objection. If the user's system is deleted, formatted and reinstalled in the future, the user must reinstall the browser add-on to deactivate Google Analytics.
Google has submitted to the EU-US Privacy Shield.
Weitere Informationen und die geltenden Datenschutzbestimmungen von Google können unter https://www.google.de/intl/de/policies/privacy/ und unter http://www.google.com/analytics/terms/de.html abgerufen werden. Google Analytics wird unter https://www.google.com/intl/de_de/analytics/ genauer erläutert.
Google hat sich dem EU-US Privacy Shield unterworfen.
XI. Google Conversion Tracking
Our website uses Google Conversion Tracking to draw attention to our offers with the help of advertising material on external websites. We can determine in relation to the data of the advertising campaigns how successful the individual advertising measures are. We are interested in showing you advertisements that are of interest to you, to make our website more interesting for you and to achieve a fair calculation of advertising costs.
The advertising media are delivered by Google via so-called "Ad Servers". For this purpose we use ad server cookies, through which certain parameters for measuring success, such as the insertion of ads or clicks by users, can be measured. If you access our website via a Google ad, Google AdWords stores a cookie on your computer. These cookies usually expire after 30 days and are not intended to identify you personally. For this cookie, the unique cookie ID, number of ad impressions per placement, last impression and opt-out information are usually stored as analysis values.
These cookies enable Google to recognise your internet browser. If a user visits certain pages of an AdWords customer's website and the cookie stored on their computer has not expired, Google and the customer can recognise that the user has clicked on the ad and has been redirected to this page. Each AdWords customer is assigned a different cookie. Cookies can therefore not be traced through the websites of AdWords customers. We do not process any personal data ourselves in the aforementioned advertising measures. We only receive statistical evaluations from Google. On the basis of these evaluations we can recognise which of the advertising measures used are particularly effective. We do not receive any further data from the use of advertising material; in particular, we cannot identify users on the basis of this information.
Due to the marketing tools used, your browser automatically establishes a direct connection to the Google server. We have no influence on the extent and the further processing of the data collected by Google through the use of this tool, and therefore inform you according to our level of knowledge: By integrating AdWords Conversion, Google receives the information that you have accessed the corresponding part of our internet presence or clicked on an advertisement from us. If you are registered with a Google service, Google may associate your visit with your account. Even if you are not registered with Google or have not logged in, it is possible that the provider may obtain and store your IP address.
We have no knowledge of the storage time at Google and have no influence on it.
You can prevent participation in this tracking procedure by setting your browser software accordingly (suppression of third-party cookies) or by deactivating the cookies for conversion tracking by setting your browser so that cookies are blocked by the domain "www.googleadservices.com" or by permanently deactivating them using the browser plug-in in the browsers Firefox, internet Explorer or Google Chrome under the link http://www.google.com/settings/ads/plugin .
Google has submitted to the EU-US Privacy Shield. The legal basis for this data processing on our website is § 15 Section 3 Telemedia Act.
XII. Google Tag Manager
This website uses the Google Tag Manager from Google. This service allows website tags to be managed through an interface. The Google Tag Manager only implements tags. This means that no cookies are used and no personal data is collected. The Google Tag Manager triggers other tags that may collect data. However, the Google Tag Manager does not access this data. If deactivation has been implemented at the domain or cookie level, it remains valid for all tracking tags if they are implemented with the Google Tag Manager.
We work together with Aumago GmbH ("Aumago"), Berlin, a target group marketer. Aumago uses so-called cookies, a text file that is stored in the browser of the computer. Pseudonymous usage data in the form of cookie IDs and advertising IDs without the IP addresses of the user in the cookie are collected.
The cookie ID and advertising IDs without IP address are not sufficient to identify a natural person behind a browser / user.
Aumago assumes an interest in a specific B2B industry based on the user's surfing behaviour (website visited, categories, product pages) and uses this information on our behalf to direct more targeted, usage-based online advertising.
Cookies can be synchronised with other platforms via so-called cookie matching. Matching can take place, for example, for: Google, Doubleclick, Adition, Appnexus, Mediamath, The Trade Desk, Adform, Active Agent, yieldlab.
The cookies are either Aumago cookies or cookies from service providers that Aumago uses, such as The ADEX GmbH, Berlin. The user can opt-out at any time via the following link ( https://dmp.theadex.com/donttrack/1?rdr=http://www.theadex.com/opt-out ) and thus object to the relevant cookie tracking. This sets an opt-out cookie. The opt-out cookie requires that a setting in the browser does not prevent the storage of cookies or deletes the cookie. After deleting the opt-out cookie, the user needs to repeat the objection. Alternatively, the user can delete the cookies directly in the browser, set the browser settings to "do not track" right from the start or manage cookie preferences here. ( http://www.youronlinechoices.com/de/praferenzmanagement/ )
If you would like to receive information about the information stored in your cookie, please send us your cookie ID.
The legal basis for this data processing on our website is § 15 Section 3 Telemedia Act.
XIV. Wired Minds
Products and services of WiredMinds GmbH, Lindenspürstraße 32, 70176 Stuttgart ("WiredMinds") (www.wiredminds.de) are used on our website for marketing and optimisation purposes. During the process, data is processed and used to create user profiles under a pseudonym. As far as possible, the user profiles are rendered completely anonymous. Cookies may be used for this purpose. Cookies are small text files that are stored in the user's internet browser and serve to recognise the internet browser. The collected data is transmitted to WiredMinds or collected directly by WiredMinds. WiredMinds may use information left behind by visits to the websites to create anonymous user profiles. The data obtained in this way will not be used to personally identify the visitor to this website without the separately given consent of the person concerned, and will not be combined with personal data about the bearer of the pseudonym. If IP addresses are collected, they will be made anonymous immediately after collection by deleting the last number block. The data processing can be rejected at any time with effect for the future. You can prevent detection by WiredMinds by clicking on the following link. An opt-out cookie is set to prevent future collection of your data when you visit this website:
The legal basis for this data processing on our website is § 15 Section 3 Telemedia Act.
This website uses the affiliate advertising networks of AWIN AG, Eichhornstraße 3, 10785 Berlin ("AWIN"). Conversion tracking is used in this context.
If you have reached the above-mentioned website via an advertising medium of one of these affiliate networks, a valid cookie will be set for 90 days. Within this time we and the respective affiliate network can recognise that the user has been redirected to the above page.
These cookies are used to generate statistics that evaluate in anonymous form whether sales have been generated via this contact. This evaluation is used to bill and evaluate advertisements and does not contain any personal data about you.
If you do not wish cookies to be stored in your browser, you can do so by setting your browser accordingly. You can deactivate the storage of cookies in your respective browser under Tools/internet options, limit them to certain websites or set your browser so that it notifies you as soon as a cookie is sent. Please note, however, that in this case you must expect a limited display of the online offers and limited user guidance. You can also delete cookies at any time. In this case, the information stored in the cookie is removed from your mobile device.
The legal basis for this data processing on our website is § 15 Section 3 Telemedia Act.
This website uses an ad server service of Adform Germany GmbH ("Adform"). Adform uses so-called "cookies", text files which are stored on your computer and which enable an analysis of the advertising banners you have seen and which we have been placed as well as the determination of whether or not a ticket has been purchased ("conversion tracking"). The cookie contains an advertising identification number and is valid for 28 days. The IP addresses of the computer you use will only be stored (pseudonymised) by Adform in a shortened form. Furthermore, no personal characteristics such as address, first name, surname, address, email address, etc. are recorded by Adform, via which you could be personally identified. However, the advertising ID can be used to pseudonymise which advertising material drew your attention to Leipziger Messe and whether you bought a ticket in the online shop of Leipziger Messe. You can also be recognised when you return to the website or as part of an advertising campaign. Leipziger Messe does not under any circumstances combine the advertising identification number with personal data. Users who do not wish to participate in the analysis can deactivate the Adform cookie via their browser at http://site.adform.com/privacy-policy-opt-out
The information generated by the cookie about your use of this website is transferred to an Adform server in the EU and stored there. The opt-out procedure deletes all previously collected data and places an alternative Adform cookie in the internet user's browser, which specifically indicates an "opt-out" selection and contains no further data.
The cookie only applies to the respective computer or mobile device and browser. If a user wants to log out of other browsers, computers or mobile devices, he/she must repeat the process. Please also note that if all cookies are deleted from the computer or mobile device, the opt-out cookie is also deleted and the process must be repeated.
We use Adform to enable the delivery of advertisements,
to measure and evaluate the success of our advertisements and to record and evaluate purchases made by users clicking on an advertisement. On the basis of the statistics we can improve our offer and make it more interesting for you as a user. We can also show you more relevant advertising.
Contact data of the third party: Adform, Wildersgade 10B, 1408 Copenhagen, Denmark.
The legal basis for this data processing on our website is § 15 Section 3 Telemedia Act.
1. Facebook Social Plugin
On the basis of our legitimate interests (interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 Section 1 f GDPR) we use the social plugins ("plugins") of the social network facebook.com, which is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"). The plugins can display interaction elements or content (e.g. videos, graphics or text contributions) and are recognisable by one of the Facebook logos or are marked with the addition "Facebook Social Plugin". The list and appearance of Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/ .
Facebook has submitted to the EU-US Privacy Shield.
When a user calls up a function of this online offer that contains such a plugin, his/her device establishes a direct connection to the Facebook servers. The content of the plugin is transmitted by Facebook directly to the user's device and integrated into the online offer. The processed data can be used to create user profiles. We therefore have no influence on the amount of data Facebook collects with the help of this plugin, and therefore inform users according to our level of knowledge.
By integrating the plugins, Facebook receives information that a user has accessed the corresponding page of the online offer. If the user is logged in to Facebook, Facebook can assign the visit to his/her Facebook account. When users interact with the plugins, for example by pressing the like button or making a comment, the corresponding information is transmitted directly from their device to Facebook and stored there. If a user is not a member of Facebook, it is still possible for Facebook to obtain and store their IP address. According to Facebook, only an anonymised IP address is stored in Germany.
The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the relevant rights and setting options for the protection of users' privacy, can be found in Facebook's data protection information: https://www.facebook.com/about/privacy/ .
If a user is a Facebook member and does not want Facebook to collect data about him via this online offer and link it to the membership data stored on Facebook, he/she must log out of Facebook before using our online offer and delete his/her cookies. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/ . The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
2. Facebook Pixel
Due to our legitimate interests in the analysis, optimisation and economic operation of our online offer and for these purposes, the so-called "Facebook pixel" of the social network Facebook is used within our online offer.
Facebook has submitted to the EU-US Privacy Shield.
With the help of the Facebook pixel, Facebook is able to determine the visitors to our online offering as a target group for the presentation of ads (so-called "Facebook ads"). Accordingly, we use the Facebook pixel to display the Facebook ads we post only to Facebook users who have also shown an interest in our online offering or who have certain features (e.g. interest in certain topics or products that are determined by the websites visited) that we transmit to Facebook (so-called "custom audiences"). We also use the Facebook pixel to ensure that our Facebook ads meet the potential interest of users and are not a nuisance. The Facebook pixel also helps us understand the effectiveness of Facebook ads for statistical and market research purposes by showing whether users have been redirected to our website after clicking on a Facebook ad (so-called "conversion").
Facebook processes the data in accordance with Facebook's Data Usage Policy. Accordingly, general information on the display of Facebook ads can be found in the Facebook Data Usage Policy: https://www.facebook.com/policy.php . For specific information and details about the Facebook pixel and how it works, please visit the Facebook Help section: https://www.facebook.com/business/help/651294705016616 .
You can object to the collection by the Facebook pixel and use of your data to display Facebook ads. To set what types of ads are displayed to you within Facebook, you can visit the page set up by Facebook and follow the instructions on usage-based advertising settings: https://www.facebook.com/settings?tab=ads . The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
We collect and process the information you submit via WhatsApp solely for the purpose of collecting, processing and handling your submissions. For this purpose we use the mobile phone number sent to us within the scope of your message. Further personal data is not necessary for the fulfilment of the above mentioned purpose. Your data will be processed on the basis of paragraph 6 section 1f of the GDPR. We will delete your transmitted data after your registration and an eventual response. If you send us photos as part of your message, please make sure that you do not violate the rights of third parties.
XIX. Processing of data in countries outside the European Economic Area
If we process data in third countries (countries outside the EU/EEA) or transfer it to companies in third countries, we will only do so if we are authorised to do so by you or by law. If there is no adequacy decision by the Commission in accordance with Art. 45 GDPR for the third country concerned, i.e. there is no adequate level of data protection in the third country, we ensure through contractual provisions (standard contractual clauses of the EU on data protection) or other suitable guarantees within the meaning of Art. 46 GDPR that your privacy and your personal data are also adequately and legally provided for within the company in the third country.
XX. Your rights as a data subject
If you process personal data, you as the data subject have the following rights with regard to the responsible party. To assert your rights below, please contact us:
1. Right to information
You can ask us to confirm whether personal data concerning you will be processed by us. If such processing has taken place, you can request the following information from us:
(1) the purposes for which the personal data is processed;
(2) the categories of personal data being processed;
(3) the recipients or categories of recipients to whom the personal data concerning you has been or is still being disclosed;
(4) the planned duration of the storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period;
(5) the existence of a right to rectification or deletion of personal data concerning you, a right to limitation of processing by the responsible party or a right to object to such processing;
(6) the existence of a right of complaint to a supervisory authority;
(7) any available information on the origin of the data if the personal data is not collected from the data subject;
(8) the existence of automated decision-making including profiling in accordance with Art. 22 Section 1 and 4 GDPR and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.
You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transmission.
2. The right to correction
You have a right of rectification and/or completion with regard to the responsible party if the personal data processed concerning you is incorrect or incomplete. The person responsible must make the correction without delay.
3. Right to limitation of processing
Under the following conditions, you may request that the processing of personal data concerning you should be restricted:
(1) if you dispute the accuracy of the personal data concerning you for a period of time that enables the responsible party to verify the accuracy of the personal data;
(2) the processing is unlawful and you refuse to delete the personal data and instead request that the use of the personal data be restricted;
(3) the responsible party no longer needs the personal data for the purposes of the processing, but you do need them to assert, exercise or defend legal claims, or
(4) if you have filed an objection to the processing in accordance with Art. 21 Section 1 GDPR and it has not yet been determined whether the legitimate reasons of the person responsible outweigh your reasons.
If the processing of personal data concerning you has been restricted, such data may only be processed - apart from being stored - with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on grounds of an important public interest on the part of the Union or a member state.
If the processing restriction has been restricted according to the above conditions, you will be informed by the responsible party before the restriction is lifted.
4. Right to deletion
a) Duty to delete
You may request the responsible party to delete the personal data relating to you without delay and the responsible party is obliged to delete this data without delay if one of the following reasons applies:
(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
(2) You revoke your consent, on which the processing was based in accordance with Art. 6 Section 1 a or Art. 9 Section 2 a GDPR, and there is no other legal basis for the processing.
(3) You file an objection against the processing in accordance with Art. 21 Section 1 GDPR and there are no overriding legitimate reasons for the processing, or you file an objection against the processing in accordance with Art. 21 Section 2 GDPR.
(4) The personal data concerning you has been processed unlawfully.
(5) The deletion of personal data relating to you is necessary to fulfil a legal obligation under Union law or the law of the member states to which the data controller is subject.
(6) The personal data concerning you was collected in relation to information society services offered in accordance with Art. 8 Section 1 GDPR.
b) Information to third parties
If the responsible party has made the personal data concerning you public and is obliged to delete it in accordance with Art. 17 Section 1 GDPR, it must take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data processors who process the personal data that you as the data subject have requested the deletion of all links to this personal data or of copies or replications of this personal data.
The right to cancellation does not exist insofar as the processing is necessary
(1) to exercise freedom of expression and information;
(2) for the performance of a legal obligation required for processing under the law of the Union or of the member states to which the responsible party is subject or for the performance of a task in the public interest or in the exercise of official authority conferred on the responsible party;
(3) for reasons of public interest in the field of public health in accordance with Art. 9 Section 2 h and i and Art. 9 Section 3 GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Art. Art. 89 Section 1 GDPR, insofar as the law referred to under a) is likely to make it impossible or seriously impair the attainment of the objectives of such processing, or
(5) to assert, exercise or defend legal claims.
5. Right to information
If you have exercised your right to have the responsible party correct, delete or limit the processing, it is obliged to inform all recipients to whom the personal data concerning you has been disclosed of this correction or deletion of the data or restriction on processing, unless this proves impossible or involves a disproportionate effort.
You have the right towards the person responsible to be informed of such recipients.
6. Right to data transferability
You have the right to receive the personal data concerning you that you have provided to the person responsible in a structured, standard and machine-readable format. In addition, you have the right to pass this data on to another responsible party without obstruction by the responsible party to whom the personal data was provided, provided that
(1) processing is based on consent in accordance with Art. 6 Section 1 a GDPR or Art. 9 Section 2 lit. a GDPR or on a contract in accordance with Art. Art. 6 Section 1 b GDPR and
(2) processing is carried out by means of automated methods.
In exercising this right, you also have the right to request that the personal data concerning you be transferred directly from one responsible party to another responsible party, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to transferability shall not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the controller.
7. Right of objection
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you under Art. 6 Section 1 e or f GDPR; this also applies to profiling based on these provisions.
The responsible party no longer processes the personal data concerning you, unless it can prove compelling reasons worthy of protection for the processing which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such advertising; this also applies to profiling, insofar as it is associated with such direct marketing.
If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
You have the possibility to exercise your right of objection in connection with the use of information society services by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.
8. Right to revoke the data protection declaration of consent
You have the right to revoke your data protection declaration of consent at any time. The revocation of consent will not affect the legality of the processing carried out on the basis of the consent until revocation.
9. Automated decision in individual cases including profiling
You have the right not to be subject to a decision based exclusively on automated processing - including profiling - that has legal effect against you or significantly impairs you in a similar manner. This does not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the responsible party,
(2) the legislation of the Union or of the member states to which the responsible party is subject is admissible and that legislation contains appropriate measures to safeguard your rights, freedoms and legitimate interests; or
(3) is implemented with your express consent.
However, these decisions may not be based on special categories of personal data in accordance with Art. 9 Section 1 GDPR, unless Art. 9 Section 2 a or g applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.
When using our website, the user is not subject to any such automated decisions in individual cases, including profiling.
10. Right of complaint to a supervisory authority
If you believe that the processing of your personal data contradicts the GDPR, you have the right to file a complaint with a supervisory authority, particularly in the member state where you reside, work or suspect an infringement has occurred, without prejudice to any other administrative or judicial remedies.
The supervisory authority to which the complaint has been lodged will inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.